System and method for training machine learning applications

A device comprising:

• one or more processors;
• and
• memory storing instructions that, when executed by the one or more processors, cause the device to:
• generate, for a plurality of files, metadata indicating one or more properties of the plurality of files;
• select, based on executing one or more queries that restrict membership in the first portion of the plurality of files based on one or more values of the metadata, a first portion of the plurality of files to train one or more machine learning models to classify the plurality of files as malign or benign;
• train, based on the first portion of the plurality of files, the one or more machine learning models;
• and
• determine, based on the one or more machine learning models, that a file from a second portion of the plurality of files is malign.

A non-transitory computer-readable medium storing instructions that, when executed, cause:

• generating, for a plurality of files, metadata indicating one or more properties of the plurality of files;
• selecting, based on executing one or more queries that restrict membership in the first portion of the plurality of files based on one or more values of the metadata, a first portion of the plurality of files to train one or more machine learning models to classify the plurality of files as malign or benign;
• training, based on the first portion of the plurality of files, the one or more machine learning models;
• and
• determining, based on the one or more machine learning models, that a file from a second portion of the plurality of files is malign.