Back to results
US 12,764,143 B2Granted
One-class threat detection using federated learning
AssigneeAvast Software s.r.o.
InventorsYue Zhao, Acar Tamersoy, Kevin Roundy, Daniel Kats, Michalis Pachilakis
Life of this patent
Estimating the term…
Abstract
A machine learning model is trained to classify data as malicious or benign, including receiving the machine learning model in a user device and training the machine learning model on the user device user-generated data that has been classified as known benign. A result of the training is sent to a remote server. Training samples on the user device may be classified automatically, such as classifying sent emails, instant messages, or other content generated by the user as benign.
Claims19
A method of training a machine learning model to classify data as malicious or benign, comprising:
- receiving in a user device a machine learning model configured to classify data as malicious or benign;
- training the machine learning model locally on the user device using user-generated data on the user device, the user-generated data classified as known benign, wherein training the machine learning model comprises training a user-specific one-class training model exclusively on the known benign user-generated data to establish a baseline behavioral profile for a user, wherein the user-generated data comprises only at least one of a user's sent email and/or sent messages, and wherein training the machine learning model comprises iteratively updating model parameters on the user device using stochastic gradient descent;
- determining, by the user device, whether a subsequently received or generated communication deviates from the baseline behavioral profile beyond a deviation threshold to identify anomalous behavior indicative of malicious activity;
- and
- sending a result of training the machine learning model to a remote server, wherein the result of training comprises one or more gradients generated by the local training on the user device, wherein the user generated data is not sent to the remote server, and wherein the one or more gradients generated as a result of the training are sent to the remote server to be applied to the machine learning model.
2 more elements
A method of training a machine learning model to classify data as malicious or benign, comprising:
- sending a machine learning model configured to classify data as malicious or benign from a server to a user device;
- and
- receiving from the user device a result of training the machine learning model locally on the user device using user-generated data on the user device, the user-generated data classified as known benign, wherein training comprises training a user-specific one-class anomaly detection model exclusively on the known benign user-generated data to learn a baseline behavioral representation of the user, wherein the user-generated data comprises only at least one of user-sent email, user-sent instant messages, and/or user-sent communication, and wherein training the machine learning model comprises local iterative training using stochastic gradient descent, and wherein receiving from the user device the result of training comprises receiving only one or more gradients generated as a result of the training without receiving the user-generated data, aggregating the received gradients to update a server version of the machine learning model, and sending an updated version of the machine learning model to one or more user devices.
A computerized system, comprising:
- a user device comprising a processor and a nonvolatile storage, the nonvolatile storage comprising coded instructions that when executed on the user device cause the user device to:
- receive a machine learning model configured to classify data as malicious or benign;
- train the machine learning model locally on the user device using user-generated data on the user device, the user-generated data classified as known benign, wherein training the machine learning model comprises training a user specific one-class training model exclusively on the known benign user-generated data to establish a baseline behavioral profile for a user, wherein the user-generated data comprises only at least one of a user's sent email and/or sent messages, and wherein training the machine learning model comprises locally updating model parameters using stochastic gradient descent;
- determine whether a subsequently received or generated communication deviates from the baseline behavioral profile beyond a deviation threshold to identify anomalous behavior;
- and
- send a result of training the machine learning model to a remote server, wherein the result of training comprises only one or more gradients generated as a result of the training that are sent to the remote server without transmitting the user-generated data, and wherein the remote server aggregates gradients received from a plurality of user devices to update a shared machine learning model and transmits an updated machine learning model to the user device.
3 more elements
Dependencies are inferred from the claim text.