Deployment of Machine Learning Models for Discernment of Threats

A system comprising:

• at least one data processor;
• and
• memory storing instructions which, when executed by the at least one data processor, result in operations comprising:
• detecting a mismatch between model-based classifications produced by a first version of a computer-implemented machine learning threat discernment model and a second version of a computer-implemented machine learning threat discernment model for a file, each of the first version of the machine learning threat discernment model and the second version of the machine learning threat discernment model for a file output a respective threat score, wherein the mismatch is based on a difference between the threat scores;
• and
• executing or accessing the file if the difference between the threat scores is below a pre-defined threshold;
• or
• analyzing the mismatch to determine appropriate handling for the file if the threat score is equal to or above a pre-defined threshold.

The system of claim 10 wherein:

• the analyzing comprises comparing a human-generated classification for a file, a first model version status that reflects classification by the first version of the machine learning threat discernment model, and a second model version status that reflects classification by the second version of the machine learning threat discernment model,
• the analyzing further comprises allowing the human-generated classification to dominate when it is available;
• and
• the operations further comprise:
• taking an action based on the analyzing.

A computer program product comprising non-transitory media storing instructions which, when executed by the at least one data processor, result in operations comprising:

• detecting a mismatch between model-based classifications produced by a first version of a computer-implemented machine learning threat discernment model and a second version of a computer-implemented machine learning threat discernment model for a file, each of the first version of the machine learning threat discernment model and the second version of the machine learning threat discernment model for a file output a respective threat score, wherein the mismatch is based on a difference between the threat scores;
• and
• executing or accessing the file if the difference between the threat scores is below a pre-defined threshold;
• or
• analyzing the mismatch to determine appropriate handling for the file if the threat score is equal to or above a pre-defined threshold.