Methods and apparatus for management of a machine-learning model to adapt to changes in landscape of potentially malicious artifacts

A non-transitory processor-readable medium storing code representing instructions to be executed by a processor, the instructions comprising code to cause the processor to:

• train, at a time, a machine learning model to output (1) an identification of whether an artifact is malicious and (2) a confidence value associated with the identification of whether the artifact is malicious;
• receive, during a time period after the time, a set of artifacts;
• for each artifact from the set of artifacts, provide a representation of that artifact as an input to the machine learning model to obtain as an output of the machine learning model an indication of whether that artifact is malicious and a confidence value associated with the indication of whether that artifact is malicious;
• compare the confidence value for each artifact from the set of artifacts to a high confidence criterion to identify a number of artifacts having confidence values that meet the high confidence criterion;
• compare the confidence value for each artifact from the set of artifacts to a low confidence criterion to identify a number of artifacts having confidence values that meet the low confidence criterion;
• and
• send an indication to retrain the machine learning model in response to a metric associated with at least one of the number of artifacts having confidence values that meet the high confidence criterion or the number of artifacts having confidence values that meet the low confidence criterion meeting a retraining criterion.

A method, comprising:

• training, at a time, a machine learning model to output (1) an identification of whether an artifact is malicious and (2) a confidence value associated with the identification of whether the artifact is malicious;
• receiving, during a time period after the time, a set of artifacts;
• for each artifact from the set of artifacts, providing a representation of that artifact as an input to the machine learning model to obtain as an output of the machine learning model an indication of whether that artifact is malicious and a confidence value associated with the indication of whether that artifact is malicious;
• comparing the confidence value for each artifact from the set of artifacts to a confidence criterion to identify a number of artifacts having confidence values that do not meet the confidence criterion;
• and
• sending an indication to retrain the machine learning model in response to a metric associated with the number of artifacts meeting a retraining criterion.