Network protection

Abstract

A computer implemented method, computer system and computer program for protecting a network are provided. The method trains a classifier to classify activity within the network. The method retrains the classifier using an active learning technique by: determining a respective level of uncertainty of the classifier in classifying each sample in a set of sample data; identifying a subset of the sample data, the subset including a plurality of samples from the set for which the respective level of uncertainty is highest; randomly selecting a number of samples from the subset, wherein the number of samples is less than a size of the subset; labelling the selected samples by querying an oracle; and using training data including the labelled samples to retrain the classifier. The method uses the retrained classifier to classify activity within the network and determines whether to take action to protect the network based on the classification of the activity.

Dependencies are inferred from the claim text.