One-class threat detection using federated learning
AssigneeAvast Software s.r.o.
InventorsYue Zhao, Acar Tamersoy, Kevin Roundy, Daniel Kats, Michalis Pachilakis
Life of this patent
Estimating the term…
Abstract
A machine learning model is trained to classify data as malicious or benign, including receiving the machine learning model in a user device and training the machine learning model on the user device user-generated data that has been classified as known benign. A result of the training is sent to a remote server. Training samples on the user device may be classified automatically, such as classifying sent emails, instant messages, or other content generated by the user as benign.
Claims19
A method of training a machine learning model to classify data as malicious or benign, comprising:
- receiving in a user device a machine learning model configured to classify data as malicious or benign;
- training the machine learning model using user-generated data on the user device, the user-generated data classified as known benign, wherein training the machine learning model comprises training a one-class training model;
- and
- sending a result of training the machine learning model to a remote server.
A method of training a machine learning model to classify data as malicious or benign, comprising:
- sending a machine learning model configured to classify data as malicious or benign to a user device;
- and
- receiving from the user device a result of training the machine learning model using user-generated data on the user device, the user-generated data classified as known benign.
A computerized system, comprising:
- a user device comprising a processor and a nonvolatile storage, the nonvolatile storage comprising coded instructions that when executed on the user device cause the user device to:
- receive a machine learning model configured to classify data as malicious or benign;
- train the machine learning model using user-generated data on the user device, the user-generated data classified as known benign, wherein training the machine learning model comprises training a one-class training model;
- and
- send a result of training the machine learning model to a remote server.
Dependencies are inferred from the claim text.