# US 2025/0097249 A1 · Methods and apparatus for artificial intelligence (ai) model security protection using moving target defenses > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2025/0097249 A1 - Document ID: US20250097249A1 - Status: Published application - Kind: A1 - Application number: 18/965,769 - Filed: 2024-12-02 - Published: 2025-03-20 - Earliest claimed: 2024-12-02 - Assignees: Intel Corporation - Applicants: Intel Corporation - Inventors: Omer Ben-Shalom; Yoni Kahana; Yaron Klein; Ilil Blum Shem-Tov; Dan Horovitz - Web page: https://patentgrep.com/patent/US20250097249A1 ## CPC - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)} - H04L 63/145: {the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms} - G06F 21/566: {Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract An example apparatus includes interface circuitry, machine-readable instructions, and at least one processor circuit to be programmed by the machine-readable instructions to interface circuitry to obtain a pre-trained detection model, machine-readable instructions, and at least one processor circuit to be programmed by the machine-readable instructions to tune the pre-trained detection model based on first local behavior data and execute the tuned detection model to detect an anomaly in second local behavior data associated with the apparatus. ## Claims ### Claim 1 An apparatus, comprising: interface circuitry to obtain a pre-trained detection model; machine-readable instructions; and at least one processor circuit to be programmed by the machine-readable instructions to: tune the pre-trained detection model based on first local behavior data; and execute the tuned detection model to detect an anomaly in second local behavior data associated with the apparatus. ### Claim 2 (depends on 1) The apparatus of claim 1, wherein the anomaly in the second behavior data is associated with potential malware activity. ### Claim 3 (depends on 1) The apparatus of claim 1, wherein the first local behavior data is associated with at least one of a network activity, a browser activity, a file access pattern, a system interaction, or an application activity. ### Claim 4 (depends on 1) The apparatus of claim 1, wherein the anomaly is malware activity, one or more of the at least one processor circuit is to trigger at least one of quarantining a file, blocking a network connection, generating a malware alert, or securing an application. ### Claim 5 (depends on 1) The apparatus of claim 1, wherein one or more of the at least one processor circuit is to tune the pre-trained detection model based on Low-Rank Adaptation (LoRA). ### Claim 6 (depends on 1) The apparatus of claim 1, wherein the pre-trained detection model is an endpoint detection model. ### Claim 7 (depends on 1) The apparatus of claim 1, wherein at least one of the first local behavior data or the second local behavior data is associated with user behavior or platform behavior on the apparatus. ### Claim 8 At least one non-transitory machine-readable medium comprising machine-readable instructions to cause at least one processor circuit to at least: tune a pre-trained detection model based on first local behavior data; and execute the tuned detection model to detect an anomaly in second local behavior data associated with an apparatus. ### Claim 9 (depends on 8) The at least one non-transitory machine-readable medium of claim 8, wherein the anomaly in the second behavior data is associated with potential malware activity. ### Claim 10 (depends on 8) The at least one non-transitory machine-readable medium of claim 8, wherein the first local behavior data is associated with at least one of a network activity, a browser activity, a file access pattern, a system interaction, or an application activity. ### Claim 11 (depends on 8) The at least one non-transitory machine-readable medium of claim 8, wherein the anomaly is malware activity, the machine-readable instructions are to cause one or more of the at least one processor circuit to trigger at least one of quarantining a file, blocking a network connection, generating a malware alert, or securing an application. ### Claim 12 (depends on 8) The at least one non-transitory machine-readable medium of claim 8, wherein the machine-readable instructions are to cause one or more of the at least one processor circuit to tune the pre-trained detection model based on Low-Rank Adaptation (LoRA). ### Claim 13 (depends on 8) The at least one non-transitory machine-readable medium of claim 8, wherein the pre-trained detection model is an endpoint detection model. ### Claim 14 (depends on 8) The at least one non-transitory machine-readable medium of claim 8, wherein at least one of the first local behavior data or the second local behavior data is associated with user behavior or platform behavior on the apparatus. ### Claim 15 An apparatus, comprising: means for tuning a pre-trained detection model based on first local behavior data; and means for executing the tuned detection model to detect an anomaly in second local behavior data associated with the apparatus. ### Claim 16 (depends on 15) The apparatus of claim 15, wherein the anomaly in the second behavior data is associated with potential malware activity. ### Claim 17 (depends on 15) The apparatus of claim 15, wherein the first local behavior data is associated with at least one of a network activity, a browser activity, a file access pattern, a system interaction, or an application activity. ### Claim 18 (depends on 15) The apparatus of claim 15, wherein the anomaly is malware activity, further including means for triggering at least one of quarantining a file, blocking a network connection, generating a malware alert, or securing an application. ### Claim 19 (depends on 15) The apparatus of claim 15, wherein the means for tuning include tuning the pre-trained detection model based on Low-Rank Adaptation (LoRA). ### Claim 20 (depends on 15) The apparatus of claim 15, wherein the pre-trained detection model is an endpoint detection model.