Adaptive Detection of Security Threats Through Dynamic Retraining Training of Computer-Implemented Models

A system, comprising:

• memory storing one or more instructions;
• and
• one or more processors configured to execute the one or more instructions from memory to:
• maintain a natural language processing model trained to classify communications as attacks;
• detect a missed attack corresponding to a communication processed by the natural language processing model;
• determine to retrain the natural language processing model based on detection of the missed attack;
• generate one or more training samples based on the communication processed by the natural language model, the one or more training samples including data corresponding to one or more behavioral dimensions from the communication;
• retrain the natural language processing model using at least the one or more training samples, to generate a retrained natural language processing model;
• and
• deploy the retrained natural language processing model for one or more subsequent communications, to detect an attack in at least one of the one or more subsequent communications, based on the at least one subsequent communication having one or more traits corresponding to the one or more behavioral dimensions.

A non-transitory computer readable medium storing instructions that, when executed by one or more processors, cause the one or more processors to:

• maintain a natural language processing model trained to classify communications as attacks;
• detect a missed attack corresponding to a communication processed by the natural language processing model;
• determine to retrain the natural language processing model based on detection of the missed attack;
• generate one or more training samples based on the communication processed by the natural language model, the one or more training samples including data corresponding to one or more behavioral dimensions from the communication;
• retrain the natural language processing model using at least the one or more training samples, to generate a retrained natural language processing model;
• and
• deploy the retrained natural language processing model for one or more subsequent communications, to detect an attack in at least one of the one or more subsequent communications, based on the at least one subsequent communication having one or more traits corresponding to the one or more behavioral dimensions.