Learning of malicious behavior vocabulary and threat detection through behavior matching

Patent metadata

Field	Value
Publication number	US-12160429-B2
Application number	US-202318225517-A
Country	US
Kind code	B2
Filing date	Jul 24, 2023
Priority date	Mar 26, 2020
Publication date	Dec 3, 2024
Grant date	Dec 3, 2024

Abstract

In one embodiment, a device obtains input features for a neural network-based model. The device pre-defines a set of neurons of the model to represent known behaviors associated with the input features. The device constrains weights for a plurality of outputs of the model. The device trains the neural network-based model using the constrained weights for the plurality of outputs of the model and by excluding the pre-defined set of neurons from updates during the training.

First claim

What is claimed is:

1. A tangible, non-transitory, computer-readable medium storing program instructions that, when executed by one or more processors, cause a device to perform operations comprising:
selecting a first set of pre-defined weights associated with a first set of neurons, and a second set of weights associated with a second set of neurons;
performing a training procedure on a neural network model, wherein the training procedure includes excluding the first set of pre-defined weights associated with a first set of neurons from updating during the training while updating the weights associated with the second set of neurons.

2. The tangible, non-transitory, computer-readable medium storing program instructions of claim 1 wherein the first set of pre-defined weights associated with the first set of neurons has weights defined from a previous training procedure.

3. The tangible, non-transitory, computer-readable medium storing program instructions of claim 1 , wherein the operations further comprise receiving the first set of pre-defined weights associated with the first set of neurons.

4. The tangible, non-transitory, computer-readable medium storing program instructions of claim 1 wherein the neural network model is a discriminatory model.

5. The tangible, non-transitory, computer-readable medium storing program instructions of claim 1 wherein the neural network model is a generative model.

6. The tangible, non-transitory, computer-readable medium storing program instructions of claim 1 , wherein the operations further comprise:
prior to performing the training procedure on the neural network model, constraining a plurality of the weights in the first set of weights to a lower precision.

7. The tangible, non-transitory, computer-readable medium storing program instructions of claim 6 wherein the weights associated with at least an output layer of the second set of neurons have been constrained to be binary.

8. A method of training a neural network comprising:
selecting a first set of pre-defined weights associated with a first set of neurons, and a second set of weights associated with a second set of neurons;
performing a training procedure on a neural network model, wherein the training procedure includes excluding the first set of pre-defined weights associated with a first set of neurons from updating during the training while updating the weights associated with the second set of neurons.

9. The method of claim 8 wherein the first set of pre-defined weights associated with the first set of neurons had weights defined from a previous training procedure.

10. The method of claim 8 , further comprising obtaining the first set of pre-defined weights associated with the first set of neurons.

11. The method of claim 8 wherein the neural network model is a discriminatory model.

12. The method of claim 8 wherein the neural network model is a generative model.

13. The method of claim 8 , further comprising:
prior to performing the training procedure on the neural network model, constraining a plurality of the weights in the first set of weights to a lower precision.

14. The method of claim 13 wherein the weights associated with at least an output layer of the second set of neurons have been constrained to be binary.

15. A system specialized for training a neural network comprising:
one or more network interfaces to communicate with a network;
one or more processors coupled to the network interfaces; and
a memory comprising a plurality of storage locations that are addressable by the one or more processors;
wherein a first storage location includes program instructions interpretable by the one or more processors; and wherein a second storage location includes a data structure interpretable as set of pre-defined weights and a third storage location includes a data structure interpretable as a second set of weights; and
wherein the one or more processors interpret the program instructions and performs operations including:
associating the first set of pre-defined weights with a first set of neurons within a neural network model, and associating the second set of weights with a second set of neurons of the neural network model;
performing a training procedure on the neural network model, wherein the training procedure includes excluding the first set of pre-defined weights associated with a first set of neurons from updating during the training while updating the second set of weights; and
storing the second set of weights in the third storage location.

16. The system of claim 15 wherein the first set of pre-defined weights associated with the first set of neurons had weights defined from a previous training procedure.

17. The system of claim 15 , wherein the operations further include obtaining the first set of pre-defined weights via the one or more network interfaces.

18. The system of claim 15 wherein the neural network model is a discriminatory model.

19. The system of claim 15 wherein the neural network model is a generative model.

20. The system of claim 15 , wherein the operations further include:
prior to performing the training procedure on the neural network model, modifying the first set of weights by constraining a plurality of the weights in the first set of weights to a lower precision.

21. The system of claim 20 wherein the weights associated with at least an output layer of the second set of neurons have been constrained to be binary.

Assignees

• Cisco Tech Inc

Inventors

• Somol Petr
• Kopp Martin
• Kohout Jan
• Brabec Jan
• Dupont Marc René Jacques Marie
• Skarda Cenek
• Bajer Lukas
• Khikhlukha Danila

Classifications

• G06N3/0895

  Weakly supervised learning, e.g. semi-supervised or self-supervised learning · CPC title

• G06N3/0475

  Generative networks · CPC title

• G06N3/094

  Adversarial learning · CPC title

• G06N3/082

  modifying the architecture, e.g. adding, deleting or silencing nodes or connections · CPC title

• G06N3/0455

  Auto-encoder networks; Encoder-decoder networks · CPC title