Methods and Systems for On-Device High-Granularity Classification of Device Behaviors using Multi-Label Models

摘要

Various aspects include methods and computing devices implementing the methods for evaluating device behaviors in the computing devices. Aspect methods may include using a behavior-based machine learning technique to classify a device behavior as one of benign, suspicious, and non-benign. Aspect methods may include using one of a multi-label classification and a meta-classification technique to sub-classify the device behavior into one or more sub-categories. Aspect methods may include determining a relative importance of the device behavior based on the sub-classification, and determining whether to perform robust behavior-based operations based on the determined relative importance of the device behavior.

主权项

1. A method of evaluating device behaviors in a computing device, comprising:
using a behavior-based machine learning technique to classify a device behavior as one of benign, suspicious, and non-benign; using one of a multi-label classification technique and a meta-classification technique to sub-classify the device behavior into a sub-classification that includes one or more sub-categories; determining a relative importance of the device behavior based on the sub-classification; and determining whether to perform robust behavior-based operations based on the relative importance of the device behavior.