Abstract: An apparatus, a method, and a computer program product are provided that dynamically selects features and machine learning models for optimal accuracy when determining a threat disposition of a security alert. The method includes training a base machine learning model, determining impacts that features in the training dataset have on the trained base machine learning model when predicting threat disposition on security threats, and creating subsets of the features, based on threat dispositions, by analyzing the features with their corresponding impacts and placing common features and impacts into each subset of the subsets. The method also includes training a plurality of machine learning models and a machine learning feature predictor using the training dataset and the subsets. The method further includes selecting, for a new input data instance, the selected features from the new input data instance and selecting a trained machine learning model trained based on the selected features.

Abstract: Techniques for improved cybersecurity are provided. A plurality of feature subsets are identified, each containing a respective subset of features from a plurality of features included in a set of training security logs. The plurality of feature subsets is modified using one or more genetic programming techniques, and each of the plurality of feature subsets is scored using a plurality of threat classifiers, where the plurality of threat classifiers comprise trained machine learning models. A set of feature subsets is selected, from the plurality of feature subsets, based on the scores. A type classifier is trained based on the set of feature subsets, where the type classifier comprises a trained machine learning model.

Abstract: A machine learning model selector is provided. A set of machine learning (ML) models are trained based on a first training dataset. The set of trained ML model is executed on a second training dataset to generate a corresponding output for a set of data instances in the second training dataset. For each data instance in the set of data instances, a corresponding ranking of ML models is generated based on the corresponding output for the data instance generated by the set of ML models. A ML model selector is trained based on the data instances in the set of data instances and the corresponding ranking of ML models, to select a trained ML model based on an input data instance.

Abstract: A machine learning model selector is provided. A set of machine learning (ML) models are trained based on a first training dataset. The set of trained ML model is executed on a second training dataset to generate a corresponding output for a set of data instances in the second training dataset. For each data instance in the set of data instances, a corresponding ranking of ML models is generated based on the corresponding output for the data instance generated by the set of ML models. A ML model selector is trained based on the data instances in the set of data instances and the corresponding ranking of ML models, to select a trained ML model based on an input data instance.