Taming Data Challenges in ML-based Security Tasks: Lessons from Integrating Generative AI

TL;DR

This paper explores how Generative AI can address data challenges in machine learning security tasks by augmenting datasets, leading to significant performance improvements and rapid adaptation to changing conditions.

Contribution

It introduces a novel GenAI scheme called Nimai and demonstrates how synthetic data generation can enhance classifier performance in security applications.

Findings

GenAI improves classifier performance by up to 32.6%.

Synthetic data aids rapid adaptation to concept drift.

Some GenAI schemes struggle with certain security tasks.

Abstract

Machine learning-based supervised classifiers are widely used for security tasks, and their improvement has been largely focused on algorithmic advancements. We argue that data challenges that negatively impact the performance of these classifiers have received limited attention. We address the following research question: Can developments in Generative AI (GenAI) address these data challenges and improve classifier performance? We propose augmenting training datasets with synthetic data generated using GenAI techniques to improve classifier generalization. We evaluate this approach across 7 diverse security tasks using 6 state-of-the-art GenAI methods and introduce a novel GenAI scheme called Nimai that enables highly controlled data synthesis. We find that GenAI techniques can significantly improve the performance of security classifiers, achieving improvements of up to 32.6% even in severely data-constrained settings (only ~180 training samples). Furthermore, we demonstrate that GenAI can facilitate rapid adaptation to concept drift post-deployment, requiring minimal labeling in the adjustment process. Despite successes, our study finds that some GenAI schemes struggle to initialize (train and produce data) on certain security tasks. We also identify characteristics of specific tasks, such as noisy labels, overlapping class distributions, and sparse feature vectors, which hinder performance boost using GenAI. We believe that our study will drive the development of future GenAI tools designed for security tasks.