Training a model based on soft labeling

Abstract

A method for cybersecurity includes receiving a corpus of cyber incidents, each including (i) one or more alerts indicative of suspicious activities in one or more computer systems, and (ii) one or more features characterizing the cyber incident. Binary labels respectively assigned to the cyber incidents of the corpus are further received, each of the binary labels having a first value indicating the cyber incident is benign, or a second value indicating the cyber incident is malicious. Predefined labeling rules that map the binary labels to respective soft labels that are indicative of suspiciousness levels of the cyber incidents are held. The binary labels are mapped to respective soft labels, based at least on the predefined labeling rules. The cyber incidents of the corpus and the respective soft labels are provided for training a machine learning model that, when trained, predicts risk scores for cyber incidents outside the corpus.