A system and method for batched, supervised, in-situ machine learning classifier retraining for malware identification and model heterogeneity. The method produces a parent classifier model in one location and providing it to one or more in-situ retraining system or systems in a different location or locations, adjudicates the class determination of the parent classifier over the plurality of the samples evaluated by the in-situ retraining system or systems, determines a minimum number of adjudicated samples required to initiate the in-situ retraining process, creates a new training and test set using samples from one or more in-situ systems, blends a feature vector representation of the in-situ training and test sets with a feature vector representation of the parent training and test sets, conducts machine learning over the blended training set, evaluates the new and parent models using the blended test set and additional unlabeled samples, and elects whether to replace the parent classifier with the retrained version.
Please help me write a proper abstract based on the patent claims. CLAIM: 1. A method for batched, supervised, in-situ machine learning classifier retraining for malware identification and model heterogeneity, the method comprising: a. producing a parent classifier model in one location and providing it to one or more in-situ retraining system or systems in a different location or locations; b. adjudicating the class determination of the parent classifier over the plurality of the samples evaluated by the in-situ retraining system or systems; c. determining a minimum number of adjudicated samples required to initiate the in-situ retraining process; d. blending a feature vector representation of the in-situ training and test sets with a feature vector representation of the parent training and test sets or subset thereof; e conducting machine learning over the blended training set; f evaluating the new and parent models using the blended test set and additional unlabeled samples; and g electing whether to replace the parent classifier with the retrained version. 2. The method of claim 1 further comprising creating a new training and test set, using samples from one or more in-situ systems. 3. The method of claim 2 further comprising repeating (a)-(g) and the creating. 4. The method of claim 1 wherein the adjudicating includes receiving user inputs that confirm or correct a classification. 5. The method of claim 1, where the samples comprise machine executable software or file types used by machine executable software. 6. The method of claim 1, where the class determination is either benign or malicious. 7. The method of claim 1, where the in-situ retrained classifier is distributed to one or more of the in-situ retraining system within an enterprise. 8. The method of claim 1, where the minimum number of adjudicated samples is a function of the parent classifier's training and test set size. 9. The method of claim 1, where a feature vector representation and not the complete sample is transmitted between in-situ retrainers. 10. The method of claim 1, where the user manually adds samples and adjudicates their class. 11. The method of claim 1, where samples are evaluated against a plurality of in-situ retrained classifier models. 12. The method of claim 1, where the in-situ classifier operates in tandem with the parent classifier for the purpose of classifier evaluation. 13. The method of claim 1, where different priorities are used for inclusion in the in-situ training and test sets based on the source of the in-situ sample. 14. The method of claim 1, where adjudicated sample feature vectors are shared amongst a plurality of users who have entered into a trust relationship with one another. 15. The method of claim 14, where a trusted broker is used to facilitate the exchange of adjudicated sample feature vectors. 16. The method of claim 1, wherein the blending further comprises adding in-situ sample feature vectors to parent classifier feature vectors. 17. The method of claim 1, wherein the blending further comprises replacing a number of parent classifier feature vectors with an equal number of in-situ sample feature vectors. 18. The method of claim 1, wherein the blending further comprises adding in-situ sample feature vectors to a subset of parent classifier feature vectors. 19. The method of claim 1, wherein the electing is performed by a user. 20. The method of claim 1, wherein the electing is performed by the in-situ retraining system without human intervention. 21. A method for producing unique classification models for each enterprise that determine if computer readable files are malicious or benign based on a common parent model and an enterprise-specific sample set. 22. A computer readable medium comprising instructions for batched, supervised, in-situ machine learning classifier for malware identification and model heterogeneity retraining that are executed to perform the method of claim 1. 23. A system for batched, supervised, in-situ machine learning classifier retraining for malware identification and model heterogeneity comprising a server that includes a processor and a memory that includes comprising instructions for batched, supervised, in-situ machine learning classifier retraining that are executed to perform the method of claim 1. 24. The system of claim 23, wherein the server includes a retraining manager service. 25. The system of claim 23, wherein the server includes a machine learning service. 26. The system of claim 23, wherein the server includes a feature extraction service. 27. The system of claim 23, wherein the server includes a database that stores information on classified files. 28. The system of claim 23, wherein the server includes test and training set feature vectors for a base model. 29. The system of claim 23, wherein the server includes test and training set feature vectors for an in situ model.