Machine learning faces two obstacles: obtaining a sufficient training set of malicious and normal traffic and retraining the system as malware evolves. We propose an algorithm based on the Multiple Instance Learning (MIL) that seeks for the Neyman-Pearson detector with a very low false positive rate that is necessary in the deployment of the system. The solution uses blocklists and feeds to create weak labels of bags to train the system which can then be used to analyze more detailed proxy logs using statistical and machine learning techniques.”]
Source: https://blog.talosintelligence.com/2015/09/cognitive-research-learning-detectors.html