System and method of machine training model of detecting malicious files

Abstract

Disclosed are systems and methods for machine learning of a model for detecting malicious files. The described system samples files from a database of files and trains a detection model for detectingmalicious files on the basis of an analysis of the sampled files. The described system forms behavior logs based on executable commands intercepted during execution of the sampled files, and generatesbehavior patterns based on the behavior log. The described system determines a convolution function based on the behavior patterns, and trains a detection model for detecting malicious files by calculating parameters of the detection model using the convolution function on the behavior patterns. The trained detection model may be used to detect malicious files by utilizing the detection model ona system behavior log generated during execution of suspicious files.

Description

technical field [0001] The present disclosure relates to antivirus technology. More specifically, the present invention relates to methods, systems, and computer-readable media for machine learning malware detection models. Background technique [0002] The rapid development of computer technology in recent decades, and the widespread distribution of various computing devices such as personal computers, laptops, tablets, and smartphones, has become an important issue in countless problems and various situations, from surfing the Internet to bank transfers and electronic document transportation. Great motivation to use such a device in the field of activity. While the number of computing devices and the software running on those devices has grown, the number of malicious programs has also increased rapidly. [0003] There are currently a large number of various malicious programs. Some of these malicious programs steal personal confidential data such as logins and password...

AI Technical Summary

Problems solved by technology

[0009] Although known techniques are good at detecting files with specific characteristic attributes similar to those of known malicious files (i.e., describing things such as the presence of a graphical interface, data encryption, data transmission over a computer network, etc.) from a specific file group Malicious files with specific characteristics of data), but known techniques are not good at detecting malicious files that (albeit behave similarly) have characteristic attributes that are different from those of known malicious files

In addition, the above techniques do not disclose aspects of model testing, model retraining, and formation and reformulation of feature attributes that rely on the results of the above tests for machine learning models.

Images