System and method of detecting malicious files using a trained machine learning model

Abstract

The present disclosure is directed to a system and method of detecting malicious files by using a trained machine learning model. The system may comprise a hardware processor configured to form at least one behavior pattern, calculate the convolution of all behavior patterns, select from a database of detection models at least two models for detection of malicious files on the basis of the behavior patterns, calculate the degree of harmfulness of a file being executed on the basis of an analysis of the convolution and the at least two models for detection of malicious files, form, on the basisof the degrees of harmfulness, a decision-making pattern, recognize the file being executed as malicious if the degree of similarity between the formulated decision-making pattern and at least one ofa predetermined decision-making patterns from a database of decision-making patterns previously formulated on the basis of an analysis of malicious files, exceeds a predetermined threshold value.

Description

technical field [0001] The present invention relates to antivirus technology, and more particularly to systems and methods for detecting malicious files using trained machine learning models. Background technique [0002] The rapid development of computer technology in the last decade and the widespread availability of various computing devices (personal computers, laptops, tablets, smartphones, etc.) strong impetus for use in money transfers and electronic document transactions). While the number of computing devices and the software that runs on those devices has grown, the number of malicious programs has also increased rapidly. [0003] Currently, there are a large variety of malicious programs. Some of them malicious programs steal personal and confidential data (such as logins and passwords, banking information, electronic documents) from the user of the device. Other malicious programs cause user devices to form so-called botnets for attacks such as denial of servi...

AI Technical Summary

Problems solved by technology

[0015] Although the techniques described above are good at detecting specific characteristics similar to those of known malicious files (i.e., data describing specific characteristics of files from a specific file group, such as the presence of a graphical interface, encryption of data, transmission of data over a computer network etc.), but the techniques described above cannot handle the detection of malicious files with characteristic signatures different from those of known malicious files (even if the behavior is similar)

Furthermore, the aforementioned techniques do not disclose the aspects of machine teaching of the model (e.g., testing and teaching of the model), and training and retraining of feature features (depending on the results of the aforementioned testing)

Images