Detecting malware using deep generative models

Abstract

Embodiments of the present disclosure relate to detecting malware with deep generative models. Features are extracted from artifacts such that a vector can be populated. The vector is then input into an anomaly detection model, which includes a deep generative model to generate a first score. The first score can characterize the artifact as malicious or benign with respect to access, execution, or continued execution. Further, the vector is input into a machine learning based classification model to generate a second score. The second score can also characterize the artifact as malicious or benign with respect to access, execution, or continued execution. The second score can be modified based on the first score to result in a final score. The final score can then be provided to a consumption application or process. Related apparatuses, systems, techniques, and articles of manufacture are also described.

Description

Technical Field

[0001] The topics described in this article involve enhancement techniques for characterizing potentially malicious artifacts using deep generative models. Background Technology

[0002] Hackers are becoming increasingly sophisticated in their attempts to access various computing systems by developing malware designed to deceive or otherwise bypass traditional antivirus solutions. In particular, adversarial techniques are being employed, where various artifacts encapsulating malware are iteratively and automatically modified until such artifacts are incorrectly classified as benign by antivirus software. Simultaneously, malware detection systems are becoming increasingly multimodal, integrating information from multiple heterogeneous sources when making a final judgment. Summary of the Invention

[0003] In the first aspect, the artifact is received. Features are then extracted from the artifact, allowing a vector to be populated. This vector is then fed into an anomaly detection model, which includes a deep generative model to generate a first score. This first score characterizes the artifact as malicious or benign for access, execution, or continued execution. Furthermore, the vector is fed into a machine learning-based classification model to generate a second score. This second score also characterizes the artifact as malicious or benign for access, execution, or continued execution. The second score is then modified based on the first score to obtain a final score. This final score can then be provided to a consumer application or process.

[0004] Deep generative models can be likelihood-based models. In some variations, this likelihood-based model includes variational autoencoders and / or normalized flows.

[0005] Anomaly detection models may form part of a model set that includes at least one machine learning model selected from the group consisting of: logistic regression models, neural networks, convolutional neural networks, recurrent neural networks, generative adversarial networks, support vector machines, random forests, and / or Bayesian models.

[0006] Before a vector is input into an anomaly detection model and / or a classification model, a feature reduction operation is used to reduce the features in the vector. This feature reduction operation can include one or more of the following: random projection, feature hashing, deterministic principal component analysis, or stochastic principal component analysis.

[0007] This modification can include combining the first score and the second score.

[0008] This modification could include overwriting the second score when the first score is higher than a threshold. In this case, the second score could be replaced by the baseline score or a previous score as the final score.

[0009] This modification could include applying weights to a second score, which are variable and based on the first score.

[0010] In some variations, multiple distinct vectors are created, which are then analyzed sequentially by corresponding classification and / or anomaly detection models. The weights of the classification model output used to generate the final score can vary and are based on (multiple) first scores.

[0011] The modification may include applying weights to a second score that is variable and based on the first score, and combining the weighted second score with the baseline score.

[0012] This modification could include feeding a vector to a second classification model for classification when the first score exceeds a threshold, where the output of the second classification model is used to generate the final score. The second classification model can be computationally more intensive than the first classification model. The second classification model is executed by a computing device that also executes the first classification model. Alternatively, the second classification model can be executed by a computing device located remotely from the one executing the first classification model.

[0013] This document also describes a non-transitory computer program product (i.e., a physically implemented computer program product) containing instructions that, when executed by one or more data processors in one or more computing systems, cause at least one data processor to perform the operations described herein. Similarly, a computer system is described that may include one or more data processors and memory coupled to the one or more data processors. The memory may temporarily or permanently store instructions that cause at least one processor to perform one or more of the operations described herein. Furthermore, the methods may be implemented by one or more data processors, either within a single computing system or distributed across two or more computing systems. Such computing systems may be connected via one or more connections, and may exchange data and / or commands or other instructions, including but not limited to connections over a network (e.g., the Internet, wireless wide area network, local area network, wide area network, wired network, etc.), direct connections between one or more computing systems, etc.

[0014] The topic described in this article offers many technical advantages. For example, compared to traditional techniques, the current topic provides a more accurate classification of potentially malicious artifacts.

[0015] Details of one or more variations of the subject matter described herein are set forth in the accompanying drawings and the description below. Further features and advantages of the subject matter described herein will become apparent from the description, drawings, and claims. Attached Figure Description

[0016] Figure 1 It is a computer-based workflow diagram illustrating the process of characterizing an article as malicious or benign.

[0017] Figure 2 It illustrates a flowchart of the malware detection process using deep generative models; and

[0018] Figure 3 This is a schematic diagram illustrating computing devices that can be used to implement various aspects of the topics discussed in this article. Detailed Implementation

[0019] This article discusses enhancement techniques for using deep generative models to detect malware (e.g., malicious code, etc.). Once malware is detected in a file using this model, corrective actions can be taken, such as blocking access to such a file, stopping the execution of such a file, and / or isolating the file.

[0020] Discriminative models estimate probabilities p(y|x), where y is the response (such as a label) and x is a feature vector. In contrast, generative models estimate p(x), where x is a vector of features (note that one of those features can be the label y, if needed). Classic examples of discriminative models include regression and multilayer perceptrons. Classic examples of generative models include exponential family distributions and mixture models.

[0021] Compared to discriminative models, generative models have the advantage of allowing the computation of anomaly scores for new samples. For discriminative models, it is meaningless whether the feature vector x is normal or anomalous, because the model takes x as a given. In contrast, generative models can evaluate whether samples with features (again, including class labels if needed) are anomalous.

[0022] As presented in this article, these assessments of anomalies are invaluable for malware detection products. If the corresponding features of a file appear typical, rather than those that appear anomalous, then one will have more confidence in the representation of a machine learning (ML) system or one of its components. Two scenarios are highlighted here where this assessment of “trust” can enhance classification: when protecting against adversarial attacks, and when integrating multiple models into a single score.

[0023] Adversarial attacks on ML-based antivirus products might involve altering the characteristics of malicious files until they are characterized as "good" by the product. If successful, the file could pass through ML-based antivirus products that only use discriminative models. However, consider that these artifacts can produce manufactured combinations of highly unusual features. For example, a "string padding" attack could be performed, appending numerous strings to the end of a malicious file, often indicating goodness (such as terms related to video games). This produces a file with a bizarre combination of features, which would then be flagged by a high-quality anomaly detector.

[0024] Now consider a multimodal malware detection system that integrates information across multiple heterogeneous sources. For example, in the context of malicious user detection, it might be necessary to combine scores from various models (process, network, keystroke, mouse, login, file, registry, etc.). In the context of malware detection, it might be necessary to combine scores from static (i.e., pre-execution, etc.) and dynamic (i.e., post-execution, etc.) models. In this example, scores from multiple classifiers must be combined into the final decision. When doing so, the score of each classifier can be weighted according to the level of anomalousness of its inputs (high anomalousness results in low weight). Because high anomalousness scores suggest that these inputs are off-distribution, the strategy is reasonable, and therefore the strategy is inherently unknown to the classifier model. Note that in cases where previous scores or baseline scores also contribute to the final decision, the final decision will then look increasingly like the previous scores or baseline scores as the level of anomalousness increases across all classifiers.

[0025] Therefore, anomaly detection is a crucial part of malware detection systems. Files, screenshots, artifacts, etc., classified as "good" but "abnormal" guarantee a lower level of trust. Ultimately, such files may need to be blocked, temporarily isolated, or authorized for further processing by more expensive models, system operators, or malware analysts. In contrast, files classified as "good" and "normal" are authorized with a higher level of trust, allowing them to proceed without further inspection. Furthermore, in complex multimodal malware detection systems, which integrate information from multiple classifiers, the anomaly level of a given modality can be used to measure its contribution to the final decision, which relates to whether a file needs to be blocked, temporarily isolated, or authorized for further processing by more expensive models, system operators, or malware analysts.

[0026] Existing methods for identifying anomalous computer files have limited expressiveness (i.e., the ability to capture complex structures in data, etc.) because they use simple generative models, such as Gaussian functions or mixtures of Gaussian functions, or distance measures derived from them (such as Mahalanobis distance). Utilizing the topic of this paper, anomaly detection can be performed on computer files using deep generative likelihood-based models. The deep generative models used in this paper provide rich classes of density estimators; in particular, they form probabilistic models with deep neural networks to construct expressive models that can scale to high-dimensional inputs.

[0027] There are generally two categories of deep generative models: Generative Adversarial Networks (GANs) and likelihood-based models. This paper focuses on likelihood-based models because they provide a natural way to score the level of anomalousness in new samples. Within this, there are three main subclasses of likelihood-based models: autoregressive models, variational autoencoders (VAEs), and normalized flow models. While each subclass can be utilized, this paper focuses on VAEs and normalized flow models because autoregressive models are difficult to parallelize. Details on how VAEs and normalized flow models can be used to identify anomalous computer files are provided below.

[0028] Figure 1 This is process flowchart 100, which illustrates the workflow of a computer implementation for classifying artifacts as malicious or benign. Initially, artifact 110 may be received (e.g., accessed, loaded, received from a remote computing system, etc.). Artifact 110 may be a file, a portion of a file, metadata representing a file, and / or source code. The artifact 110 may be parsed or otherwise processed by an observer. Specifically, the observer may extract 120 features (sometimes referred to as attributes or observations) from the artifact and quantize 130 of these features. Further, depending on the complexity and / or number of features within the vector, a feature reduction operation 140 may be performed on the vector, reducing the number of dimensions of the vector. Feature reduction operation 140 may utilize various techniques, including but not limited to principal component analysis and random projection matrices, to reduce the number of features extracted from the vector while retaining usefulness (e.g., for classification purposes). The vector with reduced features may be input into one or more anomaly detection models 150. As detailed below, anomaly detection models 150 may include deep generative models.

[0029] The output of the anomaly detection model 150 can be a first score 160. Unless otherwise indicated, the first score 160 (and additionally a second score 180) as used herein can be a numerical, categorical, or clustered, or other alphanumeric output, which can be used directly or indirectly (as described below, in combination with the second score 190) by the consuming process or application 195 to take subsequent actions. For malware applications, the final score 190 (which can be a combination of the first score 160 and the second score 180, a variant of the second score 180 based on the first score 160, another score, etc.) can be used to determine whether to access, execute, continue execution, isolate, or take some other remedial action that prevents the software and / or computing system from being infected or otherwise penetrated by malicious code or other information encapsulated within the artifact 110.

[0030] In some cases, score 160 can be consumed by one or more classification models 170, which then generate a second score 180. This second score can then be used directly or indirectly (after being combined with the first score 160) by a consumption process or application 195 (instead of a consumption process or application 195 using the first score). For example, the first score 160, along with reduced features 140, improves the accuracy of classification model 170. Classification model 170 can take various forms, including but not limited to deep generative models, logistic regression models, neural networks (including convolutional neural networks, recurrent neural networks, generative adversarial networks, etc.), support vector machines, random forests, Bayesian models, etc., or combinations thereof.

[0031] With a final score of 190, various weights can be applied to the first score 160 and the second score 180. The anomaly detection model 150 can be used to provide insights into how much of the output of the classification model 170 can be trusted. For example, if the first score 160 (i.e., the anomaly score) is high enough, the second score 180 (classification) can be overridden during the combination process 190. Overriding could include replacing the second score 180 with a baseline score, a previous score, or a default score. The baseline score can be low (in the direction of the malicious classification) when in an environment where the file is expected to default to malicious, when there is contextual information suggesting maliciousness, and / or when the decision tradeoff tends to favor aggression over conservatism (i.e., wanting to avoid underreporting—missing malware—at any cost).

[0032] The baseline score can be high (in the direction of benign classification) when in an environment where the default is expected to be benign, when there is contextual information suggesting benignity, and / or when the decision trade-offs tend to favor conservatism over aggression (i.e., wanting to avoid false positives - invoking good malware - at any cost).

[0033] In some cases, for a final score of 190, a second score of 180 can be combined with the baseline score, and the weights can be based on the first score of 160. For example, the higher the level of anomaly indicated by the first score of 160, the greater the weight given to the baseline score.

[0034] If the initial score is 160 (an anomaly score), a classification model score of 180 can be overridden using an unknown indicator. For example, consider a classifier trained to map images of flowers to their names. If the classifier suddenly gets an image of a car, it can be configured not to return the name of the flower in its list of possible flowers that happens to best match the image; otherwise, it can report "unknown".

[0035] In further cases, if the first score of 160 is high enough, additional processing can be solicited. For example, a more computationally intensive model can be used. Such a model can be local or optionally remote (i.e., cloud-based, rather than on a local client). For example, the model could perform deeper penetration into the file (e.g., script analysis, or decompilation), which costs additional money or time to run, and therefore should only be solicited when necessary. In some cases, a high first score of 160 can flag artifact 100 for manual inspection / survey.

[0036] In some implementations, there may be an ensemble of anomaly detection model 150 and / or an ensemble of classification model 170. When using an ensemble, there may be vectors 130 of different types, and the combination at 190 can be configured such that a first score 160 can be used to provide weights for a second score 180 to achieve a final combined score. As an example, in the context of malware classification, suppose there is a vector A based on static file features (which can be extracted during file pre-execution) and a vector B based on dynamic file features (which occurs during file execution). Suppose these vectors are reduced to a simplified vector A and a simplified vector B, respectively, and then fed into classifier A (on static features) and classifier B (on dynamic features). Further suppose that anomaly detector A (on static features) produces a high score. Then, when the combined classifier score A and classifier score B are the final score, it is desirable to downgrade (or completely ignore) classifier A.

[0037] In the context of malicious user detection, assume there are vectors V1, V2, V3, etc., for different modalities (process, network, file, registry, etc.). These vectors V1, V2, V3, etc., can be fed into classification models C1, C2, C3, etc., on a vector-to-modality basis. The same vectors V1, V2, V3, etc., can be fed into anomaly detection models A1, A2, A3, etc., on a vector-to-modality basis. The outputs of classification models C1, C2, C3, etc., can be combined into the final decision. Lower weights can be placed on classifier scores from modalities with higher anomaly scores, because high anomaly scores suggest vector deviations from the distribution and are therefore inherently unknown to the classifier model.

[0038] Variational autoencoder. For ease of explanation, this paper provides an example variational autoencoder that consistently applies the independent and identically distributed assumption and the Gaussian distribution (and therefore real numerical observations).

[0039] Probabilistic Model Consider a parameter frequency latent variable model, where real numerical observations... Latent variables and parameter θ. Note that for some observed data dimension d and some latent variable dimension k, each and

[0040] Through factorization, observation x can be modeled.

[0041]

[0042] By using a multilayer perceptron (MLP), each observation x (i) The likelihood can be obtained and parameterized by weights θ to account for the latent variable z. (i) Mapping to control observation x (i) The Gaussian parameters of the distribution.

[0043]

[0044] Because MLP maps latent variables z to parameters of a probability distribution over observed data x, this aspect of MLP can be called a probabilistic decoder.

[0045] The pre-distribution can be additionally placed on the latent variables:

[0046]

[0047]

[0048] Furthermore, in the context of a frequency latent variable model, it can be assumed that θ is a fixed (but unknown) constant that will be learned.

[0049] In this case, the posterior distribution p θ (z|x) is difficult to solve. However, by using a multilayer perceptron (MLP) and parameterizing the weights φ to map the observations x to Gaussian parameters controlling the distribution of the latent variable z, an approximation can be considered:

[0050]

[0051]

[0052] Because MLP maps observations x to parameters of a probability distribution on latent variables z, this aspect of MLP can be called a probabilistic encoder (which can also be called a recognition model).

[0053] Note that the probabilistic encoder can therefore be viewed as an approximation of the posterior distribution of the latent variable, which is generated by using a probabilistic decoder as the likelihood.

[0054] Probability coding For example, we can specifically assume that the observation x (i) It can be probabilistically encoded into the latent variable z. (i) In the middle, through the following process

[0055] h (i) =tanh(W1x (i) +b1)

[0056]

[0057] in

[0058] Where (W1, W) 21 W 22 ) are weights, and (b1, b 21 b 22 ) represents the bias of a multilayer perceptron (MLP). Let φ:=(W1, W 21 W 22 b1, b 21 b 22 The trained encoder can be used to define an approximate posterior q. φ (z|x).

[0059] Probabilistic decoding For example, we can specifically assume that the latent variable z (i) It can be probabilistically decoded to observation x (i) In the middle, through the following process

[0060] h (i) =tanh(W3z) (i)+b3)

[0061]

[0062] in

[0063] Among them (W3, W) 41 W 42 ) is the weight, and (b3, b 41 b 42 ) represents the bias of the multilayer perceptron (MLP). Let θ:=(W3, W 41 W 42 b3, b 41 b 42 A trained decoder can be used to define the likelihood p. θ (x|z).

[0064] Derivation Variational derivation can be used to jointly optimize (θ, φ). For example, in the sample implementation in this paper, it has...

[0065] θ=(W3,W 41 W 42 b3, b 41 b 42 ) Generate parameters

[0066] φ=(W1, W 21 W 22 b1, b 21 b 22 Variational parameters

[0067] Specifically, as the marginal likelihood p θ The lower bound of (x) It can be constructed via entropy / energy decomposition, as provided in the variational derivation:

[0068]

[0069] By variational lower bound The model can be trained by performing stochastic gradient descent. During training, the objective function can be approximated by performing a Monte Carlo approximation of the expected value. Given a mini-batch x... (i) L samples can be obtained from q φ (z|x (i) The following estimators are derived from this:

[0070]

[0071] Note that in this case, the natural backpropagation gradient ignores the effect of parameters during the sampling step. However, reparameterization techniques can be utilized, i.e., differentiable transformations g of the parameterless distribution p(∈). φ Being constructed, making g φ (∈, x (i) ) has and q φ (z (i) |x (i) The same distribution. Using this method, L samples {∈1, ..., ∈ L The estimator can be obtained from p(∈):

[0072]

[0073] Abnormal scoring By using a variational autoencoder, the sample x (i) The anomaly can be evaluated as follows. First, from the fitted variational distribution (i.e., the encoder) q φ (z (i) |x (i) L samples {z} are obtained from ) (i，1) , ..., z (i，L)}. By specifying its parameters Each of these samples z (i，l) Determine the specific form of the likelihood of the fit (i.e., the decoder). Using this, the reconstruction probability of a sample can be defined as the average of these likelihoods: reconstruction probability.

[0074]

[0075] Now we're moving to a variant for malware anomaly detection that uses normalized flow.

[0076] Density estimation and variable change Consider a parametric function that maps a persistent random variable X to a persistent random variable Z.

[0077] f θ X→Z

[0078]

[0079] Where x is the observed sample and z is the latent variable. Assume density p z Given. Then, through the variable change theorem, the density of the observed sample x is given by the following.

[0080]

[0081] The objective of density estimation can be given as follows: based on the assumed latent variable density p z Learning φ to handle unknown data density p XModeling.

[0082] Normalized flow Normalized flow It is a sequence of reversible transformations that maps observed data points x to hidden state representations z.

[0083] If provided

[0084]

[0085]

[0086] Then due to det∏ i A i =∏ i detA i Therefore, the likelihood becomes

[0087]

[0088] Real NVP. True NVP is the normalized flow described above, where Constituted such that:

[0089]

[0090] Where b 1 , ..., b K is a binary mask, ⊙ is the Hadamard product or element-wise product, and s and t represent scaling and translation.

[0091] Affine coupling layer. In real-world NVP, the affine coupling layer is an element of a sequence of invertible transformations, that is, for some i∈{1,...,K}, it is h. i .

[0092] If the random variable is D-dimensional, and b i = [1, ... 1, 0, ... 0], where entry 0 starts at entry d. i+1 At each element, the affine coupling layer is given by the following:

[0093]

[0094]

[0095] Note that true NVP allows for fast calculation of the Jacobian determinant because:

[0096]

[0097] The bottom left term can be arbitrarily complex and does not need to be calculated, because the determinant of a triangular matrix is ​​the product of its diagonals:

[0098]

[0099] Therefore, using the above likelihood equation, the log-likelihood of the normalized NVP flow applied to a single data sample x is:

[0100]

[0101] Furthermore, assuming independent and identically distributed, the log-likelihood applied to the sample set is the sum of the individual log-likelihoods.

[0102] Figure 2 The diagram at 210 shows the artifact being received. Subsequently, at 220, features are extracted from the artifact so that the vector can be padded. Optionally, at 230, one or more feature reduction operations are performed to reduce the features in the vector. Then, at 240, the vector is fed into an anomaly detection model, which includes a deep generative model to generate a first score. This first score characterizes the artifact as malicious or benign for access, execution, or continued execution. Furthermore, at 250, the vector is fed into a machine learning-based classification model to generate a second score. This second score also characterizes the artifact as malicious or benign for access, execution, or continued execution. At 206, based on the first score, the second score is then modified to obtain a final score. At 270, this final score can then be provided to a consumer application or process.

[0103] Figure 3 This is a schematic diagram 300 illustrating a sample computing device architecture for implementing the various aspects described herein. Bus 304 may serve as an information highway interconnecting other illustrated components of the hardware. A processing system 308, labeled CPU (Central Processing Unit) (e.g., one or more computer processors / data processors at a given computer), can perform computational and logical operations required for program execution. Non-transitory processor-readable storage media, such as read-only memory (ROM) 312 and random access memory (RAM) 316, can communicate with processing system 308 and may include one or more programming instructions for the operations specified herein. Optionally, program instructions may be stored on a non-transitory computer-readable storage medium, such as a magnetic disk, optical disk, recordable memory device, flash memory, or other physical storage medium.

[0104] In one example, disk controller 348 may interface with one or more optional disk drives to system bus 304. These disk drives may be external or internal floppy disk drives (such as 360); external or internal CD-ROM, CD-R, CD-RW, or DVD drives, or solid-state drives (such as 352); or external or internal hard disk drives 356. As previously mentioned, these various disk drives 352, 356, 360, and disk controller are optional devices. System bus 304 may also include at least one communication port 320 to allow communication with external devices that are physically connected to the computing system or are available externally via wired or wireless networks. In some cases, at least one communication port 320 includes or otherwise includes a network interface.

[0105] To provide interaction with the user, the subjects described herein can be implemented on a computing device having: a display device 340 (such as a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information acquired from bus 304 via display interface 314 to the user; and input devices 332, such as a keyboard and / or pointing devices (e.g., a mouse or trackball) and / or a touchscreen, through which the user can provide input to the computer. Other types of input devices 332 can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback via microphone 336, or haptic feedback); and input received from the user in any form, including acoustic, speech, or haptic input. Input devices 332 and microphone 336 can be coupled to bus 304 and communicate information via bus 304 through input device interface 328. Other computing devices (such as dedicated servers) may omit one or more displays 340 and display interface 314, input devices 332, microphones 336, and input device interface 328.

[0106] One or more aspects or features of the subject matter described herein can be implemented in digital electronic circuits, integrated circuits, application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), computer hardware, firmware, software, and / or combinations thereof. These various aspects or features can be implemented in one or more computer programs that are executable and / or interpretable on a programmable system; such programmable systems include at least one programmable processor, at least one input device, and at least one output device, the programmable processor being dedicated or general-purpose, coupled to receive data and instructions from and transfer data and instructions to a storage system. The programmable system or computing system can include clients and servers. Clients and servers are typically geographically separated and typically interact via a communication network. The client-server relationship is generated by computer programs that run on their respective computers and have a client-server relationship with each other.

[0107] These computer programs (which may also be referred to as programs, software, software applications, applications, components, or code) include machine instructions for programmable processors and can be implemented using high-level programming languages, object-oriented programming languages, functional programming languages, logic programming languages, and / or assembly / machine languages. As used herein, the term "computer-readable medium" refers to any computer program product, apparatus, and / or device (such as, for example, a disk, optical disk, memory, and programmable logic device (PLD)) used to provide instructions and / or data to a programmable processor, and the term "computer-readable medium" includes a computer-readable medium that receives machine instructions as a machine-readable signal. The term "machine-readable signal" refers to any signal used to provide machine instructions and / or data to a programmable processor. The machine-readable medium may store such machine instructions non-transitory, such as, for example, non-transitory solid-state memory, or magnetic hard disk drive, or any equivalent storage medium. The machine-readable medium may alternatively or additionally store such machine instructions transiently, such as, for example, a processor cache or other random access memory associated with one or more physical processor cores.

[0108] In the foregoing description and claims, phrases such as “at least one of” or “one or more of” may appear after a combined list of elements or features. The term “and / or” may also appear in a list of two or more elements or features. Unless otherwise implicitly or explicitly contradicted by the context in which it is used, such phrases are intended to individually refer to any listed element or feature, or to refer to any stated element or feature in combination with any other stated element or feature. For example, the phrases “at least one of A and B,” “one or more of A and B,” and “A and / or B” are intended to respectively refer to “A alone,” “B alone,” or “A and B together.” A similar understanding is also intended for including three or more items. For example, the phrases “at least one of A, B, and C,” “one or more of A, B, and / or C” are each intended to refer to “A alone,” “B alone,” “C alone,” “A and B together,” “A and C together,” “B and C together,” or “A and B and C together.” Furthermore, the use of the term "based on" above and in the claims is intended to mean "at least partially based on," making unrecorded features or elements permissible as well.

[0109] Depending on the desired configuration, the subject matter described herein can be implemented in systems, apparatuses, methods, and / or articles of art. The implementations set forth in the foregoing description do not represent all implementations consistent with the subject matter described herein. Rather, they are examples consistent only with aspects relevant to the described subject matter. While several variations have been described in detail above, other modifications or additions are possible. In particular, further features and / or variations may be provided in addition to those implementations set forth herein. For example, the above implementations may be for various combinations and sub-combinations of the disclosed features, and / or combinations and sub-combinations of several further features disclosed above. Furthermore, the logic flowcharts depicted in the accompanying drawings and / or the logic flowcharts described herein do not necessarily require a particular or sequential order to achieve the desired result. Other implementations may be within the scope of the appended claims.

Claims

1. A computer-implemented method, comprising: Received products; Extract features from the article and fill in the vector; The vector is input into an anomaly detection model, which includes a deep generative model for generating a first score that characterizes the artifact as malicious or benign for accessing, executing, or continuing to execute. If the first score is below a threshold, the vector is input into a first machine learning-based classification model to generate a second score, which characterizes the artifact as malicious or benign for accessing, executing, or continuing to execute. If the first score is higher than the threshold, the vector is passed to a second machine learning-based classification model to generate the second score. The second machine learning-based classification model is cloud-based and computationally more intensive than the first machine learning-based classification model. The second score is modified based on the first score to obtain the final score; as well as The final score is provided to the consumer application or process.

2. The method according to claim 1, wherein the deep generation model is a likelihood-based model.

3. The method according to claim 2, wherein the likelihood-based model comprises a variational autoencoder.

4. The method of claim 2, wherein the likelihood-based model comprises a normalized flow.

5. The method of claim 1, wherein the anomaly detection model forms part of a model set, the model set comprising at least one machine learning model selected from a group, the group comprising: Logistic regression model, neural network, convolutional neural network, recurrent neural network, generative adversarial network, support vector machine, random forest, or Bayesian model.

6. The method according to claim 1, further comprising: Before the vector is input into the anomaly detection model, a feature reduction operation is used to reduce the features in the vector.

7. The method of claim 6, wherein the feature reduction operation comprises random projection or feature hashing.

8. The method of claim 6, wherein the feature reduction operation comprises deterministic or stochastic principal component analysis.

9. The method of claim 1, wherein the modification includes: Combine the first score and the second score.

10. The method of claim 1, wherein the modification includes: When the first score is higher than the threshold, the second score is overwritten.

11. The method according to claim 1, further comprising: Replace the second score with the baseline score as the final score.

12. The method of claim 1, wherein the modification includes: Weights are applied to the second score, which are variable and based on the first score.

13. The method of claim 1, wherein there are multiple vectors and multiple classification models, and wherein the models comprise: The varying weights are applied to each of the plurality of classification models based on the first score.

14. The method of claim 1, wherein the modification includes: Weights are applied to the second score, the weights being variable and based on the first score; And the weighted second score and the baseline score are combined.

15. A system comprising: At least one data processor; as well as The memory includes instructions that, when executed by the at least one data processor, cause operations including: Received products; Extract features from the article and fill in the vector; The vector is input into an anomaly detection model, which includes a deep generative model for generating a first score that characterizes the artifact as malicious or benign for accessing, executing, or continuing to execute. If the first score is below a threshold, the vector is input into a first machine learning-based classification model to generate a second score, which characterizes the artifact as malicious or benign for accessing, executing, or continuing to execute. If the first score is higher than the threshold, the vector is passed to a second machine learning-based classification model to generate the second score. The second machine learning-based classification model is cloud-based and computationally more intensive than the first machine learning-based classification model. The second score is modified based on the first score to obtain the final score; and The final score is provided to the consumer application or process.

16. A non-transitory computer program product, the non-transitory computer program product comprising instructions that, when executed by at least one computing device, cause an operation, the operation comprising: Received products; Extract features from the article and fill in the vector; The vector is input into an anomaly detection model, which includes a deep generative model for generating a first score that characterizes the artifact as malicious or benign for accessing, executing, or continuing to execute. If the first score is below a threshold, the vector is input into a first machine learning-based classification model to generate a second score, which characterizes the artifact as malicious or benign for accessing, executing, or continuing to execute. If the first score is higher than the threshold, the vector is passed to a second machine learning-based classification model to generate the second score. The second machine learning-based classification model is cloud-based and computationally more intensive than the first machine learning-based classification model. The second score is modified based on the first score to obtain the final score; as well as The final score is provided to the consumer application or process.

Images