Retuning of random classification forests to improve efficacy

A computing device configured for optimizing computer detection of malware using pattern recognition by refreshing random classification forests, comprising:

• a processor;
• memory in electronic communication with the processor, wherein the memory stores computer executable instructions that when executed by the processor cause the processor to perform the steps of:
• building, by a server, a random forest based at least in part on a first set of categorized data, the random forest comprising two or more binary decision trees each comprising at least one leaf node;
• sending, by the server, the random forest to a client device with a first random forest control value;
• identifying, by the server, a second set of categorized data different from the first set of categorized data, the first set of categorized data comprising a first set of known malware files and known clean files, and the second set of categorized data comprising a second set of known malware files and known clean files separate from the first set of known malware files and known clean files;
• calculating, by the server, a second random forest control value based on the second set of categorized data, the second random forest control value comprising one or more updates for the random forest, the updates for the random forest comprising one or more confidence scores associated with at least one of the leaf nodes of the binary decision trees of the random forest;
• and
• sending, by the server, the second random forest control value to the client device.

A non-transitory computer-readable storage medium storing computer executable instructions that when executed by a processor cause the processor to perform the steps of:

• building, by a server, a random forest based at least in part on a first set of categorized data, the random forest comprising two or more binary decision trees each comprising at least one leaf node;
• sending, by the server, the random forest to a client device with a first random forest control value;
• identifying, by the server, a second set of categorized data different from the first set of categorized data, the first set of categorized data comprising a first set of known malware files and known clean files, and the second set of categorized data comprising a second set of known malware files and known clean files separate from the first set of known malware files and known clean files;
• calculating, by the server, a second random forest control value based on the second set of categorized data, the second random forest control value comprising one or more updates for the random forest, the updates for the random forest comprising one or more confidence scores associated with at least one of the leaf nodes of the binary decision trees of the random forest;
• and
• sending, by the server, the second random forest control value to the client device.