Training a machine learning model for container file analysis

A method, comprising:

• training, based at least on training data, a machine learning model to enable the machine learning model to determine whether at least one container the includes at least one the rendering the at least one container the malicious, each container the encapsulating a plurality of files;
• and
• providing the trained machine learning model to enable a determination of whether at least one subsequently received container the includes at least one the rendering the at least one subsequently received container the malicious, the determination comprising a classification of the at least one subsequently received container the which is used to determine whether to access the plurality of files contained within the at least one subsequently received container file;
• wherein:
• the training data comprises a plurality of historical container files at least a portion of which are known to include the at least one the rendering the historical container the malicious;
• for each historical container file, features from each the contained therein are concatenated to form an extended feature space for use during the training;
• the extended feature space prevents misclassification by the trained machine learning model for different container files storing identical or similar sets of files in a different order;
• and
• the features are selected from a group consisting of:
• the name, the path or location, size, creator, owner, or embedded Universal Resource Locator (URL).

A non-transitory computer program product storing instructions which, when executed by at least one processor, result in operations comprising:

• training, based at least on training data, a machine learning model to enable the machine learning model to determine whether at least one container the includes at least one file rendering the at least one container the malicious, each container the encapsulating a plurality of files;
• and
• providing the trained machine learning model to enable a determination of whether at least one subsequently received container the includes at least one the rendering the at least one subsequently received container file malicious, the determination comprising a classification of the at least one subsequently received container the which is used to determine whether to access the plurality of files contained within the at least one subsequently received container file, wherein:
• the training data comprises a plurality of historical container files at least a portion of which are known to include the at least one the rendering the historical container the malicious;
• for each historical container file, features from each the contained therein are concatenated to form an extended feature space for use during the training;
• the extended feature space prevents misclassification by the trained machine learning model for different container files storing identical or similar sets of files in a different order;
• and
• the features are selected from a group consisting of:
• the name, the path or location, size, creator, owner, or embedded Universal Resource Locator (URL).