Malware detection based on training using automatic feature pruning with anomaly detection of execution graphs

A computer-implemented method comprising:

• receiving, by one or more processors, multiple files each labeled as a threat or non-threat,
• generating, by one or more processors, an execution graph of each of the received files,
• identifying, by one or more processors, behaviors of the multiple files from the execution graph;
• performing anomaly detection on the identified behaviors to classify the behaviors as anomalous or non-anomalous based on the execution graphs,
• iteratively generating, by one or more processors, one or more classifiers using different feature sets of classified behaviors per iteration until an accuracy threshold is met or exceeded, wherein if the one or more classifiers of a particular feature set do not meet or exceed the accuracy threshold, membership of the particular feature set is iteratively pruned until the accuracy threshold is met to provide a modified feature set and the one or more classifiers are generated again based on the modified feature set, and
• outputting, by one or more processors, the one or more classifiers and a corresponding feature set of classified behaviors that met or exceeded the accuracy threshold for classification of the multiple files as either an actual threat or an actual non-threat.

A computer system comprising:

• one or more memories storing instructions;
• a training engine comprising one or more processors configured to execute the stored instructions to cause the training engine to:
• receive multiple files each labeled as a threat or non-threat,
• generate an execution graph of each of the received files,
• identify behaviors of the multiple files;
• performing anomaly detection on the behaviors to classify the behaviors as anomalous or non-anomalous based on the execution graphs,
• iteratively generate one or more classifiers using different feature sets of classified behaviors per iteration until an accuracy threshold is met or exceeded, wherein if the one or more classifiers of a particular feature set do not meet or exceed the accuracy threshold, membership of the particular feature set is iteratively pruned until the accuracy threshold is met to provide a modified feature set and the one or more classifiers are generated again based on the modified feature set, and
• output the one or more classifiers and a corresponding feature set of classified behaviors that met or exceeded the accuracy threshold for classification of the multiple files as an actual threat or an actual non-threat;
• and
• a runtime detection engine comprising one or more processors configured to execute the stored instructions to cause the runtime detection engine to:
• load the outputted one or more classifiers and the corresponding feature set of behaviors,
• receive a file,
• identify, from an execution graph of the received file, the behaviors corresponding to the loaded feature set, by generating the execution graph of the received file, and extracting the behaviors from the execution graph corresponding to the loaded feature set;
• apply the loaded one or more classifiers to the extracted behaviors, and
• output the received file with a label of threat or non-threat based on the application of the loaded one or more classifiers to the extracted behaviors.

A computer system comprising:

• one or more memories storing instructions;
• and
• one or more processors configured to execute the instructions to cause the system to:
• receive multiple e-mails each labeled as a threat or non-threat,
• receive network data associated with each of the multiple e-mails,
• identify behaviors of the multiple e-mails;
• perform anomaly detection on the behaviors to classify the behaviors as anomalous or non-anomalous based on the network data,
• iteratively generate one or more classifiers using different feature sets of
• classified behaviors per iteration until an accuracy threshold is met or exceeded, wherein if one or more classifiers of a particular feature set do not meet or exceed the accuracy threshold, membership of the particular feature set is iteratively pruned until the accuracy threshold is met to provide a modified feature set and one or more classifiers are generated again based on the modified feature set, and
• output one the or more classifiers and a corresponding feature set of classified behaviors that met or exceeded the accuracy threshold for classification of e-mails as a threat or non-threat.