Data-driven identification of malicious files using machine learning and an ensemble of malware detection procedures

A system, comprising:

• a memory;
• and
• at least one processing device, coupled to the memory, operative to implement the following steps:
• obtaining a file;
• extracting metadata from the file;
• obtaining a plurality of malware detection procedures;
• selecting a subset of the plurality of malware detection procedures to apply to the file utilizing a likelihood that each of the plurality of malware detection procedures will result in a malware detection for the file based on the extracted metadata;
• applying the selected subset of the malware detection procedures to the file;
• and
• processing results of the subset of malware detection procedures using a machine learning model to determine a probability of the file being malware.

A computer program product, comprising a non-transitory machine-readable storage medium having encoded therein executable code of one or more software programs, wherein the one or more software programs when executed by at least one processing device perform the following steps:

• obtaining a file;
• extracting metadata from the file;
• obtaining a plurality of malware detection procedures;
• selecting a subset of the plurality of malware detection procedures to apply to the file utilizing a likelihood that each of the plurality of malware detection procedures will result in a malware detection for the file based on the extracted metadata;
• applying the selected subset of the malware detection procedures to the file;
• and
• processing results of the subset of malware detection procedures using a machine learning model to determine a probability of the file being malware.