Leveraging endpoint and network environment inferences for malware traffic classification

An apparatus, comprising:

• one or more network interfaces to communicate with a network;
• a processor coupled to the network interfaces and configured to execute one or more processes;
• and
• a memory configured to store a process executable by the processor, the process when executed configured to:
• obtain simulation environment data regarding traffic generated within a simulation environment in which malware is executed;
• train a malware detector using the simulation environment data;
• obtain deployment environment characteristics of a network to which the malware detector is to be deployed;
• train a first machine learning-based classifier to distinguish between traffic in the simulation environment in which malware is executed and traffic in a deployment environment in which the malware detector is to be deployed;
• and
• configure the malware detector to ignore data in the simulation environment data that is associated with one or more environment characteristics that are not present in the deployment environment characteristics using the trained first machine learning-based classifier.

A tangible, non-transitory, computer-readable medium storing program instructions that cause a device to execute a process comprising:

• obtaining, by the device, simulation environment data regarding traffic generated within a simulation environment in which malware is executed;
• training, by the device, a malware detector using the simulation environment data;
• obtaining, by the device, deployment environment characteristics of a network to which the malware detector is to be deployed;
• training, by the device, a first machine learning-based classifier to distinguish between traffic in the simulation environment in which malware is executed and traffic in a deployment environment in which the malware detector is to be deployed;
• and
• configuring, by the device, the malware detector to ignore data in the simulation environment data that is associated with one or more environment characteristics that are not present in the deployment environment characteristics using the trained first machine learning-based classifier.