Detecting malware attacks using extracted behavioral features

A computer-implemented method, comprising:

• receiving, via a processor, events from a plurality of activity monitors;
• extracting, via the processor, a plurality of behavioral features from the received events, wherein the behavioral features include network behavioral features, database behavioral features, and file behavioral features;
• detecting, via the processor, a malware attack based on the extracted behavioral features using a malware identification model trained on private data and public data, wherein the malware identification model includes a classification model trained using a machine learning technique based on both public data and private enterprise attack findings;
• and
• executing, via the processor, an ad hoc protection improvement based on the detected malware attack by dynamically installing a file access monitor agent on a machine correlated with the detected malware attack, wherein the file access monitor agent is dynamically improved by continuously updating knowledge bases of the file access monitor agent.

A computer program product for detecting malware attacks, the computer program product comprising:

• one or more computer-readable tangible storage medium and program instructions stored on at least one of the one or more tangible storage medium, the program instructions executable by a processor capable of performing a method, the method comprising:
• receiving events from a plurality of activity monitors;
• extracting a plurality of behavioral features from the received events, wherein the behavioral features include network behavioral features, database behavioral features, and file behavioral features;
• detecting a malware attack based on the extracted behavioral features using a malware identification model trained on private data and public data, wherein the malware identification model includes a classification model trained using a machine learning technique based on both public data and private enterprise attack findings;
• and
• executing an ad hoc protection improvement based on the detected malware attack by dynamically installing a file access monitor agent on a machine correlated with the detected malware attack, wherein the file access monitor agent is dynamically improved by continuously updating knowledge bases of the file access monitor agent.