System and method for analyzing binary code for malware classification using artificial neural network techniques

A system for detecting whether an executable file including binary code is associated with a cyber-attack, the system comprising:

• an intelligence-driven analysis subsystem to (i) receive the executable file, (ii) inspect and compute features of the executable file for indicators associated with a cyber-attack where the features are associated with one or more data patterns, and (iii) produce a first output representing the detected features;
• a computational analysis subsystem including a convolutional neural network (CNN) to (i) receive a CNN input being a first representation of at least one section of binary code from the executable file as input, and (ii) process the first representation of the section to produce a second output, the convolutional neural network is configured to identify patterns in the first representation operating as the CNN input and producing the second output representative of the patterns;
• and
• a post-analysis subsystem communicatively coupled to both the intelligence-driven analysis subsystem and the computational analysis subsystem, the post-analysis subsystem comprises a classifier being configured to (i) receive a first output from the intelligence-driven analysis subsystem and a second output from the convolutional neural network and (ii) determine a classification assigned to the executable file,
• wherein the classifier is communicatively coupled to the computational analysis subsystem, the classifier being configured to (i) receive the second output including one or more patterns for use in determining whether the first representation is associated with a cyber-attack, (ii) receive the first output from the intelligence-driven analysis subsystem operating concurrently with the convolutional neural network, wherein the first output is based on static analysis of the executable file, and (iii) determine the classification assigned to the executable file based, at least in part, on a threat score generated based on at least the received first output and the received second output.

A method for classifying a file as a benign file or a malicious file associated with a cyber-attack, comprising:

• receiving the file, the file comprises a binary code, the binary code corresponding to executable machine code;
• selecting a section of the binary code from the file;
• encoding the binary code section to produce a first representation of the binary code section;
• processing the first representation of the binary code section by a convolutional neural network, the processing performed by the convolutional neural network includes applying a plurality of weighting operations executing a programmatic function on the first representation to produce an output including a threat score for use in determining whether the file is associated with a cyber-attack, the programmatic function being trained using a training set including labeled patterns associated with at least one of (i) benign files and (ii) malicious files;
• and
• determining a classification assigned to the file at least based, at least in part, on a threat score generated based on the received output from the convolutional neural network and an output from an intelligence-driven analysis subsystem operating concurrently with the deep neural network, wherein the output is based on static analysis of the executable file.