System and method for identifying activity in a computer system

A system for producing a set of indicators of unwanted activity in a computer system, comprising at least one hardware processor adapted to:

• receiving a plurality of input data sets, each describing system activity of a computer system over an identified period of time and comprising an infection label and system activity information collected from said computer system;
• producing a plurality of training sets, wherein each of the plurality of training sets comprising:
• 1) a plurality of system activity values, wherein each of the plurality of system activity values is indicative of an execution of a respective instruction of a plurality of instructions executed by a computerized device of the computer system, and extracted from one of the plurality of input data sets, and 2) a respective infection label, wherein at least one system activity value of the plurality of system activity values, associated with a certain one of the plurality of instructions, is selected from a group consisting of:
• a time value, a network address value, a file name value, a file path value, a digital memory address value, an amount of digital memory, a registry key path value, a registry key value, a network protocol identifier value, a network port value, an amount of bytes, a user name value, a user account type value and a domain name value;
• producing for each training set of the plurality of training sets one of a plurality of sets of relevant system activity values by:
• training a classification model to output, in response to the respective training set, an infection classification equal to respective infection label;
• and
• analyzing the classification model to identify a set of relevant system activity values, of the plurality of system activity values, effecting the infection classification in response to the training data set;
• analyzing the plurality of sets of relevant system activity values to produce the plurality of indicators of unwanted activity;
• providing the plurality of indicators of unwanted activity to at least one security engine for the purpose of detecting unwanted activity in at least one other computer system;
• and
• wherein analyzing the plurality of sets of relevant system activity values to produce the plurality of indicators of unwanted activity comprises at least one operation selected from a group of operations consisting of:
• an intersection between at least some of the plurality of sets of relevant system activity values, sorting the plurality of relevant system activity values of the plurality of sets of relevant system activity values according to an identified sorting criterion, and applying a k-means classification method to at least some of the plurality of sets of relevant system activity values.

A system for identifying unwanted activity in a computer system, comprising at least one hardware processor adapted to:

• receiving input data comprising system activity information collected from the computer system over an identified period of time;
• extracting a plurality of system activity values from the input data, wherein each of the plurality of system activity values is indicative of an execution of a respective instruction of a plurality of instructions executed by a computerized device of the computer system, wherein at least one system activity value of the plurality of system activity values, associated with a certain one of the plurality of instructions, is selected from a group consisting of:
• a time value, a network address value, a file name value, a file path value, a digital memory address value, an amount of digital memory, a registry key path value, a registry key value, a network protocol identifier value, a network port value, an amount of bytes, a user name value, a user account type value and a domain name value;
• identifying in the plurality of system activity values at least one indicator of unwanted activity of a plurality of indicators of unwanted activity, generated by at least one other hardware processor by analyzing a classification model trained to output an infection classification in response to a plurality of input system activity values;
• outputting a determination of unwanted activity according to identifying the at least one indicator of unwanted activity;
• and
• wherein analyzing the plurality of sets of relevant system activity values to produce the plurality of indicators of unwanted activity comprises at least one operation selected from a group of operations consisting of:
• an intersection between at least some of the plurality of sets of relevant system activity values, sorting the plurality of relevant system activity values of the plurality of sets of relevant system activity values according to an identified sorting criterion, and applying a k-means classification method to at least some of the plurality of sets of relevant system activity values.