Systems and methods for malware detection using localized machine learning
AssigneeCA, Inc.
InventorsQichao Lan, Tao Cheng
Life of this patent
Estimating the term…
Abstract
The disclosed computer-implemented method for malware detection using localized machine learning may include (i) generating a global score for a file using a global machine learning model, (ii) generating a localized score for the file using a localized machine learning model, (iii) determining that the file is malware using the global score, the localized score, and the local conviction threshold, and (iv) in response to determining that the file is malware, performing a security action to protect the computing device against malware. Various other methods, systems, and computer-readable media are also disclosed.
Claims20
A computer-implemented method for malware detection using localized machine learning, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising:
- generating, by a computing device of a computing environment, a global score for a file using a global machine learning model;
- generating a localized score for the file using a localized machine learning model;
- identifying a number of new static clusters of computing devices in the computing environment of the computing device in a time period;
- determining that the number of the new static clusters is below an identified threshold;
- determining to use the localized machine learning model;
- determining that the file is malware using the global score, the localized score, and a local conviction threshold;
- and
- in response to determining that the file is malware, performing a security action to protect the computing device against malware.
A system for malware detection using localized machine learning, the system comprising:
- at least one physical processor;
- physical memory comprising computer-executable instructions that, when executed by the physical processor, cause the physical processor to:
- generate a global score for a file using a global machine learning model of a computing device;
- generate a localized score for the file using a localized machine learning model;
- identify a number of new static clusters of computing devices in a computing environment of the computing device in a time period;
- determine that the number of the new static clusters is below an identified threshold;
- determine to use the localized machine learning model;
- determine that the file is malware using the global score, the localized score, and a local conviction threshold;
- and
- in response to determining that the file is malware, perform a security action to protect the computing device against malware.
A non-transitory computer-readable medium comprising one or more computer-executable instructions that, when executed by at least one processor of a computing device, cause the computing device to:
- generate a global score for a file using a global machine learning model;
- generate a localized score for the file using a localized machine learning model;
- identify a number of new static clusters of computing devices in a computing environment of the computing device in a time period;
- determine that the number of the new static clusters is below an identified threshold;
- determine to use the localized machine learning model;
- determine that the file is malware using the global score, the localized score, and a local conviction threshold;
- and
- in response to determining that the file is malware, perform a security action to protect the computing device against malware.
Dependencies are inferred from the claim text.