Artefact classification using xenospace centroids

A system comprising:

• at least one data processor;
• and
• memory storing instructions which, when executed by the at least one data processor, result in operations comprising:
• receiving an artefact;
• parsing the artefact into a plurality of observations;
• inputting a first subset of the observations into a machine learning model trained using historical data to classify the artefact;
• inputting a second subset of the observations into a xenospace centroid configured to indicate whether cloud processing is needed to classify the artefact, the second subset of the observations being at least partially different than the first subset of the observations;
• providing the second subset of observations to a remote computing system for analysis when an output of the xenospace centroid generated in response to inputting the second subset of observations indicates that the artefact requires cloud processing and receiving a classification from the remote computing system;
• classifying the artefact as malicious or benign based on a combination of (i) an output of the machine learning model generated in response to inputting the first subset of observations and (ii) the received classification from the remote computing system when the output of the xenospace centroid indicates that the artefact requires cloud processing;
• classifying the artefact as malicious or benign based solely on the output of the machine learning model when the xenospace centroid indicates that the artefact does not need cloud processing;
• and
• preventing the artefact from being executed, from continuing to execute, and from being accessed when the artefact is classified as malicious.

A computer-implemented method comprising:

• receiving an artefact;
• parsing the artefact into a plurality of observations;
• inputting a first subset of the observations into a machine learning model trained using historical data to classify the artefact as being malicious or benign;
• inputting a second subset of the observations into a xenospace centroid configured to indicate whether the artefact requires cloud processing;
• providing the second subset of observations to a remote computing system for analysis when an output of the xenospace centroid generated in response to inputting the second subset of observations indicates that the artefact requires cloud processing and receiving a classification from the remote computing system;
• classifying the artefact as malicious or benign based on a combination of (i) an output of the machine learning model generated in response to inputting the first subset of observations and (ii) the received classification from the remote computing system when the output of the xenospace centroid indicates that the artefact requires cloud processing;
• classifying the artefact as malicious or benign based solely on the output of the machine learning model when the xenospace centroid indicates that the artefact does not need cloud processing;
• and
• preventing the artefact from being executed, from continuing to execute, and from being accessed when the artefact is classified as malicious.