Automated feature extraction and artificial intelligence (AI) based detection and classification of malware

A method comprising:

• maintaining, by a central training node of a cybersecurity fabric, a sample library having a plurality of samples, wherein the samples include virus samples and benign samples;
• generating, by the central training node, a global virus classification model by extracting features from the plurality of samples and training a machine-learning classifier or a deep-learning neural network, wherein said extracting features from the plurality of samples comprises:
• transforming, by the central training node, each binary file of a plurality of binary files, representing the plurality of samples, into a time series vector represented in a form of a plurality of chunks, wherein each chunk includes j bits and each chunk is interpreted as an unsigned integer value ranging from 0 to 2j−1 and wherein a size of the time series vector is equal to a number of the plurality of chunks;
• and projecting, by the central training node, the time series vector from a time domain to a first domain by applying a transformation to the time series vector;
• distributing, by the central training node, the global virus classification model to a plurality of detection nodes of the cybersecurity fabric for use by each of the plurality of detection nodes as a local virus detection model in connection with virus detection and sample collection, wherein each of the plurality of detection nodes is associated with a respective customer network;
• responsive to detection of a virus in network traffic being processed by a detection node of the plurality of detection nodes, receiving, by the central training node, a virus sample from the detection node;
• in response to determination that an instance of the received virus sample is already present in the sample library, then foregoing, by the central training node, incorporation of the received virus sample into the sample library;
• in response to determination that the instance of the received virus sample is not present in the sample library, then incorporating, by the central training node, the received virus sample into the sample library by adding the received virus sample into an appropriate category of a plurality of virus family categories based on a virus family with which the received virus sample is associated;
• creating or updating, by the central training node, a feature depository by extracting features from the plurality of samples;
• and
• responsive to a retraining event:
• creating, by the central training node, an improved global virus classification model by retraining the machine-learning classifier or the deep-learning neural network based on features contained in the feature depository;
• and
• causing, by the central training node, the plurality of detection nodes to be upgraded by distributing the improved global virus classification model to the plurality of detection nodes to replace their respective local virus detection models.