System and method for training a detection model using machine learning

A system for machine learning by a model for detection of malicious files, comprising:

• a hardware processor, configured to:
• select a plurality of known safe files and known malicious files from a database of files used to perform training of a model for detecting a malicious file based on predetermined rules of forming a training selection of files, wherein the hardware processor configured to select the files is configured to select the files based on predetermined rules of forming a training selection of files, wherein the predetermined rules specify at least ratios of selected safe and malicious files;
• execute the plurality of selected files;
• form one or more behavior patterns from intercepted one or more commands and parameters during execution of the selected files;
• form a detection model, wherein the detection model selects a method of machine learning and is initialized with one or more hyper-parameters;
• train the detection model by calculating the one or more hyper-parameters based on the one or more behavior patterns to form a group of rules for calculating a degree of maliciousness of a resource;
• and
• calculate degree of maliciousness of another file based on the trained detection model.

A non-transitory computer-readable medium, storing instructions thereon for machine learning by a model for detection of malicious files, the instructions comprising:

• selecting a plurality of known safe files and known malicious files from a database of files used to perform training of a model for detecting a malicious file, wherein selecting of the files is based on predetermined rules of forming a training selection of files, wherein the predetermined rules specify at least ratios of selected safe and malicious files;
• executing by a processor the plurality of selected files;
• forming one or more behavior patterns from intercepted one or more commands and parameters during execution of the selected files;
• forming a detection model, wherein the detection model selects a method of machine learning and is initialized with one or more hyper-parameters;
• training the detection model by calculating the one or more hyper-parameters based on the one or more behavior patterns to form a group of rules for calculating a degree of maliciousness of a resource;
• and
• calculating a degree of maliciousness of another file based on the trained detection model.