Methods and apparatus to improve detection of malware based on ecosystem specific data

A tangible computer-readable medium comprising instructions which, when executed, cause at least one processor to at least:

• apply, with a machine learning model, a weight to feedback associated with a sample, the feedback obtained from at least a customer ecosystem, the feedback including endpoint feedback, human feedback, infrastructure feedback, and global feedback, the endpoint feedback including static and dynamic features specific to the sample and a conviction applied by an endpoint associated with the sample after applying a custom policy on exclusion and custom exploit/detection rules;
• and
• in response to a score based on the weighted feedback satisfying a threshold for a classification, indicate to a user, with the machine learning model, that the classification for the sample is malicious.

An apparatus comprising:

• means for weighting feedback to apply, with a machine learning model, a weight to feedback associated with a sample, the feedback obtained from at least a customer ecosystem, the feedback including endpoint feedback, human feedback, infrastructure feedback, and global feedback, the endpoint feedback including static and dynamic features specific to the sample and a conviction applied by an endpoint associated with the sample after applying a custom policy on exclusion and custom exploit/detection rules;
• and
• means for convicting samples to, in response to a score based on the weighted feedback satisfying a threshold for a classification, indicate to a user, with the machine learning model, that the classification for the sample is malicious.

A method comprising:

• applying, with a machine learning model, a weight to feedback associated with a sample, the feedback obtained from at least a customer ecosystem, the feedback including endpoint feedback, human feedback, infrastructure feedback, and global feedback, the endpoint feedback including static and dynamic features specific to the sample and a conviction applied by an endpoint associated with the sample after applying a custom policy on exclusion and custom exploit/detection rules;
• and
• in response to a score based on the weighted feedback satisfying a threshold for a classification, indicating to a user, with the machine learning model, that the classification for the sample is malicious.