Detecting unknown malicious content in computer systems

One or more computer storage media having computer-executable instructions embodied thereon that, when executed, by one or more processors, cause the one or more processors to perform a method, the method comprising:

• receiving a request to determine whether content is malicious;
• extracting a plurality of features from the content;
• expanding an EventID feature of the content to a full API name and encoding the full API name as a string using character-level trigrams;
• based on the plurality of features and the expanding, generating, via a deep learning model, a similarity score between the content and each of a plurality of known malicious contents, each of the plurality of known malicious contents belonging to a distinct malicious family;
• and
• at least partially responsive to the similarity score being above a threshold for the content and a known malicious content of the plurality of known malicious contents, causing an identifier representing the known malicious content to be provided to a computing device, wherein the identifier indicates that the content is likely malicious or the content likely belongs a same malicious family as the known malicious content.

A system comprising:

• one or more processors;
• and
• one or more computer storage media storing computer-useable instructions that, when used by the one or more processors, cause the one or more processors to perform a method, the method comprising:
• receiving a request to determine whether a computer object contains malicious content;
• extracting a plurality of features from the computer object;
• determining whether an indication of the computer object is within a threshold distance, in feature space, to a set of known malicious computer objects based on the plurality of features, wherein an embedding of the set of known malicious computer objects in the feature space is learned via training based on learned weights for different features of the set of known malicious computer objects;
• and
• at least partially responsive to determining whether the indication of the computer object is within the threshold distance, providing, to a user interface of a computing device, an identifier indicating whether the computer object contains malicious content.