Malware detection by distributed telemetry data analysis

A computer system comprising:

• one or more computer processors;
• one or more computer readable storage media;
• and program instructions stored on the computer readable storage media for execution by at least one of the one or more processors, the program instructions comprising:
• program instructions to examine a process for indicators of compromise to the process;
• program instructions to determine a categorization of the process based upon a result of the examination;
• in response to determining that the categorization of the process does not correspond to a known benevolent process and a known malicious process, program instructions to execute the process in a secure enclave on a local host computer;
• program instructions to collect telemetry data from executing the process in the secure enclave;
• program instructions to pass the collected telemetry data from the secure enclave to a locally trained neural network process and a federated trained neural network process, wherein training data of the locally trained neural network process comprises other telemetry data from processes being executed on the local host computer underlying the locally trained neural network process;
• program instructions to determine a result of a first loss function for the locally trained neural network process;
• program instructions to compare the result of the first loss function for the locally trained neural network process with a result of a loss function at an end of a training of said locally trained neural network process;
• program instructions to aggregate the result of the first loss function and a result of a second loss function for the federated trained neural network process that is trained differently than the locally trained neural network process;
• and
• program instructions to determine whether the process is anomalous based on the aggregated results.

A computer program product comprising:

• one or more computer readable storage media and program instructions stored on the one or more computer readable storage media, the program instructions comprising:
• program instructions to examine a process for indicators of compromise to the process;
• program instructions to determine a categorization of the process based upon a result of the examination;
• in response to determining that the categorization of the process does not correspond to a known benevolent process and a known malicious process, program instructions to execute the process in a secure enclave on a local host computer;
• program instructions to collect telemetry data from executing the process in the secure enclave;
• program instructions to pass the collected telemetry data from the secure enclave to a locally trained neural network process and a federated trained neural network process, wherein training data of the locally trained neural network system comprises other telemetry data from processes being executed on the local host computer underlying the locally trained neural network process;
• program instructions to determine a result of a first loss function for the locally trained neural network process;
• program instructions to compare the result of the first loss function for the locally trained neural network process with a result of a loss function at an end of a training of said locally trained neural network process;
• program instructions to aggregate the result of the first loss function and a result of a second loss function for the federated trained neural network process that is trained differently than the locally trained neural network process;
• and
• program instructions to determine whether the process is anomalous based on the aggregated results.