A computer-implemented method for static analysis of executable files using predictive models, the method executable by a processor of a computing device, the method comprising:
- in a training phase:
- obtaining, by the processor, a plurality of training executable files, the plurality of training executable files including at least one malicious training executable file and at least one benign training executable file;
- analyzing, by the processor, each one of the plurality of training executable files to extract data therefrom including a plurality of features of each one of the plurality of training executable files;
- transforming, by the processor, the data organizing the plurality of features in sets of features, each set of features of which includes features of a respective predetermined type;
- enriching, by the processor, a set of features of the sets of features with additional features of the respective predetermined type for increasing accuracy of a respective predictive model to be applied to the set of features, the respective predictive model having been configured for identifying informative features of the respective predetermined type, the informative features being indicative of a training executable file of the plurality of training executable files being one of malicious and benign, the enriching including:
- enriching the set of features with at least one of additional feature obtained after examining Portable Executable (PE) files and indicators of compromise having been identified by human specialists in analysis of malicious code;
- applying, by the processor, to the set of features, the respective predictive model to identify therein the informative features indicative of the training executable file being one of malicious and benign, thereby generating at least one feature vector,
- training, by the processor, based on the at least one feature vector, at least one of an ensemble of classifiers to determine if an executable file is one of malicious and benign;
- and
- assigning, by the processor, to each one of the ensemble of classifiers, a respective weight value indicative of a priority of a respective predicted indicator thereof associated with the executable file amongst respective predicted indicators of other ones of the ensemble of classifiers;
- in an execution phase:
- obtaining, by the processor, the executable file;
- analyzing, by the processor, the executable file, to extract therefrom data including execution features;
- transforming, by the processor, the data organizing the execution features in at least one execution set of features;
- generating, by the processor, based on the at least one execution set of features, a respective execution feature vector;
- applying, by the processor, each one of the ensemble of classifiers to the respective execution feature vector to generate the respective predicted indicator of the executable file being one of malicious and benign;
- applying, by the processor, to the respective predicted indicators generated by the ensemble of classifiers, respective weight values associated therewith to generate respective weighted predicted indicators of the executable file being one of malicious and benign;
- determining, by the processor, an aggregate predicted indicator based on the respective weighted predicted indicators;
- and
- in response to the aggregate predicted indicator being indicative of the executable file being malicious, blocking, by the processor, the executable file.