Utilizing machine learning to detect malicious executable files efficiently and effectively

A method, implemented in a cloud-based system comprising steps of:

• responsive to training a machine learning model with a combination of knowledge features and non-knowledge features, wherein the knowledge features include features associated executable files determined to be effective for training, and wherein non-knowledge features include n-grams, entropy, and file size, receiving the machine learning model;
• performing inline monitoring of production traffic between users, the Internet, and cloud services;
• utilizing the trained machine learning model to inspect files in the production traffic;
• and
• classifying the traffic as one of malicious or benign based on the trained machine learning model.

A server in a cloud-based system comprising:

• one or more processors;
• and
• memory storing instructions that, when executed, cause the one or more processors to:
• responsive to training a machine learning model with a combination of knowledge features and non-knowledge features, wherein the knowledge features include features associated with executable files determined to be effective for training, and wherein non-knowledge features include n-grams, entropy, and file size, receive the machine learning model;
• perform inline monitoring of production traffic between users, the Internet, and cloud services;
• utilize the trained machine learning model to inspect files in the production traffic;
• and
• classify the traffic as one of malicious or benign based on the trained machine learning model.