Utilizing machine learning to detect ransomware in code

A computer system for screening a source code for ransomware, the computer system comprising one or more processors configured to perform operations of:

• accessing the source code of a script hosted by a remote server;
• extracting features from the source code in accordance with a machine-learning model comprising one or more layers of logic;
• at least based on the machine-learning model, determining, for each of the extracted features, a corresponding probability conditioned on the source code containing ransomware;
• and
• at least based on the machine-learning model, determining a combined probability for the extracted features conditioned on the source code containing ransomware when the extracted features are jointly present;
• comparing the combined probability with a threshold;
• in response to determining that the combined probability exceeds the threshold, flagging the source code as containing ransomware;
• and
• in response to determining that the combined probability does not exceed the threshold, flagging the source code as not containing ransomware.

A non-transitory computer-readable medium comprising software, which, when executed by a computer, causes the computer to execute operations of:

• accessing the source code of a script hosted by a remote server;
• extracting features from the source code in accordance with a machine-learning model comprising one or more layers of logic;
• at least based on the machine-learning model, determining, for each of the extracted features, a corresponding probability conditioned on the source code containing ransomware;
• and
• at least based on the machine-learning model, determining a combined probability for the extracted features conditioned on the source code containing ransomware when the extracted features are jointly present;
• comparing the combined probability with a threshold;
• in response to determining that the combined probability exceeds the threshold, flagging the source code as containing ransomware;
• and
• in response to determining that the combined probability does not exceed the threshold, flagging the source code as not containing ransomware.