Machine learning methods and systems for determining file risk using content disarm and reconstruction analysis

A method of training a machine learning algorithm for addressing malware, the method comprising:

• providing files known to contain malware in a malicious group;
• providing files known not to contain malware in a non-malicious group;
• performing content disarm and reconstruction (CDR) analysis on files in both groups by:
• parsing the analyzed files into standard and non-standard components,
• re-creating standard components from known-good data according to standardized specifications,
• combining the re-created standard components with information from the non-standard components to create a substitute electronic file visually identical to the analyzed file, and
• creating a machine readable summary report for each analyzed file, each machine readable summary report including multiple report items based on file content and structure;
• training the machine learning algorithm with the machine readable summary reports and computing a probability function with the machine learning algorithm to estimate risk of the files that will generalize to new data and be useful for classifying unknown malware at least because the machine readable summary reports are based on file content and structure.