Identifying ambiguous patterns as malware using generative machine learning

A non-transitory computer-readable medium comprising memory with instructions encoded thereon that, when executed by one or more processors, cause the one or more processors to perform operations comprising:

• receiving a request to scan a package integration for a malicious dependency, the package integration comprising a plurality of dependencies, the package integration to be integrated into an application;
• determining, using a known package cache, a subset of the plurality of dependencies that have not been previously scanned;
• inputting content of each file of the subset into a malware detection model;
• receiving, as output from the malware detection model, an identification of an ambiguous pattern, the ambiguous pattern having at least a first threshold probability of indicating malware may be present, but less than a second threshold probability corresponding to a conclusion that malware is in fact present;
• responsive to receiving the identification of the ambiguous pattern, inputting the ambiguous pattern into a severity model;
• receiving, as output from the severity model, a level of severity that the ambiguous pattern would impose on an assumption that malware is present;
• responsive to determining that the level of severity is above a threshold minimum level of severity, transmitting a query to a generative machine learning model to determine whether malware is present in the ambiguous pattern;
• and
• determining whether malware is present based on a response from the generative machine learning model.

A system comprising:

• memory with instructions encoded thereon;
• and
• one or more processors that, when executing the instructions, are caused to perform operations comprising:
• receiving a request to scan a package integration for a malicious dependency, the package integration comprising a plurality of dependencies, the package integration to be integrated into an application;
• determining, using a known package cache, a subset of the plurality of dependencies that have not been previously scanned;
• inputting content of each file of the subset into a malware detection model;
• receiving, as output from the malware detection model, an identification of an ambiguous pattern, the ambiguous pattern having at least a first threshold probability of indicating malware may be present, but less than a second threshold probability corresponding to a conclusion that malware is in fact present;
• responsive to receiving the identification of the ambiguous pattern, inputting the ambiguous pattern into a severity model;
• receiving, as output from the severity model, a level of severity that the ambiguous pattern would impose on an assumption that malware is present;
• responsive to determining that the level of severity is above a threshold minimum level of severity, transmitting a query to a generative machine learning model to determine whether malware is present in the ambiguous pattern;
• and
• determining whether malware is present based on a response from the generative machine learning model.