Detecting zero-day malware with tetra code

A non-transitory computer-readable medium in a Zero-day malicious detection system at least partially implemented in hardware, with end-to-end encryption, for using machine learning to detect that a file is malicious using an encrypted Tetra code representation of the file, without using content of the file and without decrypting the Tetra code, the method comprising:

• receiving, from a client, a Tetra code sample for determination as being malicious, clean, or unknown, wherein the Tetra code sample comprises encrypted features of the file;
• determining whether the Tetra code sample matches any previously stored Tetra codes, within a threshold and, if the Tetra code sample matches any stored Tetra code, retrieving a label for a family and a label for a variant associated with the stored Tetra code, and recalculating a family mask associated with the stored Tetra code and a variant mask within the family;
• responsive to the Tetra code sample not matching any stored Tetra codes, (a) generating an internal structure of the Tetra Code to expose correlations of encrypted features of the file, without any access to the file, (b) using machine learning to classify the internal structure of the Tetra code sample using the encrypted features against training data of encrypted features, and (c) predicting a label based on the classification;
• if the label is malicious, generating a signature for malicious Tetra code, without access to the file;
• and
• transmitting, to the client, any label for the Tetra code sample of encrypted features of the file for a security action by the client, and for malicious files, providing a signature to the client for future preemptive security actions by the client.

A Zero-day malicious detection system at least partially implemented in hardware with end-to-end encryption, at least partially implemented in hardware, for using machine learning to detect that a file is malicious using an encrypted Tetra code representation of the file, without using content of the file and without decrypting the Tetra code, the malicious detection system comprising:

• a processor;
• a network interface communicatively coupled to the processor and to the hybrid wireless network;
• and
• a memory, communicatively coupled to the processor and storing:
• a database to store a plurality of Tetra code samples organized by family and then by variant, along with a label to indicate the Tetra code sample as malicious, clean, mixed, or unknown;
• a Tetra code conversion module to receive a string sample from a file in real-time and converting the string code sample to a Tetra code;
• a Tetra code matching module to determine whether the real-time Tetra code matches any previously stored Tetra codes, within a threshold and, if the Tetra code sample matches a stored Tetra code, retrieving a label for a family and a label for a variant associated with the stored Tetra code, and recalculating a family mask associated with the stored Tetra code and a variant mask within the family,
• wherein responsive to the Tetra code sample does not match any stored Tetra codes, the Tetra code matching module determines whether the real-time Tetra code fits any family mask, and responsive to the Tetra code sample matches a family mask, retrieving the label for family and recalculating the family mask;
• and
• a label prediction module to, responsive to the Tetra code sample not matching any stored Tetra codes, (a) generate an internal structure of the Tetra Code to expose correlations of encrypted features of the file, without any access to the file, (b) using machine learning to classify the internal structure of the Tetra code sample using the encrypted features against training data of encrypted features, and (c) predict a label based on the classification,
• wherein the Tetra code sample is stored in the database associated with the new family label and/or the new variant label and
• any label for the file string sample is output.