Prediction of execution behaviors in sandbox

A method of predicting a behavior of a sample program, said method comprising:

• executing said sample program in a sandbox module on a host computer;
• collecting first behaviors of said sample program using dynamic analysis;
• collecting second behaviors of said sample program using static analysis;
• feeding said first and second behaviors into a model of a recurrent neural network (RNN) that has been trained to predict behaviors of a computer program;
• and
• predicting, by said model, a first predicted behavior of said sample program based upon said first and second behaviors, wherein said predicting occurs after said steps of collecting and wherein said first predicted behavior is a future behavior at the time of said predicting and is not available from said dynamic analysis;
• and
• outputting said first predicted behavior and taking an action upon said sample program based upon said first predicted behavior.

A program behavior prediction system comprising:

• a sandbox module executing upon a host computer arranged to execute a sample program, said sandbox module including
• a dynamic analysis module arranged to collect run-time behaviors of said sample program,
• a decision engine arranged to output a decision regarding said sample program based upon an output first predicted behavior from a machine learning network model;
• and
• a sequence network executing upon said host computer arranged to input said run-time behaviors from said sample program, said sequence network including
• an encoder arranged to encode said run-time behaviors into numerical tuples,
• said machine learning network model that inputs said numerical tuples and is trained to output said first predicted behavior of said sample program based upon said numerical tuples, wherein said first predicted behavior is a future behavior at the time of said output from said machine learning network model and is not available from said dynamic analysis module, and
• a decoder arranged to decode a numerical tuple representing said predicted behavior into an output predicted behavior for delivery to said decision engine.