Determining exploit prevention using machine learning

A system comprising:

• at least one processor;
• and
• memory coupled to the at least one processor, the memory storing computer executable instructions that, when executed by the at least one processor, performs a method comprising:
• receiving, by a machine learning system for exploit prevention from exploit prevention software executing on a computing device, process information for one or more protected processes protected by the exploit prevention software and executing on the computing device;
• generating, by the machine learning system, exploit prevention configuration settings for the exploit prevention software and process configuration settings for the one or more protected processes, based on the process information for the one or more protected processes, wherein generating the exploit prevention configuration settings comprises applying a machine learning model to the process information for the one or more protected processes, the machine learning model trained to determine the process configuration settings for the one or more protected processes and the exploit prevention configuration settings for the exploit prevention software, the machine learning model representing training data comprising:
• training process information for each of one or more processes protectable by the exploit prevention software;
• and
• training configuration settings;
• providing, by the machine learning system to the exploit prevention software executing on the computing device, the exploit prevention configuration settings;
• receiving, by the machine learning system from the exploit prevention software, monitored process stability data for each of the one or more protected processes, the monitored process stability data indicating stability monitored of each of the one or more protected processes monitored during execution before and after application of the exploit prevention configuration settings into the exploit prevention software, the monitored process stability data comprising for each of the one or more protected processes at least one of a number of processes crashes or a number of reported errors;
• determining, by the machine learning system based on the received monitored process stability data, whether the one or more protected processes have become more or less stable after application of the exploit prevention configuration settings into the exploit prevention software;
• based on whether the one or more protected processes have become more or less stable while executing on the computing device, adjusting:
• the process configuration settings provided by the machine learning system to the one or more protected processes;
• and
• the exploit prevention configuration settings provided by the machine learning system to the exploit prevention software;
• and
• applying the adjusted process configuration settings and the adjusted exploit prevention configuration settings to the computing device.

A computer program product comprising a non-transitory computer-readable medium storing instructions executable by one or more processors to perform:

• receiving, by a machine learning system for exploit prevention from exploit prevention software executing on a computing device, process information for one or more protected processes protected by the exploit prevention software and executing on the computing device;
• generating, by the machine learning system, exploit prevention configuration settings for the exploit prevention software and process configuration settings for the one or more protected processes, based on the process information for the one or more protected processes, wherein generating the exploit prevention configuration settings and the process configuration settings comprises applying a machine learning model to the process information for the one or more protected processes, the machine learning model trained to determine the exploit prevention configuration settings for the exploit prevention software and the process configuration settings for the one or more protected processes, the machine learning model representing training data comprising:
• training process information for each of one or more processes protectable by the exploit prevention software;
• and
• training configuration settings;
• providing, by the machine learning system to the exploit prevention software executing on the computing device, the exploit prevention configuration settings;
• receiving, by the machine learning system from the exploit prevention software, monitored process stability data for each of the one or more protected processes, the monitored process stability data indicating stability of each of the one or more protected processes monitored during execution before and after application of the exploit prevention configuration settings into the exploit prevention software, the monitored process stability data comprising for each of the one or more protected processes at least one of a number of processes crashes or a number of reported errors;
• determining, by the machine learning system based on the received monitored process stability data, whether the one or more protected processes have become more or less stable after application of the exploit prevention configuration settings into the exploit prevention software;
• based on whether the one or more protected processes have become more or less stable while executing on the computing device, adjusting:
• the process configuration settings provided by the machine learning system to the one or more protected processes;
• and
• the exploit prevention configuration settings provided by the machine learning system to the exploit prevention software;
• and
• applying the adjusted process configuration settings and the adjusted exploit prevention configuration settings to the computing device.