Detecting polymorphic botnets using an image recognition platform

A method comprising:

• at a computing device comprising at least one processor, a communication interface, and memory:
• training, based on a training set of historical image patterns stored in at least one pattern database, a pattern matching engine to generate image pattern statuses, wherein the training set comprises a plurality of historical malicious image patterns and a plurality of historical safe image patterns, wherein a given historical image pattern comprises historical interaction information for a cloud-based network;
• automatically generating real-time interaction information based on monitoring interactions between a first user device and a cloud platform;
• generating, using a consolidation unit, a first potentially malicious image pattern based on the real-time interaction information, wherein the consolidation unit is configured to consolidate interaction information corresponding to the first user device and interaction information corresponding to the cloud platform into an image pattern comprising a heat map of at least a portion of the real-time interaction information;
• inputting the first potentially malicious image pattern into the pattern matching engine to generate an image pattern status for the first potentially malicious image pattern, wherein generating the image pattern status comprises comparing a first central processing unit (CPU) usage corresponding to the first potentially malicious image pattern to a second CPU usage corresponding to at least one historical image pattern;
• identifying, based on the comparing, that the first potentially malicious image pattern is a malicious image pattern, and automatically in response:
• storing the first potentially malicious image pattern at a malicious pattern database;
• and
• initiating at least one security action responsive to malicious image patterns;
• and
• updating, using the first potentially malicious image pattern and the image pattern status for the first potentially malicious image pattern, the pattern matching engine, wherein updating the pattern matching engine causes the pattern matching engine to determine one or more additional image pattern statuses based on the image pattern status for the first potentially malicious image pattern.

One or more non-transitory computer-readable media storing instructions that, when executed by a computing platform comprising at least one processor, a communication interface, and memory, cause the computing platform to:

• train, based on a training set of historical image patterns stored in at least one pattern database, a pattern matching engine to generate image pattern statuses, wherein the training set comprises a plurality of historical malicious image patterns and a plurality of historical safe image patterns, wherein a given historical image pattern comprises historical interaction information for a cloud-based network;
• automatically generate real-time interaction information based on monitoring interactions between a first user device and a cloud platform;
• generate, using a consolidation unit, a first potentially malicious image pattern based on the real-time interaction information, wherein the consolidation unit is configured to consolidate interaction information corresponding to the first user device and interaction information corresponding to the cloud platform into an image pattern comprising a heat map of at least a portion of the real-time interaction information;
• input the first potentially malicious image pattern into the pattern matching engine to generate an image pattern status for the first potentially malicious image pattern, wherein generating the image pattern status comprises comparing a first central processing unit (CPU) usage corresponding to the first potentially malicious image pattern to a second CPU usage corresponding to at least one historical image pattern;
• identify, based on the comparing, that the first potentially malicious image pattern is a malicious image pattern, and automatically in response:
• store the first potentially malicious image pattern at a malicious pattern database;
• and
• initiate at least one security action responsive to malicious image patterns;
• and
• update, using the first potentially malicious image pattern and the image pattern status for the first potentially malicious image pattern, the pattern matching engine, wherein updating the pattern matching engine causes the pattern matching engine to determine one or more additional image pattern statuses based on the image pattern status for the first potentially malicious image pattern.