Bayesian neural networks for ransomware incident detection

A computer-readable storage medium having computer-executable instructions stored thereupon which, when executed by a processing device, cause the processing device to:

• receive a data set comprising records of a first plurality of computer operations that have been labeled as being caused by ransomware or being caused by malware that is not ransomware;
• train a probabilistic machine learning model with posterior Spike and Slab distributions using the received data set, wherein an individual posterior Spike and Slab distribution is an aggregation of a Slab distribution function and a Spike distribution function, wherein the individual posterior Spike and Slab distribution has a first probability of being sampled from the slab distribution and a second probability of being sampled from the spike distribution, and wherein training the probabilistic machine learning model includes learning the first probability and the second probability by sampling values from a prior Spike and Slab distribution function and updating the first probability and the second probability based on how well the probabilistic machine learning model explains labeled records of the data set when evaluated using the sampled values;
• receive a second plurality of computer operations that were performed in part by a computing device over a defined period of time;
• identify features associated with ransomware attacks from the second plurality of computer operations;
• apply the trained probabilistic machine learning model to infer that at least some of the second plurality of computer operations were caused by ransomware;
• and
• apply a security countermeasure to the computing device to disable a potential ransomware attack associated with the second plurality of computer operations.

A computing device, comprising:

• a computer-readable storage medium having computer-executable instructions stored thereupon;
• and
• a processor that executes the computer-executable instructions, causing the computing device to:
• receive a data set comprising records of a first plurality of computer operations that have been labeled as being caused by ransomware or being caused by malware that is not ransomware;
• train a Bayesian neural network-based machine learning model with posterior radial Spike and Slab distributions using the received data set, wherein an individual posterior radial Spike and Slab distribution is an aggregation of a slab distribution function and a spike distribution function, wherein the probabilistic machine learning model generates weights by sampling from the posterior Spike and Slab distributions, wherein the individual posterior Spike and Slab distribution has a first probability of being sampled from the slab distribution and a second probability of being sampled from the spike distribution, and wherein training the machine learning model includes learning the first probability and the second probability by sampling values from a prior Spike and Slab distribution function and updating the first probability and the second probability based on how well the probabilistic machine learning model explains labeled records of the data set when evaluated using the sampled values;
• receive a second plurality of computer operations that occurred over a defined period of time;
• identify features associated with ransomware attacks from the second plurality of computer operations;
• apply the trained probabilistic machine learning model to infer a probability that at least some of the second plurality of computer operations were caused by ransomware;
• and
• apply a security countermeasure to disable a potential ransomware attack associated with the second plurality of computer operations.