System and method of training a machine learning model for detection of malicious containers

A system for training a machine learning model for detecting malicious container files, the system comprising:

• a storage device configured to store a group of container files;
• a hardware processor configured to:
• select a plurality of objects from a malicious container file, wherein a container file is a file that contains at least two or more objects constituting logically separate data regions of the container file;
• determine at least one parameter for each object selected from the malicious container file, wherein the at least one parameter characterizes a functional relation of the respective object to at least one other object in the container file;
• generate a first convolution associated with the malicious container file based on the determined at least one parameter, wherein the first convolution comprises a multidimensional vector in which each element of the multidimensional vector corresponds to its own unique parameter among the determined parameters, while the value of the mentioned element corresponds to the number of objects for which the mentioned parameter has been determined;
• generate a second convolution associated with a safe container file based on determined parameters of objects that are chosen from the safe container file;
• and
• modify a machine learning model based on the first convolution associated with the malicious container file and the second convolution associated with the safe container file, wherein the machine learning model is configured to compute a degree of harmfulness of a container file under analysis.

A non-transitory computer readable medium comprising computer executable instructions for training a machine learning model for detecting malicious container files, including instructions for:

• selecting a plurality of objects from a malicious container file, wherein a container file is a file that contains at least two or more objects constituting logically separate data regions of the container file;
• determining at least one parameter for each object selected from the malicious container file, wherein the at least one parameter characterizes a functional relation of the respective object to at least one other object in the container file;
• generating a first convolution associated with the malicious container file based on the determined at least one parameter, wherein the first convolution comprises a multidimensional vector in which each element of the multidimensional vector corresponds to its own unique parameter among the determined parameters, while the value of the mentioned element corresponds to the number of objects for which the mentioned parameter has been determined;
• generating a second convolution associated with a safe container file based on determined parameters of objects that are chosen from the safe container file;
• and
• modifying a machine learning model based on the first convolution associated with the malicious container file and the second convolution associated with the safe container file, wherein the machine learning model is configured to compute a degree of harmfulness of a container file under analysis.