Lightweight malware inference architecture

A system for creating a malware inference architecture, the system comprising:

• an endpoint in a network that:
• receives an instruction set;
• classifies the instruction set as potentially malicious or benign according to a first machine learning model based on a first parameter set;
• and
• a cloud system network comprising a set of devices and a communication interface in communication with the endpoint, wherein a subset of the set of devices:
• receives the instruction set if the instruction set is determined by the first machine learning model to be potentially malicious;
• and
• analyzes the instruction set using a second machine learning model to determine if the instruction set comprises malicious code, the second machine learning model configured to classify a type of security risk associated with the instruction set based on a second parameter set that is different from the first parameter set.

A non-transitory computer-readable medium comprising instructions stored thereon, the instructions executable by one or more processors of a computing system to perform a method for creating a malware inference architecture, the instructions causing the computing system to:

• receive an instruction set at an endpoint in a network;
• classify, at the endpoint, the instruction set as potentially malicious or benign according to a first machine learning model based on a first parameter set;
• send the instruction set to a cloud system if the instruction set is determined by the first machine learning model to be potentially malicious;
• and
• analyze, at the cloud system, the instruction set using a second machine learning model to determine if the instruction set comprises malicious code, the second machine learning model configured to classify a type of security risk associated with the instruction set based on a second parameter set that is different from the first parameter set.