Initialization vector identification for malware detection

A computer system comprising:

• a processor and memory storing computer program code for detecting a malware file in encrypted form comprising:
• receiving multiple versions of the malware file, each version encrypted using a different initialization vector;
• training an autoencoder based on each version of the malware file, wherein the autoencoder includes:
• a set of input units each for representing information from a byte of malware file,
• output units each for storing an output of the autoencoder, and
• a set of hidden units smaller in number than the set of input units and each interconnecting all input units and all output units with weighted interconnections, such that the autoencoder is trainable to provide an approximated reconstruction of values of the input units at the output units;
• selecting a set of one or more offsets in the malware file in encrypted form as candidate locations for storage of an initialization vector for encryption of the malware file, the selection being based on weights of interconnections in the autoencoder;
• and
• identifying the malware file based on an identification of an initialization vector in an encrypted form of the malware file at one of the candidate locations.