System and method for machine based detection of a malicious executable file

A method for training a file classification model for classifying malicious software comprising:

• computing a plurality of training datasets, each for one of a plurality of training executable software files, each file having a class label, each of the plurality of training datasets is computed by:
• receiving a respective training executable file;
• detecting a plurality of binary functions in the respective training executable file;
• translating each of the respective plurality of binary functions into a symbolic language to produce a plurality of disassembled functions;
• clustering a plurality of operation codes identified in the plurality of disassembled functions into a plurality of operation code clusters according to respective operation code;
• computing a plurality of statistical values of the plurality of disassembled functions and the plurality of operation code clusters;
• and
• associating the plurality of statistical values with the training executable file's label to produce a training dataset;
• and
• training a file classification model using the plurality of training datasets to compute at least one classification score of an input file.

A system for classifying malicious software comprising at least one hardware processor adapted to:

• receiving an executable software file;
• detecting a plurality of binary functions in the executable software file;
• translating each of the respective plurality of binary functions into a symbolic language to produce a plurality of disassembled functions;
• computing a plurality of statistical values of the plurality of disassembled functions and a plurality of operation code clusters;
• computing at least one classification score by inputting the plurality of statistical values to a file classification model trained by:
• computing a plurality of training datasets, each for one of a plurality of training executable software files, each file having a label, each of the plurality of training datasets is computed by:
• receiving a respective training executable file;
• detecting a plurality of training binary functions in the respective training executable file;
• translating each of the respective plurality of training binary functions into a symbolic language to produce a plurality of training disassembled functions;
• clustering a plurality of training operation codes identified in the plurality of training disassembled functions into a plurality of training operation code clusters according to respective training operation code;
• computing a plurality of training statistical values of the plurality of training disassembled functions and the plurality of training operation code clusters;
• and
• associating the plurality of training statistical values with the training executable file's label to produce a training dataset;
• and
• training the file classification model using the plurality of training datasets to compute at least one classification score of an input file;
• and
• computing a file classification according to a comparison between the at least one classification score and a predetermined maliciousness score threshold value;
• wherein the plurality of operation code clusters are the plurality of training operation code clusters.