Identify Malicious Software

A method for identifying malicious software on a user device, the method comprising:

• receiving, at data processing hardware, an application install pattern from a user device, the application install pattern indicating a sequence of n-applications installed on the user device;
• for each application in the sequence of n-applications:
• generating, by the data processing hardware, a numerical vector representation for the corresponding application using a feed-forward neural network model configured to receive each application and the order of each application in the sequence of n-applications as feature inputs;
• and
• clustering, by the data processing hardware, the corresponding application in a free vector space based on the numerical vector representation for the corresponding application;
• determining, by the data processing hardware, whether any of the applications in the sequence of n-applications are clustered with training applications identified as malware;
• and
• for each application clustered with training applications identified as malware, identifying, by the data processing hardware, the corresponding application in the sequence of n-applications as malware.

A system for identifying malware, the system comprising:

• data processing hardware;
• and
• memory hardware in communication with the data processing hardware, the memory hardware storing instructions that when executed by the data processing hardware cause the data processing hardware to perform operations comprising:
• receiving a software application;
• executing the software application;
• identifying a plurality of uniform resource identifiers the software application interacts with during execution of the software application;
• generating a vector representation for the software application using a feed-forward neural network configured to receive the plurality of uniform resource identifiers as feature inputs;
• determining similarity scores for a pool of training applications stored in the memory hardware, each similarity score associated with a corresponding training application and indicating a level of similarity between the vector representation for the software application and a respective vector representation for the corresponding training application;
• and
• flagging the software application as belonging to a potentially harmful application category when one or more of the training applications have similarity scores that satisfy a similarity threshold and comprise a potentially harmful application label.

A system for identifying malicious software, the system comprising:

• data processing hardware;
• memory hardware in communication with the data processing hardware, the memory hardware storing instructions that when executed by the data processing hardware cause the data processing hardware to perform operations comprising:
• receiving an application install pattern from a user device, the application install pattern indicating a sequence of n-applications installed on the user device;
• for each application in the sequence of n-applications:
• generating a numerical vector representation for the corresponding application using a feed-forward neural network model configured to receive each application and the order of each application in the sequence of n-applications as feature inputs;
• and
• clustering the corresponding application in a free vector space based on the numerical vector representation for the corresponding application;
• determining whether any of the applications in the sequence of n-applications are clustered with training applications identified as malware;
• and
• for each application clustered with training applications identified as malware, identifying the corresponding application in the sequence of n-applications as malware.