Multi-dimensional malware analysis

A computer-implemented method of detecting computer malware, comprising:

• bucketizing analysis results for a class of objects based on one or more features shared by the class of objects;
• computing respective probabilistic curves for buckets of the bucketized analysis results;
• computing respective feature analysis thresholds for the probabilistic curves;
• performing feature analysis on an object under analysis, including computing a malware score;
• comparing the malware score to a feature analysis threshold for a bucket associated with the object under analysis;
• and
• taking a malware action on the object under analysis based on the comparing.

A computer-implemented method of detecting computer malware, comprising:

• applying a fusion model for malware detection to an object under analysis, wherein the fusion model is to account for a plurality of data sources associated with the object under analysis, and includes a first data source having quantized score groups, wherein a quantized score group for the object under analysis is used to modify a score from a second data source;
• based on a result of the fusion model, detecting the object under analysis as malware;
• and
• taking a malware remediation action in response to the detecting.

One or more tangible, nontransitory computer-readable storage media having stored thereon executable instructions to instruct a processor circuit to:

• apply, or cause a device to apply, a fusion model for malware detection to an object under analysis, wherein the fusion model is to account for a plurality of data sources associated with the object under analysis, and includes a first data source having quantized score groups, wherein a quantized score group for the object under analysis is used to modify a score from a second data source;
• based on a result of the fusion model, detect, or cause a device to detect, the object under analysis as malware;
• and
• take, or cause a device to take, a malware remediation action in response to the detecting.