Generic feature extraction for identifying malicious packages

A computer system for classifying packages based on generic feature extraction, comprising:

• a processor;
• and
• a computer storage media that stores computer-executable instructions that are executable by the processor to cause the computer system to at least:
• identify a set of training packages, the set of training packages including a first subset of training packages that are known to be malicious, and a second subset of training packages that are known to be benign;
• extract a set of training feature vectors from the set of training packages, including inputting each training package in the set of training packages to a feature extraction model which generates at least one corresponding training feature vector for each training package in the set of training packages, the set of training feature vectors including a first subset of training feature vectors extracted from the first subset of training packages that are known to be malicious and a second subset of training feature vectors extracted from the second subset of training packages that are known to be benign;
• train a classification model using the set of training feature vectors;
• and
• after training the classification model using the set of training feature vectors, classify a subject package as malicious or benign based on:
• extracting a feature vector for the subject package by inputting the subject package to the feature extraction model;
• and
• inputting the feature vector to the classification model.

A computer program product comprising a computer storage media that stores computer-executable instructions that are executable by a processor to cause a computer system to classify packages based on generic feature extraction, the computer-executable instructions including instructions that are executable by the processor to cause the computer system to at least:

• identify a set of training packages, the set of training packages including a first subset of training packages that are known to be malicious, and a second subset of training packages that are known to be benign;
• extract a set of training feature vectors from the set of training packages, including inputting each training package in the set of training packages to a feature extraction model which generates at least one corresponding training feature vector for each training package in the set of training packages, the set of training feature vectors including a first subset of training feature vectors extracted from the first subset of training packages that are known to be malicious and a second subset of training feature vectors extracted from the second subset of training packages that are known to be benign;
• train a classification model using the set of training feature vectors;
• and
• after training the classification model using the set of training feature vectors, classify a subject package as malicious or benign based on:
• extracting a feature vector for the subject package by inputting the subject package to the feature extraction model;
• and
• inputting the feature vector to the classification model.