Behavioral detection of malware that performs file operations at a server computer

An arrangement for protecting against malware that performs file operations at a server computer in a system having a client computer and the server computer, the client computer causing file operations to be performed at the server computer, wherein the server computer gathers information for each file operation performed at the server computer into an event, the gathered information including, at least an identifier of a file on which the file operation was performed and a type of the file operation performed on the file at the server computer, comprising:

• a processing circuitry;
• and
• a memory, the memory containing instructions that, when executed by the processing circuitry, configure the system to:
• develop an event-level feature vector for each event, each of the event-level feature vectors including at least two features, each of the features in each of the event-level feature vectors being numerical data representing an aspect of the gathered information for each event;
• group the event-level feature vectors by at least one identifier of a file and deriving a file-level feature vector for every unique file that is indicated within the event-level feature vectors, wherein the grouping is performed in a manner that is agnostic during a prescribed period to at least one of an order sequence of performance of the file operations and a spacing in time of performance of the file operations;
• supply the file-level feature vectors to a trained machine learning classifier and receiving as an output of the classifier at least one risk score, each risk score indicating a likelihood of a presence of malware activity;
• and
• when there is a likelihood of malware activity being present which is indicated by an aggregate risk score exceeding a threshold, the aggregate risk score being based on the at least one risk score output by the classifier, initiate incident handling.

A non-transitory computer readable medium having stored thereon instructions for causing a processing circuitry to perform a process for protecting against malware that performs file operations at a server computer in a system having a client computer and the server computer, the client computer causing file operations to be performed at the server computer, wherein the server computer gathers information for each file operation performed at the server computer into an event, the gathered information including, at least an identifier of a file on which the file operation was performed and a type of the file operation performed on the file at the server computer, the process comprising:

• developing, not by the client computer, an event-level feature vector for each event, each of the event-level feature vectors including at least two features, each of the features in each of the event-level feature vectors being numerical data representing an aspect of the gathered information for each event;
• grouping the event-level feature vectors by at least one identifier of a file and deriving a file-level feature vector for every unique file that is indicated within the event-level feature vectors, wherein the grouping is performed in a manner that is agnostic during a prescribed period to at least one of an order sequence of performance of the file operations and a spacing in time of performance of the file operations;
• supplying, not by the client computer, the file-level feature vectors to a trained machine learning classifier and receiving as an output of the classifier at least one risk score, each risk score indicating a likelihood of a presence of malware activity;
• and
• when there is a likelihood of malware activity being present which is indicated by an aggregate risk score exceeding a threshold, the aggregate risk score being based on the at least one risk score output by the classifier, initiating incident handling.