Framework for classifying an object as malicious with machine learning for deploying updated predictive models

An apparatus comprising:

• one or more hardware processors;
• and
• a memory coupled to the one or more processors, the memory comprises
• a detection engine that, when executed by the one or more processors, analyzes an object to produce a first result, the first result identifies whether the object is malicious or non-malicious;
• and
• a classification engine that, when executed by the one or more processors, analyzes one or more features of the object to produce a second result, the second result identifies whether the object is malicious or non-malicious in accordance with a predictive model,
• wherein, in response to the first result of the detection engine and the second result of the classification engine differing in a determination as to whether the object is malicious, uploading information associated with at least a portion of results from the analysis of the object by at least one of the detection engine and the classification engine and, based on the uploaded information identifying that the predictive model is ineffective or is becoming ineffective, receiving an update of the predictive model to reduce a number or a rate of at least false negative determinations by the classification engine, and
• wherein, in response to the first result of the detection engine and the second result of the classification engine being consistent in the determination as to whether the object is to be classified as malicious or non-malicious, refraining from uploading the information associated with at least the portion of results from the analysis of the object.

An apparatus comprising:

• one or more processors;
• and
• a non-transitory storage medium communicatively coupled to the one or more processors, the non-transitory storage medium includes an analysis engine that comprises
• a detection engine that analyzes an object to uncover one or more features of the object that are used to determine whether the object is malicious or non-malicious, and
• a classification engine that is configured to (i) receive the features of the object conducted by the detection engine, and (ii) determine, based at least in part on the information from the detection engine and in accordance with values assigned to different parameters of a predictive model to identify features of the object that tend to be associated with malware, a confidence score associated with the object, the confidence score identified a probability of the object is malicious,
• wherein, in response to the detection engine and the classification engine differing in a determination as to whether the object is to be classified as malicious, uploading information associated with at least a portion of the results from the analysis of the object by at least one of the detection engine and the classification engine for use in determining whether an update of values associated with one or more parameters of the predictive model so as to reduce a number or a rate of at least false negative determinations by the classification engine, and
• wherein, in response to the detection engine and the classification engine being consistent in the determination as to whether the object is to be classified as malicious or non-malicious, refraining by the analysis engine from uploading the information associated with at least the portion of the results.