Patent Description:
Machine learning models for malware detection are often trained using known samples. For example, the known samples comprise datasets with labels. These samples are taken from different sources. As a result, the sample datasets describe the objects that contain the threat, but do not include metadata that could be useful. For example, where the dataset comprises malicious files, such metadata could reveal how the malicious file got into the affected computer system. Moreover, the malicious file might be only a derivative of some other pro- gram or file. Or the malicious file could be a part of a broad distributed attack system.

When training a machine learning model using the features obtained from a typical dataset, there are cases where the model cannot correctly classify an object by its attributes. Even though the object contains a threat, the object will not be classified correctly because there is not enough data in the dataset that characterizes such objects.

Another problem comes from attackers who automate the process of creating malware and combine various modules for encryption, obfuscation, and exploitation of vulnerabilities. Such malware may use different command centers for communication. Or the malware may exploit unusual ways of hiding in the system. Hence, malicious files, web pages, network packets and other system objects that carry the same malicious functionality can be missed by the protection system. This is be- cause these objects will have a different set of attributes than what a machine learning model would predict based on known malware.

Patent application <CIT> computer-implemented method for improving the classification accuracy of trustworthiness classifiers and system, enhancing detection quality using classifier training on selected training data. Selected subset of training data upon determining that subset of training data includes only data that captures and/or represents a certain characteristic that leads to improved classification accuracy in trustworthiness classifiers for the specific organization. For example, the security software vendor may analyze the accuracy of trustworthiness classifiers trained using certain vectors of training data. Examples of such vectors include, without limitation, training data related to organizations of a certain size, training data that originates from or was encountered by particular organizations, training data related to organizations of a certain industry, training data related to organizations headquartered in and/or operating primarily in a certain geographic region, variations of one or more of the same, combinations of one or more of the same, or any other suitable vectors of training data.

Document <CIT> does not teach to enhance detection in general for any types of the customer - to improve detection of known threats and unknown threats, based on given datasets of known objects collections and synthesized datasets.

Another point of view is described in Patent publication <CIT> where a method and system for static behavior-predictive malware detection. The method and system use a transfer learning model from behavior prediction to malware detection based on static features. In accordance with an embodiment of the invention, machine learning is used to capture the relations between static features, behavior features, and other context information. Synthesized behavior-related static features are generated by projecting the original static features to the behavior features.

Document <CIT> does not teach to synthesize static and dynamic features based on mixing and substitution. Also does not teach to synthesize features by classes of files or threats and by types of features. <CIT> generates synthetic static features only based on predictive behavior features, based on correlation of given behavior and static features of known samples.

Another example is describes in patent application <CIT>) where an apparatus for verifying a malicious code machine learning classification model, which includes: a main feature processing subsystem performing feature extracting and processing functions in an input file; and a multi-layer cyclic verification subsystem performing multi-layer verification in order to determine whether the file is normal or malicious based on the extracted and processed features to verify a machine learning model that classifies malicious codes, thereby ensuring reliability of a prediction result for a machine learning model.

Current methods for working with combined data for machine learning and deep learning models aim at improving the quality of object classification. But these methods may not be effective for detecting malicious objects, including unknown malicious objects. The combined data remains a random set of attributes even though it has been derived from the data available in the dataset. This approach will improve the quality of training a machine learning model to identify malware. But at the same time, it will introduce an increase in false positives. Randomly synthesized data may correspond to legitimate software and its resources. For example, all the attributes corresponding to the known samples of ransomware may be taken and the data synthesized by filling the sets of attributes with random data or data that, in principle, can occur in real systems. In this case, some of the records in the dataset will correspond to legitimate software. Examples of such software include an agent file system encryption, DLP agents, and file synchronization agents.

Known technologies do not effectively predict the emergence of new threats. They focus instead on improving the accuracy of the machine learning model for a specific class of objects. Searching for universal rules for detecting new instances of malicious files and programs risks increasing false positives. New systems and methods are needed to prevent increasingly sophisticated malware attacks while at the same time avoiding these false positives.

To overcome the problems found in the state of the art, where the main advantage of the present invention in comparison with prior art is that potential malware files, programs, and modules are predicted in advance by machine learning classification. Classification is achieved by analyzing the parameters an behavior of known malicious programs. The present invention predicts the appearance of new, previously unknown threats and increases the level of detection while reducing the level of false positives. This result is achieved by synthesizing new records in the machine learning dataset. These new, synthetic records improve the quality of model training and improve the model's ability to determine the class of malware and detect previously unknown threats more accurately.

Implementation of a method embodying the invention comprises collecting known malware samples. The dynamic (behavioral) characteristics and static characteristics are described separately for each file. Both types of parameters are combined into a single table. Machine learning algorithms are then used to create synthetic models for the potential malware. These tables and models comprise a kind of virtual sample, which are used to train a model that will more accurately classify real malicious objects found in the wilds.

A feature of the invention is data synthesis. Synthesized datasets improve a machine learning model's accuracy in the detection of new threats. Synthesis in this context means combining the attributes of known threats with logic that creates new feature vectors that will better correspond to unknown samples. At the same time, the synthesized datasets are more likely to correspond to the threat model for certain classes of threats and while reducing noise that increases false positives.

Several embodiments of the invention can be used to implement this approach. First, the attributes of known threats can be synthesized while filtering out vectors derived from datasets of known safe objects. A second method builds a sample of vectors corresponding to a certain class of malicious objects and mixes attributes in this sample in various ways. For example, the class and the selection are formed according to the key attributes of static analysis and all the attributes of this se- lection are mixed, including dynamic attributes. Or the class and the selection are formed according to behavioral logs, which record types of behavior. All the attributes of this selection are mixed, including attributes. A third method combines synthesizing attributes and filtering out known safe vectors for a specific class and sample.

The invention comprises a system and method for training and using machine learning malware classification models. Synthetic datasets are created and used for training a machine learning malware classifier. These synthetic datasets improve the ability of machine learning models to accurately detect and classify malware. These synthetic datasets act as virtual samples that allow ma- chine learning classifiers to be trained to detect previously unknown malware. The invention improves machine learning malware classifiers by increasing classification accuracy and reducing false positives. Increased accuracy by a malware classifier improves the efficiency of a computer system by protecting them from new malware threats while reducing false positives ensures the use- fulness of the computer system for its intended tasks. The improved malware classifier can also be used for penetration testing. Synthetic malware datasets can be used to create hypothetical "new" malware objects for testing purposes. These new objects can be used to test the detection capabilities of existing computer security systems to rate.

In the context of machine learning, a feature is an input variable used in making predictions or classifications in machine learning. Feature engineering is the process of determining which features might be useful in training a machine learning model, and then converting raw data from log files and other sources into those features. Feature extraction aims to reduce the number of features in a dataset by creating new features from the existing ones (and then discarding the original features).

Malicious processes in computer systems can be detected using dynamic analysis and static analysis. Dynamic analysis, also called "behavior analysis," focuses on how an untrusted file or process acts. Static analysis, on the other hand, is concerned with what can be known about an untrusted file or process before runtime.

<FIG> shows how the machine learning classification model is trained by extracting static and dynamic features from a malware collection and a clean objects collection. The system <NUM> comprises malware collection <NUM> and clean objects collection <NUM>. These collections <NUM>, <NUM> communicate with static analysis feature ex- tractor <NUM> and dynamic analysis feature extractor <NUM>. In turn, static analysis feature extractor <NUM> and dynamic analysis feature extractor <NUM> pass extracted dataset features to malware feature dataset <NUM> and clean ob- jects feature dataset <NUM>. These datasets <NUM>, <NUM> interact with malware classification machine learning module <NUM>.

Module <NUM> comprises a file with functions for training malware classification machine learning model <NUM>. For example, in a Python environment, module <NUM> contains variables of different types, such as arrays, dictionaries, objects, and is saved in a file with the. py extention.

Machine learning model <NUM> is a file that has been trained to recognize certain types of patterns in a given dataset. Pattern recognition is achieved by way of functions and algorithms provided by module <NUM>.

The system of <FIG> resembles <FIG> but shows additional details related to feature synthesis, including a feature synthesizing unit and a synthesized feature dataset. System <NUM> comprises malware collection <NUM> and clean objects collection <NUM>. These collections communicate with static analysis and dynamic analysis feature extractors <NUM>, <NUM>.

Feature synthesis is accomplished through the interaction of malware feature dataset <NUM>, synthesized feature dataset <NUM>, feature synthesizing unit <NUM>, and clean objects feature dataset <NUM>. The extractors <NUM>, <NUM> pass extracted dataset features to both malware feature dataset <NUM> and clean objects feature dataset <NUM>. Feature synthesizing unit <NUM> is passed feature data from malware feature dataset <NUM> and clean objects feature dataset <NUM>. Feature synthesizing unit <NUM> mixes features from datasets <NUM> and <NUM> and passes the resulting mixed features to synthesized feature dataset <NUM>.

Malware classification machine learning module <NUM> comprises a file with functions for training mal- ware classification machine learning model <NUM>. For ex- ample, in a Python environment, module <NUM> contains variables of different types, such as arrays, dictionaries, objects, and is saved in a file with the. py extension.

Machine learning model <NUM> is a file that has been trained to recognize certain types of patterns in a given dataset. Pattern recognition is achieved by way of functions and algorithms provided by module <NUM>. In this configuration, module <NUM> is passed a synthesized feature dataset <NUM> and a clean objects feature dataset. Thus, model <NUM> is trained from "virtual" malware data rather than from known malware samples.

<FIG> shows system <NUM> for static and dynamic analysis of an object collection <NUM> comprising object samples <NUM>. Threat analysis server <NUM> is con- figured for dynamic analysis of sample <NUM> by way of running the sample as application <NUM>. Activity monitor <NUM> records information about the activity of application <NUM> during runtime. Monitor <NUM> passes features identified during runtime to dynamic feature extractor <NUM>. Object sample <NUM> is also passed to static feature extractor <NUM> for static feature extraction. The static and dynamic feature extractors <NUM>, <NUM> pass extracted features to feature extractors <NUM>, <NUM> pass extracted features to malware feature dataset <NUM>, synthesized feature data- set318, and clean objects feature dataset <NUM>. Extracted static and dynamic features are passed to malware feature dataset <NUM> or clean objects feature dataset <NUM> depending on the nature of object collection <NUM> from which sample <NUM> was obtained.

Activity monitor <NUM> also passes features identified during runtime to sample execution log <NUM>. Log data from execution log <NUM> is then passed to feature synthesizing unit <NUM>. Feature synthesizing unit <NUM> interacts with the malware, synthesized, and clean objects feature datasets <NUM>, <NUM>, and <NUM>. The mixing of features among various feature datasets, such as malware, synthesized, and clean objects feature datasets <NUM>, <NUM>, and <NUM>, is shown in detail in <FIG> and <FIG>.

The output of the mixed datasets <NUM>, <NUM>, and <NUM> is passed to malware classification machine learning training unit <NUM>, which trains malware classification ma- chine learning model <NUM>. In an embodiment, malware classification machine learning model <NUM> passes threat detection updates <NUM> to protected computer systems <NUM>.

<FIG> shows example <NUM> of building syn- thetic feature vectors corresponding to a certain class of malicious objects where the attributes of the sample are mixed. A feature vector is the list of feature values representing a row of a dataset. Known labeled malware objects <NUM> include object samples <NUM>, <NUM>, <NUM>, K (<NUM>). These object samples include feature sets <NUM>, <NUM>, <NUM>, K (<NUM>) and the feature sets are used to create synthesized malware objects <NUM> comprising feature sets x, x+<NUM>, x+<NUM>, and x+<NUM> (<NUM>). Static features <NUM> are represented by the prefix A and Dynamic features <NUM> are represented by the prefix B. For example, feature set <NUM> (<NUM>) comprises a given number of static features All, A12,. A1n and a given number of dynamic features B11, B12, B1m. Feature set <NUM> (<NUM>) likewise comprises static features A21, A22, A2n and dynamic features B21, B22,. Feature sets <NUM> through K (<NUM>) follow this pattern, where the last static feature is represented by n and the last dynamic feature is represented by m.

Synthesized feature sets x, x+<NUM>, x+<NUM>, and x+<NUM> (<NUM>) comprises mixed static and dynamic features taken from the static features <NUM> and dynamic features <NUM> from feature sets <NUM> and K. For example, feature set x (<NUM>) comprises static features AK1, A32,. A3n and dynamic features B31, B32,.

Static features <NUM> and dynamic features <NUM> are divided into one group of features <NUM> and one type of feature <NUM>. A group of features comprises, for example, stack traces, API calls sequences, operations with files, or operations with a register or network. Or group features may include file modifications or reading files. Feature sets <NUM> and K (<NUM>) and features sets x through x+<NUM> (<NUM>) comprise an object class <NUM> of features from known labeled malware objects and synthesized mal- ware objects. The static features and dynamic features found in the known labeled malware objects <NUM> in feature sets <NUM> and K (<NUM>) comprise object class <NUM>. Class- defining features <NUM> are the features in object class <NUM> that are mixed and used to populate the static and dynamic features for synthetic feature sets x, x+<NUM>, x+<NUM>, and x+<NUM>.

<FIG> shows example <NUM> of using known labeled malware objects and known labeled clean objects to create synthesized malware objects. Known mal- ware objects <NUM> include object samples <NUM>-K (<NUM>) with corresponding feature sets <NUM>-K (<NUM>). Synthesized malware objects <NUM> with corresponding feature sets x, x+<NUM>, x+<NUM>, and x+<NUM> (<NUM>). Feature sets <NUM> and <NUM> comprise static features <NUM> and dynamic features <NUM>. The static and dynamic features <NUM>, <NUM> in feature sets <NUM>-K (<NUM>) and feature sets <NUM> are grouped into a first feature group <NUM> and a second feature group <NUM>. These groups <NUM>, <NUM> are used as parameters for feature substitution. For example, features within first group <NUM> and second group <NUM> are substituted for other static and dynamic features in the same group. In the example shown in <FIG>, the substituted static features are All with AK2 and AK1 with A12. The substituted dynamic features are B11 with BK2 and BK1 with B12. These substitutions take place between features sets <NUM> and K (<NUM>).

A filtered feature set <NUM> corresponding to fea- ture set x+<NUM> (<NUM>) is defined in relation to known labeled clean objects <NUM>. These known labeled clean objects <NUM> have corresponding feature sets <NUM>, <NUM>, <NUM>,. Features sets <NUM>-L comprise static features <NUM> and dy- namic features <NUM>. Static features <NUM> are labeled C11, C12,. C1n and D11, D12,. D1m for feature set <NUM>. For feature set <NUM>, the static features are C21, C22, C2n and the dynamic features are D21, D22,. Feature set <NUM> has static features All, AK2,. AKn and dynamic features BK1, B12,. This feature set-All, AK2, AKn and BK1, B12,. B3m-also appears in synthesized malware objects feature set x+<NUM> where it is identified as filtered feature set <NUM>.

<FIG> shows a method <NUM> for training a mal- ware classification machine learning model and classifying malware by synthesizing feature sets from malware and clean collections. At step <NUM> static and dynamic features are extracted from known malware samples from a malware collection. Then at step <NUM> static and dynamic features are extracted from known clean object samples from a clean objects collection. At step <NUM>, a malware feature dataset and a clean objects feature dataset are prepared for machine learning analysis. A mal- ware classification machine learning model is trained at step <NUM> based on static and dynamic features from the malware feature dataset and the clean objects feature dataset. An unknown system object for malware analysis is obtained at step <NUM>. The object is then classified with the malware classification machine learning model at step <NUM>. The result of the classification includes one or more of the following: determining a rate of conformity to at least one class of objects, determining if the file is malicious or clean, and determining malware type if malicious.

<FIG> shows a method <NUM> of training a mal- ware classification machine learning model and classifying malware by creating a synthesized dataset from static and dynamic features. A malware feature dataset and a clean objects feature data set are loaded for ma- chine-learning data analysis at step <NUM>. The loaded datasets include static and dynamic feature sets. At step <NUM>, the features in these datasets are grouped by feature type. Then new feature sets are synthesized in a malware feature dataset at step <NUM>. Each new feature set is a combination of the loaded feature set related to a first known malware sample and a result of substitution of at least one feature related to the first known malware sample with at least one feature related to a second malware sample. The substitution is preferably performed for features from the same group. The training of a mal- ware machine learning model takes place at step <NUM>. Static and dynamic features from the malware feature dataset extended with new, synthesized feature sets and the clean objects dataset. At step <NUM> an unknown system object is obtained for malware analysis. The object is classified with the trained malware classification ma- chine learning model at step <NUM>. The result of classification includes at least one of the following: determining a rate of conformity to at least one class of objects, determining if the file is malicious or clean, and determining the type of malware if the file is malicious.

<FIG> shows a method <NUM> of training a mal- ware classification machine learning model and classifying malware by creating a synthesized dataset from selected features related to malware samples of one class of objects. A malware feature dataset and a clean objects feature data set are loaded for machine-learning data analysis at step <NUM>. The loaded datasets include static and dynamic feature sets. At step <NUM>, the features in these datasets are grouped by feature type. Feature sets are selected related to malware samples of one class of objects at step <NUM>. The class of objects is defined using at least one of static analysis, dynamic analysis, sample execution log analysis, and malware classification based on static and dynamic analysis. Then new feature sets are synthesized in a malware feature dataset at step <NUM>.

Claim 1:
A method for malware detection in a computer system comprising the following steps:
a. extracting (<NUM>) static and dynamic features of at least two known malware samples;
b. extracting (<NUM>) static and dynamic features of a known clean object sample;
c. preparing (<NUM>) a synthetic malware feature dataset and a clean objects feature dataset, wherein the synthetic malware feature dataset comprises extracted feature sets of known malware samples and synthetic malware feature sets, generated by substitution of static and dynamic features corresponding to different known malware samples;
d. training (<NUM>) a malware classification machine learning model based on the synthetic malware feature dataset and the clean objects feature dataset;
e. obtaining (<NUM>) an unknown system object for malware analysis; and
f. classifying (<NUM>) the unknown system object, wherein the result of classification includes one or more of the following: a rate of conformity with at least one class of objects, a determination if the file is malicious or not, and a determination of malware type.