Neural network detection of malicious activity
A method of identifying malicious activity in a sequence of computer instructions includes providing the sequence of computer instructions into a recurrent neural network configured to provide an output based on both the current instruction being input and at least one prior instruction in the sequence, and evaluating the provided sequence of computer instructions in the recurrent neural network at multiple points within the sequence. An output is provided indicating whether the network has determined the code sequence to that point is likely malicious.
1 . A method of identifying malicious activity in a sequence of computer instructions, comprising:
providing a sequence of computer instructions into a neural network configured to provide an output based on both a current instruction in the sequence of computer instructions being evaluated and a prior state of the neural network, wherein the prior state of the neural network is based on at least one prior instruction in the sequence of computer instructions;
evaluating the sequence of computer instructions in the neural network at each sequential program instruction within the sequence;
wherein the neural network is trained using training sequences of computer instructions having expected outputs defined for multiple instruction positions within each training sequence, such that the neural network is trained to produce output values corresponding to individual instructions within a sequence rather than only a terminal output for the sequence as a whole; and
at each sequential program instruction within the sequence, determining within the neural network whether the sequence of computer instructions to that point is malicious based on an output produced for the current instruction and representing a maximum predictive value among outputs produced for multiple instructions within the sequence to that point, and, upon determining that the sequence of computer instructions to that point is malicious, halting further evaluation of any remaining instructions based on the instruction-level output determination within the neural network itself, such that the termination is performed by the neural network's evaluation logic and providing an output indicating that the sequence of computer instructions to that point is malicious.
2 . The method of identifying malicious activity in a sequence of computer instructions of claim 1 , wherein the output is a variable indicating a determined likelihood of the sequence of computer instructions to that point being malicious.
3 . The method of identifying malicious activity in a sequence of computer instructions of claim 1 , wherein the point in the sequence of computer instructions where the output indicates the sequence of computer instructions is malicious indicates a portion of the sequence of computer instructions at the point is malicious.
4 . The method of identifying malicious activity in a sequence of computer instructions of claim 1 , further comprising at least one of:
blocking installation of the sequence of computer instructions once the output indicates the code sequence is malicious, or
blocking execution of the sequence of computer instructions once the output indicates the sequence of computer instructions is malicious.
5 . The method of identifying malicious activity in a sequence of computer instructions of claim 1 , wherein the neural network comprises one of a long short-term memory (LSTM) neural network and a gated recurrent unit (GRU) neural network.
6 . The method of identifying malicious activity in a sequence of computer instructions of claim 1 , wherein the neural network evaluates the provided sequence of computer instructions for malicious activity on an end-user device.
7 . The method of identifying malicious activity in a sequence of computer instructions of claim 6 , wherein the neural network is trained to evaluate the provided sequence of computer instructions for malicious activity on a service provider device different from the end-user device.
8 . The method of identifying malicious activity in a sequence of computer instructions of claim 1 , wherein the neural network is trained to evaluate the provided sequence of computer instructions for malicious activity by using a loss function indicating an output error coupled to the neural network output at a point in the sequence of computer instructions producing the maximum output in the sequence.
9 . The method of identifying malicious activity in a sequence of computer instructions of claim 1 , wherein the neural network is trained to evaluate the provided sequence of computer instructions for malicious activity by establishing an output threshold for which a false positive rate is acceptable.
10 . A method of creating a neural network operable to identify malicious activity in a sequence of computer instructions, comprising:
providing a training sequence of computer instructions and an expected output based on both a current instruction in the sequence of computer instructions being evaluated and a prior state of the neural network, wherein the prior state of the neural network is based on at least one prior instruction in the training sequence of computer instructions, the expected output indicating whether the training sequence of computer instructions to that point in the sequence are malicious, wherein the expected output comprises expected outputs defined for multiple instruction positions within the training sequence;
evaluating the sequence of computer instructions in the neural network at each sequential program instruction within the sequence;
at each sequential program instruction within the sequence, determining within the neural network whether the sequence of computer instructions to that point is malicious and, upon determining that the sequence of computer instructions to that point is malicious, halting further evaluation of any remaining instructions in the sequence of computer instructions within the neural network itself during the training sequence, such that the error signal is generated based on the instruction producing the maximum predictive value such that the termination is performed by the neural network's evaluation logic and providing an error signal to the neural network based on a difference between the expected output and an actual output of the neural network to that point in the sequence; and
modifying the neural network to reduce the difference between the expected output and the actual output, thereby training the neural network to identify whether the training sequence of computer instructions is malicious, wherein modifying the neural network comprises training the neural network based on an instruction within the training sequence that produces a maximum predictive value relative to other instructions within the training sequence.
11 . The method of creating a neural network operable to identify malicious activity in a sequence of computer instructions of claim 10 , wherein modifying the neural network to reduce the difference between the expected output and the actual output comprises backpropagation of the difference between the expected output and the actual output.
12 . The method of creating a neural network operable to identify malicious activity in a sequence of computer instructions of claim 10 , wherein modifying the neural network to reduce the difference between the expected output and the actual output comprises training the output at the point in the sequence of computer instructions that results in an output having the maximum predictive level for the sequence.
13 . The method of creating a neural network operable to identify malicious activity in a sequence of computer instructions of claim 10 , wherein the neural network comprises one of a long short-term memory (LSTM) neural network and a gated recurrent unit (GRU) neural network.
14 . The method of creating a neural network operable to identify malicious activity in a sequence of computer instructions of claim 10 , further comprising configuring the neural network to evaluate the training sequence of computer instructions for malicious activity on an end-user device different from the computerized device on which the neural network is trained.
15 . The method of creating a neural network operable to identify malicious activity in a sequence of computer instructions of claim 10 , wherein the neural network is trained to evaluate the training sequence of computer instructions for malicious activity by establishing an output threshold for which a false positive rate is acceptable.
16 . A computerized device configured to identify malicious activity in a sequence of computer instructions, comprising:
a computerized device having stored thereon a sequence of computer application instructions executed on the computerized device;
a neural network malware evaluation module executing on the computerized device, and operable to evaluate the sequence of computer application instructions and to provide an output based on both a current instruction in the sequence of computer instructions being evaluated and a prior state of the neural network, wherein the prior state of the neural network is based on at least one prior instruction in the sequence of computer application instructions, wherein the neural network malware evaluation module is trained using training sequences of computer instructions having expected outputs defined for multiple instruction positions within each training sequence, such that the neural network malware evaluation module is trained to produce output values corresponding to individual instructions within a sequence rather than only a terminal output for the sequence as a whole;
wherein the provided sequence of computer instructions is evaluated in the neural network malware evaluation module at each sequential program instruction within the sequence of computer application instructions, and
at each sequential program instruction within the sequence, determining within the neural network whether the sequence of computer instructions to that point is malicious based on an output produced for a current instruction and representing a maximum predictive value within the sequence of computer application instructions to that point, and, upon determining that the sequence of computer instructions to that point is malicious, halting further evaluation of any remaining instructions in the sequence of computer instructions within the neural network itself, such that the termination is performed by the neural network's evaluation logic and outputting from the neural network malware evaluation module an indication that the sequence of computer application instructions to that point is malicious.
17 . The computerized device configured to identify malicious activity in a sequence of computer instructions of claim 16 , wherein the output is a variable indicating a determined likelihood of the sequence of computer application instructions to that point being malicious.
18 . The computerized device configured to identify malicious activity in a sequence of computer instructions of claim 16 , wherein the point in the sequence of computer application instructions where the output indicates the code sequence is malicious indicates the portion of the sequence that is malicious.
19 . The computerized device configured to identify malicious activity in a sequence of computer instructions of claim 16 , further comprising at least one of:
blocking installation of the sequence of computer application instructions once the output indicates the sequence of computer application instructions is malicious, or
blocking execution of the sequence of computer application instructions once the output indicates the sequence of computer application instructions is malicious.
20 . The computerized device configured to identify malicious activity in a sequence of computer instructions of claim 16 , wherein the neural network is trained to evaluate the sequence of computer application instructions for malicious activity by using a loss function indicating an output error coupled to the neural network output at a point in the sequence of computer instructions producing the maximum output in the sequence.