Anti-malware behavioral graph engines, systems and methods

1 . A system for classifying an event for an anti-malware behavioral graph engine comprising:

a memory;

a processor in operable communication with the memory, the processor operable to provide instructions and data and perform operations comprising:

receiving, from a threat intelligence feed, digital data associated with an event that is detected in a cybersecurity-protected computing environment;

classifying, by a classification engine, the event based on determining whether the digital data associated with the event comprises an attack word;

based on a determination that the digital data associated with the event comprises the attack word, adding, by a machine learning model, the event to an attack graph associated with an actor, wherein:

the attack word associated with the event is represented, in the attack graph, as an embedding of an attack word embedding vector having a predefined length, and

the predefined length of the attack word embedding vector is derived from a multi level perceptron (MLP) neural network, wherein (i) each attack sentence from an attack sentence corpus is split into attack sentences of length N during training of the MLP neural network and (ii) the MLP neural network is configured to select a vector of the length N causally ordered attack words and predict an embedding of a most likely N+1th attack word;

determining whether the attack graph comprises a valid attack sentence;

based on a determination that the attack graph comprises the valid attack sentence, predicting, by the classification engine and based on applying the machine learning model, next possible attack words associated with the event; and

based on the predicting, returning remediation instructions for automated execution in the cybersecurity-protected computing environment,

wherein the remediation instructions, when executed, cause (i) automatic deletion of malicious files associated with the actor in the cybersecurity-protected computing environment and (ii) quarantining of one or more components of the cybersecurity-protected computing environment that are infected by the actor.

2 . The system of claim 1 further comprising:

checking the event against a second classification engine.

3 . The system of claim 2 wherein the second classification engine comprises one or more bespoke attack words.

4 . The system of claim 1 further comprising:

applying a malware model to the digital data associated with the event; and

recognizing non-trivial events in the event.

5 . The system of claim 1 further comprising:

performing a feed check against the threat intelligence feed; and

receiving the digital data associated with the event in response to performing the feed check.

6 . The system of claim 5 , wherein the feed check is performed real-time.

7 . The system of claim 1 further comprising:

performing a flagged check against one or more user flagged attack vectors.

8 . The system of claim 1 further comprising:

temporally ordering a sequence of events that are detected based on receiving the digital data associated with the event.

9 . A computer-readable storage medium configured with data and programmed instructions which, upon execution by a processor, perform a method to detect malware in a computer network, the method comprising:

receiving, from a threat intelligence feed, digital data associated with an event that is detected in the computer network;

classifying the event based on determining whether the digital data associated with event comprises an attack word;

based on a determination that the digital data associated with the event comprises the attack word, adding, by a machine learning model, the event to an attack graph associated with an actor, wherein:

the attack word associated with the event is represented, in the attack graph, as an embedding of an attack word embedding vector having a predefined length, and

the predefined length of the attack word embedding vector is derived from a multi level perceptron (MLP) neural network, wherein (i) each attack sentence from an attack sentence corpus is split into attack sentences of length N during training of the MLP neural network and (ii) the MLP neural network is configured to select a vector of the length N causally ordered attack words and predict an embedding of a most likely N+1th attack word;

determining whether the attack graph comprises a valid attack sentence;

based on a determination that the attack graph comprises the valid attack sentence, predicting, based on applying the machine learning model, next possible words associated with the event; and

based on the predicting, returning remediation instructions for automated execution in the computer network,

wherein the remediation instructions, when executed, cause (i) automatic deletion of malicious files associated with the actor in the computer network and (ii) quarantining of one or more components of the computer network that are infected by the actor.

10 . The computer-readable storage medium of claim 9 further comprising:

checking the event against a second classification engine.

11 . The computer-readable storage medium of claim 10 wherein the second classification engine comprises one or more bespoke attack words.

12 . The computer-readable storage medium of claim 9 further comprising:

applying a malware model to the digital data associated with the event; and

recognizing non-trivial events in the event.

13 . The computer-readable storage medium of claim 9 further comprising:

performing a feed check against the threat intelligence feed; and

receiving the digital data associated with the event in response to performing the feed check.

14 . The computer-readable storage medium of claim 13 wherein the feed check is performed real-time.

15 . The computer-readable storage medium of claim 9 further comprising:

performing a flagged check against one or more user flagged attack vectors.

16 . The computer-readable storage medium of claim 9 further comprising:

temporally ordering a sequence of events that are detected based on receiving the digital data associated with the event.