Systems and methods for generating a threat classifier to determine a malicious process

1. A computer-implemented method for generating a threat classifier to determine a malicious process, comprising:

distributing a parameter collection module from a server to a plurality of client processing systems, wherein the parameter collection module comprises a set of rules to detect a certain behavior in the plurality of client processing systems;

if one or more of the set of rules are satisfied, receiving at the server, from the plurality of client processing systems, input data indicative of a plurality of client processing parameters, wherein each client processing system responds automatically upon determining the one or more of the set of rules are satisfied;

scaling the input data to provide a plurality of parameter vectors indicative of each of the plurality of client processing parameters;

classifying each of the plurality of parameter vectors as a threat or a non-threat;

performing, at the server, a machine learning process on at least one of the plurality of classified parameter vectors;

generating the threat classifier from the machine learning process, wherein the threat classifier is configured to generate an output result, the output result comprising a single value generated for a single process;

determining if the output result satisfies a certain threshold, wherein if the output result satisfies the threshold, classifying a process as a threat, and wherein if the output result does not satisfy the threshold, requesting additional input from a user; and

transferring the threat classifier to at least one of the client processing systems, wherein the threat classifier is configured to automatically determine if a process to be performed in a client processing system is malicious.

2. The method of claim 1 , further comprising scaling the input data on float point range of −1.0 to 1.0.

3. The method of claim 1 , wherein the machine learning process comprises an Artificial Neural Network (ANN).

4. The method of claim 1 , wherein the plurality of client processing system parameters are indicative of a history of one or more computer program files on the plurality of client processing systems.

5. The method of claim 1 , further comprising receiving the input data from the client processing systems at different time periods.

6. The method of claim 1 , wherein the plurality of client processing system parameters are indicative of dynamic program features executed on the plurality of client processing systems.

7. The method of claim 3 , further comprising adjusting one or more weights between neurons of the ANN to generate the threat classifier.

8. The method of claim 1 , wherein the set of rules in the parameter collection module are hard-coded to detect the certain behaviour in the plurality of client processing systems.

9. The method of claim 1 , wherein the output result indicates a certainty of the classification assigned to a parameter vector associated with a client processing parameter.

10. A server processing system configured to generate a threat classifier to determine a malicious process, comprising:

a processor;

memory in electronic communication with the processor;

instructions stored in the memory, the instructions executable by the processor to:

distribute a parameter collection module from a server to a plurality of client processing systems, wherein the parameter collection module comprises a set of rules to detect a certain behavior in the plurality of client processing systems;

if one or more of the set of rules are satisfied, receive at the server, from the plurality of client processing systems, input data indicative of a plurality of client processing parameters, wherein each client processing system responds automatically upon determining the one or more of the set of rules are satisfied;

scale the input data to provide a plurality of parameter vectors indicative of each of the plurality of client processing parameters;

classify each of the plurality of parameter vectors as a threat or a non-threat;

perform, at the server, a machine learning process on at least one of the plurality of classified parameter vectors;

generate the threat classifier from the machine learning process, wherein the threat classifier is configured to generate an output result;

determine if the output result satisfies a certain threshold, wherein if the output result satisfies the threshold, classifying a process as a threat, and wherein if the output result does not satisfy the threshold, requesting additional input from a user; and

transfer the threat classifier to at least one of the client processing systems, wherein the threat classifier is configured to automatically determine if a process to be performed in a client processing system is malicious.

11. The system of claim 10 , wherein the machine learning process comprises an Artificial Neural Network (ANN).

12. The system of claim 10 , wherein the plurality of client processing system parameters are indicative of a history of one or more computer program files on the plurality of client processing systems.

13. The system of claim 10 , wherein the instructions are executable by the processor to:

receive the input data from the client processing systems at different time periods.

14. The system of claim 10 , wherein the plurality of client processing system parameters are indicative of dynamic program features executed on the plurality of client processing systems.

15. The system of claim 11 , wherein the instructions are executable by the processor to:

adjust one or more weights between neurons of the ANN to generate the threat classifier.

16. The system of claim 10 , wherein the set of rules in the parameter collection module are hard-coded to detect the certain behaviour in the plurality of client processing systems.

17. The system of claim 10 , wherein the output result indicates a certainty of the classification assigned to a parameter vector associated with a client processing parameter.

18. A computer-program product for generating a threat classifier to determine a malicious process, the computer-program product comprising a non-transitory computer-readable medium storing instructions thereon, the instructions executable by the processor to:

distribute a parameter collection module from a server to a plurality of client processing systems, wherein the parameter collection module comprises a set of rules to detect a certain behavior in the plurality of client processing systems;

if one or more of the set of rules are satisfied, receive at the server, from the plurality of client processing systems, input data indicative of a plurality of client processing parameters, wherein each client processing system responds automatically upon determining the one or more of the set of rules are satisfied;

scale the input data to provide a plurality of parameter vectors indicative of each of the plurality of client processing parameters;

classify each of the plurality of parameter vectors as a threat or a non-threat;

perform, at the server, a machine learning process on at least one of the plurality of classified parameter vectors;

generate a threat classifier from the machine learning process, wherein the threat classifier is configured to generate an output result;

determine if the output result satisfies a certain threshold, wherein if the output result satisfies the threshold, classifying a process as a threat, and wherein if the output result does not satisfy the threshold, requesting additional input from a user; and

transfer the threat classifier to at least one of the client processing systems, wherein the threat classifier is configured to automatically determine if a process to be performed in a client processing system is malicious.