Systems and methods for detecting malware using machine learning
View Patent ↗A computer-implemented method for detecting malware using machine learning may include (1) identifying data to be analyzed for malware, (2) classifying, using a classifier created by a combination of at least one deep learning neural network and at least one supervised data mining method, the data to be analyzed for malware, (3) determining, based on a predefined threshold, that the classification of the data indicates potential malware on the computing device, and (4) performing a security action based on the determination of potential malware on the computing device. Various other methods, systems, and computer-readable media are also disclosed.
1. A computer-implemented method for detecting malware using machine learning, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising:
identifying, by the computing device, data to be analyzed for malware;
classifying the data to be analyzed for malware using a classifier created by applying a combination of at least one deep learning neural network, wherein a deep learning neural network comprises multiple layers of artificial neural networks, and at least one supervised data mining method to:
extract features from training data using one method of the deep learning neural network or the supervised data mining method; and
classify the features using the other method of the deep learning neural network or the supervised data mining method;
determining, by the computing device and based on a predefined threshold, that the classification of the data indicates potential malware on the computing device; and
performing, by the computing device, a security action based on the determination of potential malware on the computing device.
2. The method of claim 1 , wherein identifying the data to be analyzed for malware comprises at least one of:
identifying data on the computing device;
receiving data from a client device; and
downloading data from a network.
3. The method of claim 1 , wherein the multiple layers of artificial neural networks are configured to accomplish at least one of:
hierarchical feature extraction;
semi-supervised machine learning; and
unsupervised machine learning.
4. The method of claim 1 , wherein the supervised data mining method comprises at least one of:
a decision tree;
a vector machine;
a supervised neural network;
an ensemble method; and
regression analysis.
5. The method of claim 1 , wherein the combination of the deep learning neural network and the supervised data mining method comprises:
feature extraction with the supervised data mining method; and
classification of the features with the deep learning neural network.
6. The method of claim 5 , wherein the feature extraction with the supervised data mining method comprises:
converting the training data into leaf nodes; and
converting the leaf nodes into the features using a bag-of-words model.
7. The method of claim 1 , wherein the combination of the deep learning neural network and the supervised data mining method comprises:
feature extraction with the deep learning neural network; and
classification of the features with the supervised data mining method.
8. The method of claim 1 , wherein classifying the data to be analyzed for malware comprises predicting the classification of the data to be analyzed for malware with the classifier created using the training data.
9. The method of claim 1 , wherein the training data comprises at least one of:
an example of malware;
an example of safe software;
data about a computing system infected by malware; and
data about a computing system without malware.
10. The method of claim 1 , wherein the predefined threshold comprises a degree of likelihood that the classification of the data to be analyzed for malware accurately identifies malware.
11. The method of claim 1 , further comprising creating a new classifier, using the combination of the deep learning neural network and the supervised data mining method, with updated training data.
12. The method of claim 11 , wherein the updated training data comprises at least one of:
new training data gathered periodically; and
addition of the data to be analyzed for malware.
13. A system for detecting malware using machine learning, the system comprising:
an identification module, stored in memory, that identifies data to be analyzed for malware;
a classification module, stored in the memory, that classifies the data to be analyzed for malware using a classifier created by applying a combination of at least one deep learning neural network, wherein a deep learning neural network comprises multiple layers of artificial neural networks, and at least one supervised data mining method to:
extract features from training data using one method of the deep learning neural network or the supervised data mining method; and
classify the features using the other method of the deep learning neural network or the supervised data mining method;
a determination module, stored in the memory, that determines, based on a predefined threshold, that the classification of the data indicates potential malware on a computing device;
a security module, stored in the memory, that performs a security action based on the determination of potential malware on the computing device; and
at least one physical processor that executes the identification module, the classification module, the determination module, and the security module.
14. The system of claim 13 , wherein the identification module identifies the data to be analyzed for malware by at least one of:
identifying data on the computing device;
receiving data from a client device; and
downloading data from a network.
15. The system of claim 13 , wherein the multiple layers of artificial neural networks are configured to accomplish at least one of:
hierarchical feature extraction;
semi-supervised machine learning; and
unsupervised machine learning.
16. The system of claim 13 , wherein the supervised data mining method comprises at least one of:
a decision tree;
a vector machine;
a supervised neural network;
an ensemble method; and
regression analysis.
17. The system of claim 13 , wherein the combination of the deep learning neural network and the supervised data mining method comprises:
feature extraction with the supervised data mining method; and
classification of the features with the deep learning neural network.
18. The system of claim 17 , wherein the feature extraction with the supervised data mining method comprises:
converting the training data into leaf nodes; and
converting the leaf nodes into the features using a bag-of-words model.
19. The system of claim 13 , wherein the combination of the deep learning neural network and the supervised data mining method comprises:
feature extraction with the deep learning neural network; and
classification of the features with the supervised data mining method.
20. A non-transitory computer-readable medium comprising one or more computer-executable instructions that, when executed by at least one processor of a computing device, cause the computing device to:
identify data to be analyzed for malware;
classify the data to be analyzed for malware using a classifier created by applying a combination of at least one deep learning neural network, wherein a deep learning neural network comprises multiple layers of artificial neural networks, and at least one supervised data mining method to:
extract features from training data using one method of the deep learning neural network or the supervised data mining method; and
classify the features using the other method of the deep learning neural network or the supervised data mining method;
determine, based on a predefined threshold, that the classification of the data indicates potential malware on the computing device; and
perform a security action based on the determination of potential malware on the computing device.