Systems and methods for evaluating infection risks based on profiled user behaviors

1. A computer-implemented method for evaluating infection risks based on profiled user behaviors, at least a portion of the method being performed by a computing device comprising at least one hardware processor, the method comprising:

collecting, by the computing device comprising the at least one hardware processor, a plurality of user-behavior profiles that comprises:

a plurality of labeled profiles that comprises:

a plurality of infected profiles, wherein each of the plurality of infected profiles comprises a profile of user behaviors that occurred at an associated infected computing system that is known to have encountered malware; and

a plurality of clean profiles, wherein each of the plurality of clean profiles comprises a profile of user behaviors that occurred at an associated clean computing system that is known to be free of malware; and

a plurality of unlabeled profiles, wherein each of the plurality of unlabeled profiles comprises a profile of user behaviors that occurred at an associated computing system that is not known to have encountered malware and not known to be free of malware;

assigning, before training a classification model to distinguish infected profiles from clean profiles, a pseudo label to each of the plurality of unlabeled profiles by:

labeling a first group of the plurality of unlabeled profiles as infected profiles based at least in part on one or more of:

a similarity between unlabeled profiles in the first group and at least one labeled profile in the plurality of infected profiles; or

a mapping of the unlabeled profiles in the first group to a first region of a feature space defined by a lowest-density region of the feature space; and

labeling a second group of the plurality of unlabeled profiles as clean profiles based at least in part on one or more of:

a similarity between unlabeled profiles in the second group and at least one labeled profile in the plurality of clean profiles; or

a mapping of the unlabeled profiles in the second group to a second region of the feature space defined by the lowest-density region of the feature space; and

training the classification model to distinguish infected profiles from clean profiles using features and labels of the plurality of user-behavior profiles;

using the classification model to predict at least one of:

a likelihood that a computing system of a user will become infected based at least in part on a profile of user behaviors of the user; or

a likelihood that a user behavior in the plurality of user-behavior profiles will result in a computing-system infection.

2. The computer-implemented method of claim 1 , wherein:

labeling the first group as infected profiles is based at least in part on the similarity between the unlabeled profiles in the first group and the at least one labeled profile in the plurality of infected profiles; and

labeling the second group as clean profiles is based at least in part on the similarity between the unlabeled profiles in the second group and the at least one labeled profile in the plurality of clean profiles.

3. The computer-implemented method of claim 2 , wherein labeling the first group of the plurality of unlabeled profiles as infected profiles comprises:

calculating a similarity between an unlabeled profile in the first group and the at least one labeled profile in the plurality of infected profiles;

calculating a soft risk score for the unlabeled profile based at least in part on:

the similarity between the unlabeled profile and the at least one labeled profile in the plurality of infected profiles; and

a risk score of the at least one labeled profile in the plurality of infected profiles;

labeling the unlabeled profile as an infected profile based at least in part on the soft risk score.

4. The computer-implemented method of claim 3 , wherein training the classification model comprises using the soft risk score as a weighting factor of the pseudo label of the unlabeled profile.

5. The computer-implemented method of claim 1 , wherein:

labeling the first group as infected profiles is based at least in part on the mapping of the unlabeled profiles in the first group to the first region of the feature space defined by the lowest-density region of the feature space; and

labeling the second group as clean profiles is based at least in part on the mapping of the unlabeled profiles in the second group to the second region of the feature space defined by the lowest-density region of the feature space.

6. The computer-implemented method of claim 5 , wherein assigning the pseudo label to each of the plurality of unlabeled profiles comprises:

mapping each of the unlabeled profiles in the first group and each of the unlabeled profiles in the second group to the feature space;

splitting the feature space into the first region and the second region along the lowest-density region of the feature space;

labeling unlabeled profiles in the first region as infected profiles; and

labeling unlabeled profiles in the second region as clean profiles.

7. The computer-implemented method of claim 1 , wherein:

assigning the pseudo label to each of the plurality of unlabeled profiles comprises using the classification model to reassign pseudo labels to the plurality of unlabeled profiles;

training the classification model comprises retraining, after reassigning pseudo labels, the classification model until the pseudo labels of the plurality of unlabeled profiles converge.

8. The computer-implemented method of claim 1 , wherein training the classification model comprises training a decision tree to distinguish infected profiles from clean profiles.

9. The computer-implemented method of claim 8 , wherein training the decision tree comprises determining, at an internal node in the decision tree, a splitting rule that best:

minimizes a classification error of any labeled profiles at the internal node; and

splits the feature space to which any unlabeled profiles at the internal node are mapped along the low-density region of the feature space.

10. The computer-implemented method of claim 8 , wherein training the decision tree comprises determining, at an internal node in the decision tree, a splitting rule that maximizes mutual information.

11. The computer-implemented method of claim 8 , wherein training the decision tree comprises determining, at an internal node in the decision tree, a splitting rule that splits user-behavior profiles at the internal node into two subsets in a way that maximizes a divergence between the two subsets.

12. The computer-implemented method of claim 1 , wherein using the classification model comprises:

using the classification model to predict the likelihood that the computing system of the user will become infected; and

performing a security action based at least in part on the likelihood that the computing system of the user will become infected.

13. The computer-implemented method of claim 1 , wherein using the classification model comprises:

using the classification model to predict the likelihood that the user behavior will result in a computing-system infection; and

performing a security action based at least in part on the likelihood that the user behavior will result in a computing-system infection.

14. A system for evaluating infection risks based on profiled user behaviors, the system comprising:

a collecting module, stored in memory, that collects a plurality of user-behavior profiles that comprises:

a plurality of labeled profiles that comprises:

a plurality of infected profiles, wherein each of the plurality of infected profiles comprises a profile of user behaviors that occurred at an associated infected computing system that is known to have encountered malware; and

a plurality of clean profiles, wherein each of the plurality of clean profiles comprises a profile of user behaviors that occurred at an associated clean computing system that is known to be free of malware; and

a plurality of unlabeled profiles, wherein each of the plurality of unlabeled profiles comprises a profile of user behaviors that occurred at an associated computing system that is not known to have encountered malware and not known to be free of malware;

a labeling module, stored in memory, that assigns a pseudo label to each of the plurality of unlabeled profiles by:

labeling a first group of the plurality of unlabeled profiles as infected profiles based at least in part on one or more of:

a similarity between unlabeled profiles in the first group and at least one labeled profile in the plurality of infected profiles; or

a mapping of the unlabeled profiles in the first group to a first region of a feature space defined by a lowest-density region of the feature space; and

labeling a second group of the plurality of unlabeled profiles as clean profiles based at least in part on one or more of:

a similarity between unlabeled profiles in the second group and at least one labeled profile in the plurality of clean profiles; or

a mapping of the unlabeled profiles in the second group to a second region of the feature space defined by the lowest-density region of the feature space;

a training module, stored in memory, that trains a classification model to distinguish infected profiles from clean profiles using features and labels of the plurality of user-behavior profiles;

a risk-evaluating module, stored in memory, that uses the classification model to predict at least one of:

a likelihood that a computing system of a user will become infected based at least in part on a profile of user behaviors of the user; and

a likelihood that a user behavior in the plurality of user-behavior profiles will result in a computing-system infection;

at least one processor that executes the collecting module, the labeling module, the training module, and the risk-evaluating module.

15. The system of claim 14 , wherein the labeling module:

labels the first group as infected profiles based at least in part on the similarity between the unlabeled profiles in the first group and the at least one labeled profile in the plurality of infected profiles; and

labels the second group as clean profiles based at least in part on the similarity between the unlabeled profiles in the second group and the at least one labeled profile in the plurality of clean profiles.

16. The system of claim 15 , wherein the labeling module labels the first group of the plurality of unlabeled profiles as infected profiles by:

calculating a similarity between an unlabeled profile in the first group and the at least one labeled profile in the plurality of infected profiles;

calculating a soft risk score for the unlabeled profile based at least in part on:

the similarity between the unlabeled profile and the at least one labeled profile in the plurality of infected profiles; and

a risk score of the at least one labeled profile in the plurality of infected profiles;

labeling the unlabeled profile as an infected profile based at least in part on the soft risk score.

17. The system of claim 14 , wherein the labeling module:

labels the first group as infected profiles is based at least in part on the mapping of the unlabeled profiles in the first group to the first region of the feature space defined by the lowest-density region of the feature space; and

labels the second group as clean profiles is based at least in part on the mapping of the unlabeled profiles in the second group to the second region of the feature space defined by the lowest-density region of the feature space.

18. The system of claim 14 , wherein the labeling module assigns the pseudo label to each of the plurality of unlabeled profiles by:

mapping each of the unlabeled profiles in the first group and each of the unlabeled profiles in the second group to the feature space;

splitting the feature space into the first region and the second region along the lowest-density region of the feature space;

labeling unlabeled profiles in the first region as infected profiles; and

labeling unlabeled profiles in the second region as clean profiles.

19. The system of claim 14 , wherein:

the labeling module assigns the pseudo label to each of the plurality of unlabeled profiles by using the classification model to assign pseudo labels to the plurality of unlabeled profiles;

the training module trains the classification model by retraining the classification model until the pseudo labels of the plurality of unlabeled profiles converge.

20. A non-transitory computer-readable medium comprising one or more computer-executable instructions that, when executed by at least one processor of a computing device, cause the computing device to:

collect, by the computing device comprising the at least one hardware processor, a plurality of user-behavior profiles that comprises:

a plurality of labeled profiles that comprises:

a plurality of infected profiles, wherein each of the plurality of infected profiles comprises a profile of user behaviors that occurred at an associated infected computing system that is known to have encountered malware; and

a plurality of clean profiles, wherein each of the plurality of clean profiles comprises a profile of user behaviors that occurred at an associated clean computing system that is known to be free of malware; and

a plurality of unlabeled profiles, wherein each of the plurality of unlabeled profiles comprises a profile of user behaviors that occurred at an associated computing system that is not known to have encountered malware and not known to be free of malware;

assign, before training a classification model to distinguish infected profiles from clean profiles, a pseudo label to each of the plurality of unlabeled profiles by:

labeling a first group of the plurality of unlabeled profiles as infected profiles based at least in part on one or more of:

a similarity between unlabeled profiles in the first group and at least one labeled profile in the plurality of infected profiles; or

a mapping of the unlabeled profiles in the first group to a first region of a feature space defined by a lowest-density region of the feature space; and

labeling a second group of the plurality of unlabeled profiles as clean profiles based at least in part on one or more of:

a similarity between unlabeled profiles in the second group and at least one labeled profile in the plurality of clean profiles; or

a mapping of the unlabeled profiles in the second group to a second region of the feature space defined by the lowest-density region of the feature space; and

train the classification model to distinguish infected profiles from clean profiles using features and labels of the plurality of user-behavior profiles;

using the classification model to predict at least one of:

a likelihood that a computing system of a user will become infected based at least in part on a profile of user behaviors of the user; or

a likelihood that a user behavior in the plurality of user-behavior profiles will result in a computing-system infection.