Malware detection using a machine learning model
An information handling system may receive a plurality of rules and a file for malware testing. The information handling system may apply two or more of the plurality of rules to the received file to determine a plurality of outcomes of application of the rules to the file. The information handling system may determine whether to classify the received file as malware or not malware by applying a machine learning model to the plurality of outcomes.
1. A method for detecting malware m an information handling system, comprising:
receiving, by an information handling system, a plurality of rules;
receiving, by the information handling system, a file for malware testing;
determining, by the information handling system, to apply two or more rules of the plurality of rules to the file based, at least in part, on one or more characteristics of the file, wherein the determining comprises using a classification model to estimate the probability that each rule in the plurality of rules would be able to detect malware in files having the one or more characteristics of the file;
applying the two or more rules of the plurality of rules to the received file to determine a plurality of outcomes; and
determining, by the information handling system, whether to classify the file as malware by inputting the plurality of outcomes for applying a machine learning model to the plurality of outcomes.
2. The method of claim 1 , further comprising transmitting, by the information handling system, the determination of whether to classify the file as malware or not malware for training the machine learning model.
3. The method of claim 2 , wherein the training is performed by a back-end information handling system, further comprising receiving, by the information handling system from the back-end information handling system, an update to the machine learning model based, at least in part, on the training.
4. The method of claim 1 , wherein the one or more characteristics of the file comprise a file type.
5. The method of claim 1 , wherein the two or more of the plurality of rules are further determined based, at least in part, on a comparison of the one or more characteristics of the file to a rule type for each of the rules in the plurality of rules.
6. The method of claim 1 , wherein determining whether to classify the file as malware or not malware comprises determining to classify the file as malware, further comprising:
Classifying the file as malware;
quarantining the file.
7. An information handling system comprising:
a processor; and
a memory;
wherein the processor is configured to perform steps comprising
receiving a plurality of rules;
receiving a file for malware testing;
determining, by the information handling system, to apply two or more rules of the plurality of rules to the file based, at least in part, on one or more characteristics of the file, wherein the determining comprises using a classification model to estimate the probability that each rule in the plurality of rules would be able to detect malware in files having the one or more characteristics of the file;
applying the two or more rules of the plurality of rules to the received file to determine a plurality of outcomes; and
determining whether to classify the file as malware or not malware by inputting the plurality of outcomes for applying a machine learning model to the plurality of outcomes.
8. The information handling system of claim 7 , wherein the processor is further configured to perform steps comprising receiving from a back end server an update to the machine learning model based, at least in part, on training of the machine learning model performed by the back-end information handling system using the determined classification of the file as malware or not malware.
9. The information handling system of claim 7 , wherein the one or more characteristics of the file comprise a file type.
10. The information handling system of claim 7 , wherein the two or more of the plurality of rules are further determined based, at least in part, on a comparison of the one or more characteristics of the file to a rule type for each of the rules in the plurality of rules.
11. An information handling system comprising:
a processor; and
a memory;
wherein the processor is configured to perform steps comprising:
receiving, from a client information handling system, information specifying a plurality of rules applied to a file by the information handling system, a plurality of outcomes of the application of the plurality of rules to the file, and a classification of the file determined by the client information handling system by inputting the plurality of outcomes for applying a machine learning model to the plurality of outcomes, wherein the plurality of rules applied to the file are determined using a classification model to estimate the probability that each rule in the plurality of rules would be able to detect malware in the file;
training the machine learning model based on the received information specifying the plurality of rules, the received plurality of outcomes, and the received classification of the file;
generating an update to the machine learning model based on the training; and
transmitting the update to the client information handling system.
12. The information handling system of claim 11 , wherein the step of receiving further comprises receiving, from the client information handling system, one or more characteristics of the file, and wherein the machine learning model is further trained based on the received one or more characteristics of the file.
13. The information handling system of claim 11 , wherein the step of receiving further comprises receiving, from the client information handling system, classification verification information specifying whether the classification was correct, and wherein the machine learning model is further trained based on the received classification verification information.
14. The information handling system of claim 13 , wherein training the machine learning model comprises:
if the file is classified as malware and the verification information specifies that the classification was correct, increasing a probability that the model will classify a new file as malware if application of the same plurality of rules to the new file results in the same plurality of outcomes; and
if the file is classified as malware and the verification information specifies that the classification was incorrect, increasing a probability that the model will classify a new file as not malware if application of the same plurality of rules to the new file results in the same plurality of outcomes.
15. The information handling system of claim 11 , wherein the processor is further configured to perform steps comprising:
storing the received information specifying the plurality of rules, the plurality of outcomes, and the classification in a database.
16. The information handling system of claim 11 , wherein the processor is further configured to perform steps comprising:
transmitting the update to a network of multiple client information handling systems.