Machine learning malware classifications using behavioral artifacts
Techniques and systems for a security service system configured with a sensor component including a machine learning (ML) malware classifier to perform behavioral detection on host devices. The security service system may deploy a sensor component to monitor behavioral events on a host device. The sensor component may generate events data corresponding to monitored operations targeted by malware. The system may map individual events from events data onto a behavioral activity pattern and generate process trees. The system may extract behavioral artifacts to build a feature vector used for malware classification and generate a machine learning (ML) malware classifier. The sensor component may use the ML malware classifier to perform asynchronous behavioral detection on a host device and process system events for malware detection.
1. A system comprising:
one or more processors; and
programming instructions configured to be executed by the one or more processors to perform operations comprising:
receiving, from one or more monitored devices, events data for training data;
presenting false-negative data of the events data based on a labeled indicator of the false-negative data incorrectly labeled as false-negative or false-positive;
generating labeled data by relabeling one or more processes in the false-negative data;
storing the labeled data as the training data;
determining that the events data is associated with a malicious process;
determining to map individual events from the events data onto a behavioral activity pattern;
aggregating multiple events of the individual events into a single artifact, the multiple events produced by the malicious process;
generating a malware classifier based at least in part on extracting behavioral artifacts including the single artifact from the behavioral activity pattern and building a feature vector associated with the extracted behavior artifacts used for the malware classifier;
transmitting, to the one or more monitored devices, the malware classifier; and
receiving, from the one or more monitored devices, additional events data for additional training data.
2. The system of claim 1 , wherein the feature vector includes one or more explicit features derived from a file system, a network, a registry, or a processes interaction.
3. The system of claim 1 , wherein the events data includes data produced by one or more processes, the one or more processes includes one or more of a network trace, a registry modification, a file system change, and a memory access.
4. The system of claim 3 , further comprising:
determining that the events data is associated with a severity level based at least in part on a classifier for predicting severity of an input data.
5. The system of claim 1 , wherein the events data is received over a predetermined period of time.
6. The system of claim 1 , wherein the behavioral activity pattern includes a process tree that indicates relationship information associated with one or more of an immediate parent process or a grandparent process.
7. The system of claim 1 , wherein determining that the events data is associated with the malicious process includes receiving input to label at least a portion of the events data.
8. The system of claim 1 , wherein the events data is filtered to remove known safe behavioral events.
9. A method of behavioral detection on a monitored device, the method comprising:
transmitting, to one or more computing devices, events data associated with a malicious process, the events data including false-negative data having a labeled indicator incorrectly labeled as false-negative or false-positive, one or more processes in the false-negative data to be relabeled as labeled data and to be stored as training data;
generating a process tree based on the events data;
generating features indicating malware by aggregating data corresponding to portions of the process tree;
receiving, from the one or more computing devices, a machine learning model to classify input data by the features indicating malware;
receiving, from an input device, user input;
determining, using the machine learning model, that the user input includes a feature of the features indicating malware;
determining that a malicious process is associated with the feature; and
determining to stop the malicious process.
10. The method of claim 9 , wherein the events data are produced by at least one process or at least one thread.
11. The method of claim 9 , further comprising:
determining that the malicious process associated with the events data is classified as high severity.
12. The method of claim 9 , further comprising:
removing, from the process tree, all processes associated with the malicious process.
13. The method of claim 9 , wherein generating the process tree includes monitoring, using the machine learning model, two or more process threads.
14. The method of claim 13 , wherein determining to stop the malicious process comprises stopping a first process thread of the two or more process threads.
15. One or more non-transitory computer-readable media having computer executable instructions that, when executed by one or more processors, cause the one or more processors to perform operations comprising:
transmitting, to one or more computing devices, events data associated with a malicious process, the events data including false-negative data having a labeled indicator incorrectly labeled as false-negative or false-positive, one or more processes in the false-negative data to be relabeled as labeled data and to be stored as training data;
generating a process tree based on the events data;
generating features indicating malware by aggregating data corresponding to portions of the process tree;
receiving, from the one or more computing devices, a machine learning model to classify input data by the features indicating malware;
receiving, from an input device, user input;
determining, using the machine learning model, that the user input includes a feature of the features indicating malware; and
determining to perform a remedial action based at least in part on the feature.
16. The one or more non-transitory computer-readable media as recited in claim 15 , wherein the remedial action includes terminating a malicious process associated with the feature.
17. The one or more non-transitory computer-readable media as recited in claim 15 , wherein the operations further comprise:
removing, from the process tree, all processes associated with the malicious process.
18. The one or more non-transitory computer-readable media as recited in claim 15 , wherein:
the process tree is generated based at least in part on a sliding process window for multiple processes, and
the sliding process window is associated with a start time and an end time.
19. The one or more non-transitory computer-readable media as recited in claim 15 , wherein the operations further comprise:
determining, using the machine learning model, to monitor two or more process threads.