Stack trace analysis model

1 . A computer-implemented method for detecting a malware injection in a trusted process, the method comprising:

identifying at least one trusted process launched on a computing device;

monitoring at least one thread associated with the at least one trusted process using at least one control point;

detecting activity at the at least one thread based on the at least one control point and determining a timestamp of the detected activity, wherein the timestamp corresponds to one of a plurality of scheduled timeslots at which the activity is detected;

receiving, from the at least one trusted process, at least one execution stack corresponding to the timestamp and indicating the at least one control point used to monitor the at least one thread;

applying a first machine learning module of a first malware detector to the at least one execution stack to generate a first verdict, wherein the first verdict determines that the trusted process is potentially malicious;

collecting the first verdict and auxiliary information corresponding to the at least one trusted process at the timestamp;

applying a second machine learning module of a second malware detector to the first verdict and the auxiliary information, such that the first verdict and the auxiliary information are inputs to the second machine learning module to generate a second verdict, wherein applying the second machine learning module of the second malware detector includes applying a machine learning classifier to the first verdict and the auxiliary information to infer the second verdict as a prediction using previous training of the machine learning classifier, and wherein the second verdict is indicative of presence of malware injection in the at least one trusted process; and

repeating, each of the detecting activity, the receiving the at least one execution stack, the applying the first machine learning module, the collecting the first verdict and the auxiliary information, and the applying the second machine learning module for one or more threads associated with one or more trusted processes at a predefined frequency corresponding to respective scheduled timeslots of the plurality of scheduled timeslots thereby including a plurality of timestamps associated with respective scheduled timeslots,

wherein each of the plurality of scheduled timeslots is determined according to at least one predefined rule,

wherein each respective timestamp is associated with a respective first verdict, and

wherein the respective timestamp and the respective first verdict are input to the second machine learning module, and the second verdict is based on the respective timestamp.

2 . The method of claim 1 , further including:

retraining the first malware detector to identify potential malware injection based on newly collected data corresponding to detected potential malware injections, wherein the first malware detector is based on the first machine learning module; and

retraining the second malware detector to confirm the presence of malware injection based on newly collected data corresponding to confirmed malware injections, wherein the second malware detector is based on a second machine learning module.

3 . The method of claim 1 , further comprising providing the first verdict and auxiliary information corresponding to each of two or more trusted processes, from amongst the at least one trusted process, in a series, wherein the series is formed of an order of the timestamp corresponding to each trusted process.

4 . The method of claim 1 , wherein the method further comprises determining a remedial action, by applying a third machine learning module of the second malware detector to the auxiliary information and the second verdict, in response to the second verdict.

5 . The method of claim 4 , wherein the remedial action comprises at least one of file rollback, registry rollback, scheduled tasks rollback, remote registry rollback modified by the at least one trusted process and termination of the identified malicious process.

6 . The method of claim 1 , further comprising generating an alert to a user and providing the user with the second verdict and the collected auxiliary information to remediate files, file paths, scheduled tasks and registry data modified by the at least one trusted process.

7 . The method of claim 1 , wherein the auxiliary information includes at least one of File I/O, Registry I/O data, Remote Procedure Call (RPC) calls, Local Procedural Call (LPC) data, a scheduled task, Component Object Model (COM) server data, network activity data, and intercepted Application Programming Interface (API) data.

8 . The method of claim 1 , wherein the monitoring of the at least one thread associated with the at least one trusted process is performed using call stack trace monitoring, and the at least one control point is associated with at least one event comprising at least one of: create a file, clean up a file, close a file, duplicate a handle, rename a file, delete a file, create a thread, a registry operation, a Component Object Model (COM) operation, a Remote Procedure Call (RPC) call, and a Local Procedure Call (LPC) call.

9 . The method of claim 1 , wherein the respective scheduled timeslot is scheduled at an interval of 10 seconds.

10 . The method of claim 1 , further comprising:

identifying the process as malicious if the second verdict is higher than a first predefined threshold; and

detecting a false positive if the second verdict of the malicious behavior of the at least one trusted processes is lower than a second predefined threshold.

11 . A malware detection system configured to detect a malware injection in a trusted process, the system comprising:

a hardware processor implemented on a computing device; and

instructions that, when executed by the hardware processor, cause the hardware processor to:

identify at least one trusted process launched on the computing device,

monitor at least one thread associated with the at least one trusted process using at least one control point,

detect activity at the at least one thread based on the at least one control point and determine a timestamp of the detected activity, wherein the timestamp corresponds to one of a plurality of scheduled timeslots at which the activity is detected,

receive from the at least one trusted process at least one execution stack corresponding to the timestamp and indicating the at least one control point used to monitor the at least one thread,

apply a first machine learning module of a first malware detector to the at least one execution stack to generate a first verdict, wherein the first verdict determines that the at least one trusted process is potentially malicious,

collect the first verdict and auxiliary information corresponding to the at least one trusted process at the timestamp,

apply a second machine learning module of a second malware detector to the first verdict and the auxiliary information, such that the first verdict and the auxiliary information are inputs to the second machine learning module to generate a second verdict wherein applying the second machine learning module of the second malware detector includes applying a machine learning classifier to the first verdict and the auxiliary information to infer the second verdict as a prediction using previous training of the machine learning classifier;

wherein the second verdict is indicative of presence of malware injection in the trusted process;

wherein the instructions further cause the hardware processor to repeat each of the instructions to detect activity, receive the at least one execution stack, apply the first machine learning module, collect the first verdict and the auxiliary information, and apply the second machine learning module for one or more threads associated with one or more trusted processes at a predefined frequency corresponding to respective scheduled timeslots of the plurality of scheduled timeslots, thereby including a plurality of timestamps associated with respective scheduled timeslots,

wherein each of the plurality of scheduled timeslots is determined according to at least one predefined rule,

wherein each respective timestamp is associated with a respective first verdict, and

wherein the respective timestamp and the respective first verdict are input to the second machine learning module, and the second verdict is based on the respective timestamp.

12 . The system of claim 11 , wherein the instructions further cause the hardware processor to:

retrain the first malware detector to identify potential malware injection based on newly collected data corresponding to detected potential malware injections, wherein the first malware detector is based on the first machine learning module; and

retrain the second malware detector to confirm the presence of malware injection based on newly collected data corresponding to confirmed malware injections, wherein the second malware detector is based on the second machine learning module.

13 . The system of claim 11 , wherein the first verdict and auxiliary information corresponding to each of two or more trusted processes, from amongst the at least one trusted process, are provided to the second malware detector in a series, wherein the series is formed of an order of the timestamp corresponding to each trusted process.

14 . The system of claim 11 , wherein the instructions further cause the hardware processor to: determine a remedial action, in response to the second verdict, by applying a third machine learning module of the second malware detector to the auxiliary information and the second verdict.

15 . The system of claim 14 , wherein the remedial action comprises at least one of file rollback, registry rollback, scheduled tasks rollback, remote registry rollback modified by the at least one trusted process and termination of the identified malicious process.

16 . The system of claim 11 , wherein the instructions further cause the hardware processor to:

generate an alert for a user; and

provide the user with the second verdict and the collected auxiliary information to remediate files, file paths, scheduled tasks and registry data modified by the at least one trusted process.

17 . The system of claim 11 , wherein the auxiliary information includes at least one of File I/O, Registry I/O data, Remote Procedure Call (RPC) call data, Local Procedure Call (LPC) data, a scheduled task, Component Object Model (COM) server data, network activity data, and intercepted Application Programming Interface (API) data.

18 . The system of claim 11 , wherein the monitoring of the at least one thread associated with the at least one trusted process is performed using call stack trace monitoring, and the at least one control point is associated with at least one event comprising at least one of: create a file, clean up a file, close a file, duplicate a handle, rename a file, delete a file, create a thread, registry operations, a Component Object Model (COM) operation, a Remote Procedure Call (RPC) call, and a Local Procedure Call (LPC) call.

19 . The system of claim 11 , wherein the instructions further cause the hardware processor to:

identify the process as malicious if the second verdict is higher than a first predefined threshold; and

detect a false positive if the second verdict of the malicious behavior of the at least one trusted process is lower than a second predefined threshold.

20 . The system of claim 11 , wherein the respective scheduled timeslot is scheduled at an interval of 10 seconds.