Methods and systems for malware detection

1. A method of building a dictionary, for adapting files to an input of a malware detector comprising a deep learning algorithm, comprising, by a processing unit:

building a first size dictionary, the building comprising extracting features from a plurality of malware files and non-malware files,

building an intermediate dictionary of lower size than the first size, the building comprising selecting a first subset of the features of the first size dictionary using a first automatic reduction algorithm, and forming the intermediate dictionary based at least on the first subset of features,

building a second size dictionary of lower size than the intermediate dictionary, wherein the building comprises selecting a second subset of the features of the intermediate dictionary using a second automatic reduction algorithm and forming the second size dictionary based at least on the second subset of features,

wherein the first automatic reduction algorithm and the second automatic algorithm are different one from the other, and

wherein the second size dictionary dictates, for files to be fed to the malware detector, a size and a content of vectors representing the files and suitable for being processed by the deep learning algorithm, for determining prospects of whether the files constitute malware or not.

2. The method of claim 1 , wherein building comprises extracting features from at least one of a header, a payload a source code and a portion of a memory of the plurality of malware files and non-malware files.

3. The method according to claim 1 , wherein the features comprise at least one of the following features:

operating codes of the malware and non-malware files, or

strings present in the content of the malware and non-malware files, or

parts of a header of the malware and non-malware files, or

strings present in the content of the malware and non-malware files and operating codes of the malware and non-malware files, or

strings present in the content of the malware and non-malware files and parts of a header of the malware and non-malware files, or

parts of a header of the malware and non-malware files, and operating codes of the malware and non-malware files, or

raw bytes of memory from the content of the malware and non-malware files.

4. The method according to claim 1 , wherein at least one of the first automatic reduction algorithm and the second automatic reduction algorithm includes a statistical algorithm, a linear reduction algorithm, and a non-linear reduction algorithm.

5. The method according to claim 1 , wherein at least one of the first automatic reduction algorithm and the second automatic reduction algorithm includes a combination of at least a statistical algorithm, a linear reduction algorithm, and a non-linear reduction algorithm.

6. The method according to claim 1 , comprising:

building a first intermediate dictionary of lower size than the first size dictionary, the building comprising selecting a first subset of the features of the first size dictionary using a statistical algorithm, and forming the first intermediate dictionary based at least on the first subset of features;

building a second intermediate dictionary of lower size than the first intermediate dictionary, the building comprising selecting a second subset of the features of the first size dictionary using a linear reduction algorithm, and forming the second intermediate dictionary based at least on the second subset of features;

building a second size dictionary of lower size than the second intermediate dictionary, wherein the building comprises selecting the third subset of the features of the second intermediate dictionary using a non-linear reduction algorithm, and forming the second size dictionary based at least on the third subset of features.

7. The method according to claim 1 , wherein the second size dictionary dictates a size and a content of a vector representing each malware file and non-malware file, for real time processing of each vector by the deep learning algorithm.

8. The method according to claim 1 , wherein the malware files and non-malware files are operable on different operating systems and the features are independent of the operating systems so that the first size dictionary and the second size dictionary are built irrespective of the operating systems.

9. A system for building a dictionary, for adapting files to input of a malware detector comprising a deep learning algorithm, the system comprising a configured to:

build a first size dictionary, the building comprising extracting features from a plurality of malware files and non-malware files,

build an intermediate dictionary of lower size than the first size, the building comprising selecting a first subset of the features of the first size dictionary using a first automatic reduction algorithm, and forming the intermediate dictionary based at least on the first subset of features,

build a second size dictionary of lower size than the intermediate dictionary, wherein the building comprises selecting a second subset of the features of the intermediate dictionary using a second automatic reduction algorithm and forming the second size dictionary based at least on the second subset of features,

wherein the first automatic reduction algorithm and the second automatic algorithm are different one from the other, and

wherein the second size dictionary dictates, for files to be fed to the malware detector, a size and a content of vectors representing the files and suitable for being processed by the deep learning algorithm, for determining prospects of whether the files constitute malware or not.

10. The system of claim 9 , wherein the building comprises extracting features from at least one of a header, a payload, a source code and a portion of a memory of the plurality of malware files and non-malware files.

11. The system of claim 9 , wherein the features comprise at least one of the following features:

operating codes of the malware and non-malware files, or

strings present in the content of the malware and non-malware files, or

parts of a header of the malware and non-malware files, or

strings present in the content of the malware and non-malware files and operating codes of the malware and non-malware files, or

strings present in the content of the malware and non-malware files and parts of a header of the malware and non-malware files, or

parts of a header of the malware and non-malware files, and operating codes of the malware and non-malware files, or

raw bytes of memory from the content of the malware and non-malware files.

12. The system of claim 9 , wherein at least one of the first automatic reduction algorithm and the second automatic reduction algorithm includes a combination of at least a statistical algorithm, a linear reduction algorithm and a non-linear reduction algorithm.

13. The system according to claim 9 , wherein at least one of the first automatic reduction algorithm and the second automatic reduction algorithm includes a combination of at least a statistical algorithm, a linear reduction algorithm and a non-linear reduction algorithm.

14. The system according to claim 9 , configured to preform:

building a first intermediate dictionary of lower size than the first size dictionary, the building comprising selecting a first subset of the features of the first size dictionary using a statistical algorithm, and forming the first intermediate dictionary based at least on the first subset of features;

building a second intermediate dictionary of lower size than the first intermediate dictionary, the building comprising selecting a second subset of the features of the first size dictionary using a linear reduction algorithm, and forming the second intermediate dictionary based at least on the second subset of features;

building a second size dictionary of lower size than the second intermediate dictionary, the building comprising selecting a third subset of the features of the second intermediate dictionary using a non-linear reduction algorithm, and forming the second size dictionary based at least on the third subset of features.

15. The system according to claim 9 , wherein the second size dictionary dictates a size and a content of a vector representing each malware file and non-malware file, for real time processing of each vector by the deep learning algorithm.

16. The system according to claim 9 , wherein the malware files and non-malware files are operable on different operating systems and the features are independent of the operating systems so that the first size dictionary and the second size dictionary are built irrespective of the operating systems.

17. A non-transitory storage device readable by a machine storing a data structure comprising:

at least one dictionary comprising a list of features originating from malware files and non-malware files,

wherein the dictionary dictates, for a file to be fed to a malware detector comprising a deep learning algorithm, a size and a content of a vector representing the file and suitable for being processed by the deep learning algorithm, for determining prospects of whether the file constitutes malware or not,

wherein the dictionary dictates a size and a content of a vector representing the file for processing of the vector by the deep learning algorithm,

wherein the dictionary includes features of malware files and non-malware files selected from at least an intermediate dictionary of larger size that the dictionary, using a second automatic reduction algorithm,

wherein the intermediate dictionary includes features of malware files and non-malware files selected from at least a first dictionary of larger size than the intermediate dictionary, using a first automatic reduction algorithm being different from the second automatic reduction algorithm.

18. The data structure of claim 17 , wherein the list of features provides an accuracy of prospects by the deep learning algorithm for the file which is not reduced with respect to a more comprehensive list of features which comprises said list of features and additional features originating from malware files and non-malware files.

19. The data structure of claim 17 , wherein at least one of the first automatic reduction algorithm and the second automatic reduction algorithm includes a combination of at least a statistical algorithm, a linear reduction algorithm and a non-linear reduction algorithm.

20. A non-transitory storage device readable by a machine, tangibly embodying a program of instructions executable by the machine to perform a method of building a dictionary, for adapting files to an input of a malware detector comprising a deep learning algorithm, comprising, by a processing unit:

building a first size dictionary, the building comprising extracting features from a plurality of malware files and non-malware files,

building an intermediate dictionary of lower size than the first size, the building comprising selecting a first subset of the features of the first size dictionary using a first automatic reduction algorithm, and forming the intermediate dictionary based at least on the first subset of features,

building a second size dictionary of lower size than the intermediate dictionary, wherein the building comprises selecting a second subset of the features of the intermediate dictionary using a second automatic reduction algorithm and forming the second size dictionary based at least on the second subset of features,

wherein the first automatic reduction algorithm and the second automatic algorithm are different one from the other, and

wherein the second size dictionary dictates, for files to be fed to the malware detector, a size and a content of vectors representing the files and suitable for being processed by the deep learning algorithm, for determining prospects of whether the files constitute malware or not.