System and method for training a malware detection model

1. A method for training a malware detection model, comprising:

generating, by a processor, a plurality of behavior patterns based on one or more logs of commands executed on a computing device, wherein each of the plurality of behavior patterns is represented by a feature vector and wherein the plurality of behavior patterns is generated by calculating a hash sum for each pattern element of the behavior pattern and setting a corresponding bit in the feature vector depending on the calculated hash sum;

calculating, by the processor, an effectiveness of each of a plurality of methods for machine learning based on the plurality of behavior patterns;

determining, by the processor, a preferred method for machine learning from the plurality of methods for machine learning by selecting the preferred method as a method with the greatest effectiveness from the plurality of methods for machine learning;

obtaining, by the processor, parameters of the malware detection model by applying convolution functions to the plurality of behavior patterns;

training, by the processor, the malware detection model to detect malicious files using the preferred method for machine learning.

2. The method of claim 1 , wherein the preferred method is different from a previously selected preferred method that was used to train the malware detection model.

3. The method of claim 1 , further comprising:

applying the selected preferred method for machine learning to a previously created detection model, wherein parameters of the previously created detection model are unable to produce output data with an accuracy higher than a predetermined threshold.

4. The method of claim 1 , wherein the effectiveness is measured according to a number of errors when using the method for machine learning to detect malicious files based on the behavior patterns.

5. The method of claim 4 , wherein the behavior patterns are of a particular kind, the particular kind one of: a data structure, a number of elements of the plurality of behavior patterns, performance of the computing device, available resources of the computing device.

6. The method of claim 1 , further comprising:

selecting the method for machine learning according to one or more of: cross testing, mathematical validation of one or more of: Akaike Information Criterion (AIC) and Bayesian Information Criterion (BIC), split testing and stacking.

7. The method of claim 1 , wherein determining the preferred method comprises:

selecting an artificial neural network as the preferred method when the effectiveness is greater than a random forest as the preferred method, otherwise selecting the random forest as the preferred method;

initializing a method of numerical optimization of parameters of the artificial neural network when the artificial neural network is selected; and

initializing a separating criterion for nodes in the random forest when the random forest is selected.

8. The method of claim 7 , further comprising;

selecting the random forest as the method for machine learning when performance of the computing device is below a predetermined threshold, otherwise:

selecting the artificial neural networks as the method for machine learning.

9. A system for training a malware detection model, comprising:

a hardware processor configured to:

generate a plurality of behavior patterns based on one or more logs of commands executed on a computing device, wherein each of the plurality of behavior patterns is represented by a feature vector and wherein the plurality of behavior patterns is generated by calculating a hash sum for each pattern element of the behavior pattern and setting a corresponding bit in the feature vector depending on the calculated hash sum;

calculate an effectiveness of each of a plurality of methods for machine learning based on the plurality of behavior patterns;

determine a preferred method for machine learning from the plurality of methods for machine learning by selecting the preferred method as a method with the greatest effectiveness from the plurality of methods for machine learning;

obtain parameters of the malware detection model by applying convolution functions to the plurality of behavior patterns;

training the malware detection model to detect malicious files using the preferred method for machine learning.

10. The system of claim 9 , wherein the preferred method is different from a previously selected preferred method that was used to train the malware detection model.

11. The system of claim 9 , the hardware processor further configured to:

apply the selected preferred method for machine learning to a previously created detection model, wherein parameters of the previously created detection model are unable to produce output data with an accuracy higher than a predetermined threshold.

12. The system of claim 9 , wherein the effectiveness is measured according to a number of errors when using the method for machine learning to detect malicious files based on the behavior patterns.

13. The method of claim 12 , wherein the behavior patterns are of a particular kind, the particular kind one of: a data structure, a number of elements of the plurality of behavior patterns, performance of the computing device, available resources of the computing device.

14. The method of claim 9 , the hardware processor further configured to:

select the method for machine learning according to one or more of: cross testing, mathematical validation of one or more of: Akaike Information Criterion (AIC) and Bayesian Information Criterion (BIC), split testing and stacking.

15. The method of claim 9 , wherein the hardware processor determines the preferred method by:

selecting an artificial neural network as the preferred method when the effectiveness is greater than a random forest as the preferred method, otherwise selecting the random forest as the preferred method;

initializing a method of numerical optimization of parameters of the artificial neural network when the artificial neural network is selected; and

initializing a separating criterion for nodes in the random forest when the random forest is selected.

16. The method of claim 15 , the hardware processor further configured to;

select the random forest as the method for machine learning when performance of the computing device is below a predetermined threshold, otherwise:

select the artificial neural networks as the method for machine learning.

17. A non-transitory computer-readable medium, storing instructions thereon, which when executed perform a method for training a malware detection model, comprising:

generating, by a processor, a plurality of behavior patterns based on one or more logs of commands executed on a computing device, wherein each of the plurality of behavior patterns is represented by a feature vector and wherein the plurality of behavior patterns is generated by calculating a hash sum for each pattern element of the behavior pattern and setting a corresponding bit in the feature vector depending on the calculated hash sum;

calculating, by the processor, an effectiveness of each of a plurality of methods for machine learning based on the plurality of behavior patterns;

determining, by the processor, a preferred method for machine learning from the plurality of methods for machine learning by selecting the preferred method as a method with the greatest effectiveness from the plurality of methods for machine learning;

obtaining, by the processor, parameters of the malware detection model by applying convolution functions to the plurality of behavior patterns;

training, by the processor, the malware detection model to detect malicious files using the preferred method for machine learning.

18. The medium of claim 17 , wherein the preferred method is different from a previously selected preferred method that was used to train the malware detection model.

19. The medium of claim 17 , the method further comprising:

applying the selected preferred method for machine learning to a previously created detection model, wherein parameters of the previously created detection model are unable to produce output data with an accuracy higher than a predetermined threshold.

20. The medium of claim 17 , wherein the effectiveness is measured according to a number of errors when using the method for machine learning to detect malicious files based on the behavior patterns.

21. The medium of claim 20 , wherein the behavior patterns are of a particular kind, the particular kind one of: a data structure, a number of elements of the plurality of behavior patterns, performance of the computing device, available resources of the computing device.

22. The medium of claim 17 , the method further comprising:

selecting the method for machine learning according to one or more of: cross testing, mathematical validation of one or more of: Akaike Information Criterion (AIC) and Bayesian Information Criterion (BIC), split testing and stacking.

23. The medium of claim 17 , wherein determining the preferred method comprises:

selecting an artificial neural network as the preferred method when the effectiveness is greater than a random forest as the preferred method, otherwise selecting the random forest as the preferred method;

initializing a method of numerical optimization of parameters of the artificial neural network when the artificial neural network is selected; and

initializing a separating criterion for nodes in the random forest when the random forest is selected.

24. The medium of claim 23 , the instructions further comprising;

selecting the random forest as the method for machine learning when performance of the computing device is below a predetermined threshold, otherwise:

selecting the artificial neural networks as the method for machine learning.