Dimensionality reduction of computer programs

1. A computer-implemented method, comprising:

determining a sketch matrix that approximates a matrix representative of a reference dataset, the reference dataset including at least one computer program having a predetermined classification;

determining, based on the sketch matrix, an orthonormal approximation of a range of the reference dataset;

determining, based on the determined orthonormal approximation of the range of the reference dataset, an approximation of an intermediate dimensional feature space occupied by the reference dataset;

determining, based on the intermediate dimensional feature space, an approximation of a basis of a feature space occupied by the reference dataset;

generating, based on the basis of the feature space occupied by the reference dataset a reduced dimension representation of the reference dataset, the reduced dimension representation having a fewer quantity of features than the reference dataset; and

classifying, based at least on the reduced dimension representation, a target computer program to determine whether the target computer program is malicious.

2. The computer-implemented method of claim 1 , wherein the sketch matrix is determined by at least applying, to the matrix representative of the reference dataset, a sketch operator.

3. The computer-implemented method of claim 2 , wherein the sketch operator comprises multiplying the matrix representative of the reference dataset with a random projection matrix, the random projection matrix being populated with one or more values selected from a normal distribution of values.

4. The computer-implemented method of claim 2 , wherein the sketch operator implements a feature hashing function.

5. The computer-implemented method of claim 2 , wherein the sketch operator implements a Monte Carlo sampling function.

6. The computer-implemented method of claim 5 , wherein the determining of the sketch matrix comprises:

loading, into a main memory, a first portion of the matrix representative of the reference dataset;

computing a partial product of the other matrix and the matrix representative of the reference dataset before loading, into the main memory, a second portion of the matrix representative of the reference dataset.

7. The computer-implemented method of claim 6 , wherein at least some of the features in reference dataset are merged to generate the reduced dimension representation of the reference dataset.

8. The computer-implemented method of claim 7 , wherein the classifying of the target computer program comprises determining, based on the reduced dimension representation of the reference dataset, a measure of similarity between the target computer program and the reference dataset.

9. The computer-implemented method of claim 8 , wherein the classifying of the target computer program comprises determining, based on the measure of similarity, whether the target computer program should be assigned a same classification as the one or more computer programs in the reference dataset.

10. The computer-implemented method of claim 9 , wherein the predetermined classification comprises malicious, benign, a family of malware, and/or a type of malware.

11. The computer-implemented method of claim 10 , wherein the features in the reference dataset include a file path, a file size, a file type, an instruction sequence, a character string, a binary string, a code complexity measurement, an anomalous behavior, a deceptive behavior, a destructive behavior, a data loss capability, and/or a data collection capability.

12. A system, comprising:

at least one data processor; and

at least one memory storing instructions which, when executed by the at least one data processor, result in operations comprising:

determining a sketch matrix that approximates a matrix representative of a reference dataset, the reference dataset including at least one computer program having a predetermined classification;

determining, based on the sketch matrix, an orthonormal approximation of a range of the reference dataset;

determining, based on the determined orthonormal approximation of the range of the reference dataset, an approximation of an intermediate dimensional feature space occupied by the reference dataset;

determining, based on the intermediate dimensional feature space, an approximation of a basis of a feature space occupied by the reference dataset;

generating, based on the basis of the feature space occupied by the reference dataset a reduced dimension representation of the reference dataset, the reduced dimension representation having a fewer quantity of features than the reference dataset; and

classifying, based at least on the reduced dimension representation, a target computer program to determine whether the target computer program is malicious.

13. A method for implementation by one or more computers comprising:

receiving data characterizing a target computer program;

classifying, based at least on a reduced dimension representation, the target computer program to determine whether the target computer program is malicious;

preventing execution or access of the target computer program based on a determination that the target computer program is malicious; or

allowing execution or access of the target computer program based on a determination that the target computer program is not malicious;

wherein the reduced dimension representation is generated by:

determining a sketch matrix that approximates a matrix representative of a reference dataset, the reference dataset characterizing a plurality of computer programs having a predetermined classification indicating whether each such computer program is malicious or benign; and

determining, based on the sketch matrix, an orthonormal approximation of a range of the reference dataset;

determining, based on the determined orthonormal approximation of the range of the reference dataset, an approximation of an intermediate dimensional feature space occupied by the reference dataset;

determining, based on the intermediate dimensional feature space, an approximation of a basis of a feature space occupied by the reference dataset; and

generating, based on the basis of the feature space occupied by the reference dataset a reduced dimension representation of the reference dataset, the reduced dimension representation having a fewer quantity of features than the reference dataset.

14. The computer-implemented method of claim 13 , wherein the sketch matrix is determined by at least applying, to the matrix representative of the reference dataset, a sketch operator.

15. The computer-implemented method of claim 14 , wherein the sketch operator comprises multiplying the matrix representative of the reference dataset with a random projection matrix, the random projection matrix being populated with one or more values selected from a normal distribution of values.

16. The computer-implemented method of claim 14 , wherein the sketch operator implements a feature hashing function.

17. The computer-implemented method of claim 14 , wherein the sketch operator implements a Monte Carlo sampling function.

18. The computer-implemented method of claim 17 , wherein the determining of the sketch matrix comprises:

loading, into a main memory, a first portion of the matrix representative of the reference dataset;

computing a partial product of the other matrix and the matrix representative of the reference dataset before loading, into the main memory, a second portion of the matrix representative of the reference dataset.

19. The computer-implemented method of claim 13 , wherein the predetermined classification comprises malicious, benign, a family of malware, and/or a type of malware.

20. The computer-implemented method of claim 19 , wherein features in the reference dataset include a file path, a file size, a file type, an instruction sequence, a character string, a binary string, a code complexity measurement, an anomalous behavior, a deceptive behavior, a destructive behavior, a data loss capability, and/or a data collection capability.