Multi-dimensional malware analysis

1. A computer-implemented method of analyzing a batch of objects, comprising:

bucketizing the batch of objects into a plurality of buckets according to a feature of the objects;

for objects within a batch, performing malware analysis on the objects to assign a malware analysis score, and adjusting the malware analysis score based on the batch; and

performing respective security actions on the objects within the batch, based on the adjusted malware analysis score.

2. The computer-implemented method of claim 1 , wherein the malware analysis is static analysis.

3. The computer-implemented method of claim 1 , wherein the malware analysis is dynamic analysis.

4. The computer-implemented method of claim 1 , wherein bucketizing the batch of objects comprises computing a set of probablistic curves associated with the feature.

5. The computer-implemented method of claim 1 , wherein bucketizing the batch of objects comprises computing bucketized predictions for the objects.

6. The computer-implemented method of claim 1 , wherein the feature is a predicted reputation for an object.

7. The computer-implemented method of claim 1 , wherein the feature is a reputation for a uniform resource locator (URL) or internet protocol (IP) address associated with an object.

8. The computer-implemented method of claim 1 , wherein the feature comprises certificate reputation for an object.

9. The computer-implemented method of claim 1 , wherein adjusting the malware analysis score comprises looking up an adjustment in an adjustment table.

10. The computer-implemented method of claim 9 , wherein the adjustment table is bucketized.

11. The computer-implemented method of claim 9 , wherein looking up the adjustment comprises querying a second computing apparatus.

12. The computer-implemented method of claim 9 , wherein looking up the adjustment comprises querying a cloud service.

13. The computer-implemented method of claim 1 , wherein the malware analysis score is normalized to between 1 and 0.

14. The computer-implemented method of claim 13 , wherein a threshold to detect an object as malware is approximately 0.5.

15. The computer-implemented method of claim 1 , wherein performing respective security action based on the adjusted malware analysis score comprises comparing the adjusted malware analysis score to a malware threshold.

16. One or more tangible, nontransitory computer-readable storage media having stored thereon executable instructions to analyze a batch of object, the instructions to:

bucketize the batch of objects into a plurality of buckets according to a feature of the objects;

for objects within a batch, perform malware analysis on the objects to assign a malware analysis score, and adjust the malware analysis score based on the batch; and

perform respective security actions on the objects within the batch, based on the adjusted malware analysis score.

17. The one or more tangible, nontransitory computer-readable storage media of claim 16 , wherein the malware analysis is static analysis.

18. The one or more tangible, nontransitory computer-readable storage media of claim 16 , wherein the malware analysis is dynamic analysis.

19. A computing apparatus, comprising:

a hardware platform comprising a processor circuit and a memory; and

instructions encoded within the memory to instruct the processor circuit to:

receive a batch of objects;

bucketize the batch of objects into a plurality of buckets according to a feature of the objects;

for objects within a batch, perform malware analysis on the objects to assign a malware analysis score, and adjust the malware analysis score based on the batch; and

perform respective security actions on the objects within the batch, based on the adjusted malware analysis score.

20. The computing apparatus of claim 19 , wherein the malware analysis is static analysis.