Antimalware systems and methods using optimal triggering of artificial intelligence modules
Some embodiments determine optimal trigger events for executing a malware-detecting artificial intelligence (AI) module by tracking a performance of the respective module over a lifetime of each software sample of a training corpus. Computational costs associated with the respective AI module may be substantially reduced by executing the respective module only sporadically, in response to detecting an occurrence of one of the identified trigger events. In some embodiments, a malware detector employs multiple AI modules, each having its own specific triggers. The choice of triggers may be updated at any time, without affecting other aspects of the malware detector.
1. A computer system comprising at least one hardware processor configured to:
determine a trigger event for executing a malware-detecting artificial intelligence (AI) module, wherein determining the trigger event comprises:
determining a plurality of provisional verdicts indicative of whether a training software entity is malicious, each verdict of the plurality of provisional verdicts associated with a distinct event of a plurality of events caused by an execution of the training software entity, and wherein determining each verdict comprises:
updating a feature vector characterizing the training software entity according to the distinct event, and
executing the AI module to determine a respective verdict according to the updated feature vector, and
in response to determining the plurality of provisional verdicts, selecting the trigger event from the plurality of events according to the plurality of provisional verdicts; and
in response to determining the trigger event, configure a malware detector to selectively execute another instance of the AI module in response to an occurrence of the trigger event, to determine whether a target software entity is malicious.
2. The computer system of claim 1 , wherein the at least one hardware processor is further configured to:
determine another trigger event for executing the AI module by selecting the other trigger event from the plurality of events according to the plurality of provisional verdicts; and
configure the malware detector to selectively execute the other instance of the AI module in response to an occurrence of the other trigger event, to determine whether the target software entity is malicious.
3. The computer system of claim 1 , wherein the at least one hardware processor is configured to determine each verdict of the plurality of provisional verdicts according to an order of occurrence of the plurality of events during the execution of the training software entity.
4. The computer system of claim 1 , wherein determining the trigger event further comprises:
determining a malware detection performance of the trigger event over a collection of training software entities, the malware detection performance determined according to another plurality of provisional verdicts, each verdict of the other plurality of provisional verdicts indicating whether a respective entity of the collection is malicious, each verdict of the other plurality of provisional verdicts associated with an occurrence of the trigger event during an execution of the respective entity; and
selecting the trigger event from the plurality of training events further according to the malware detection performance of the trigger event.
5. The computer system of claim 4 , wherein the at least one hardware processor is configured to determine the malware detection performance of the trigger event according to a count of true positive verdicts within the other plurality of provisional verdicts.
6. The computer system of claim 5 , wherein the at least one hardware processor is configured to determine the malware detection performance of the trigger event according to:
2
t
p
2
t
p
+
f
p
+
f
n
,
wherein t p denotes the count of true positive verdicts, f p denotes a count of false positive verdicts, and f n denotes a count of false negative verdicts within the other plurality of provisional verdicts.
7. The computer system of claim 4 , wherein the at least one hardware processor is configured to determine the malware detection performance of the trigger event according to a count of false positive verdicts within the other plurality of provisional verdicts, and further according to a count of false negative verdicts within the other plurality of provisional verdicts.
8. The computer system of claim 1 , wherein configuring the malware detector comprises formulating a specification of the trigger event and transmitting the specification of the trigger event to a client device executing the malware detector.
9. The computer system of claim 8 , wherein the specification of the trigger event further includes a specification of a trigger predicate comprising a condition for executing the other instance of the AI module in response to the occurrence of the trigger event.
10. The computer system of claim 1 , wherein the malware detector comprises a plurality of detection modules including the other instance of the AI module, and wherein selectively executing the other instance of the AI module comprises selecting the other instance of the AI module for execution from the plurality of detection modules in response to the occurrence of the trigger event.
11. A computer security method comprising employing at least one hardware processor of a computer system to:
determine a trigger event for executing a malware-detecting artificial intelligence (AI) module, wherein determining the trigger event comprises:
determining a plurality of provisional verdicts indicative of whether a training software entity is malicious, each verdict of the plurality of provisional verdicts associated with a distinct event of a plurality of events caused by an execution of the training software entity, and wherein determining each verdict comprises:
updating a feature vector characterizing the training software entity according to the distinct event, and
executing the AI module to determine a respective verdict according to the updated feature vector, and
in response to determining the plurality of provisional verdicts, selecting the trigger event from the plurality of events according to the plurality of provisional verdicts; and
in response to determining the trigger event, configure a malware detector to selectively execute another instance of the AI module in response to an occurrence of the trigger event, to determine whether a target software entity is malicious.
12. The method of claim 11 , further comprising employing the at least one hardware processor to:
determine another trigger event for executing the AI module by selecting the other trigger event from the plurality of events according to the plurality of provisional verdicts; and
configure the malware detector to selectively execute the other instance of the AI module in response to an occurrence of the other trigger event, to determine whether the target software entity is malicious.
13. The method of claim 11 , comprising determining each verdict of the plurality of provisional verdicts according to an order of occurrence of the plurality of events during the execution of the training software entity.
14. The method of claim 11 , wherein determining the trigger event further comprises:
determining a malware detection performance of the trigger event over a collection of training software entities, the malware detection performance determined according to another plurality of provisional verdicts, each verdict of the other plurality of provisional verdicts indicating whether a respective entity of the collection is malicious, each verdict of the other plurality of provisional verdicts associated with an occurrence of the trigger event during an execution of the respective entity; and
selecting the trigger event from the plurality of training events further according to the malware detection performance of the trigger event.
15. The method of claim 14 , comprising determining the malware detection performance of the trigger event according to a count of true positive verdicts within the other plurality of provisional verdicts.
16. The method of claim 15 , comprising determining the malware detection performance of the trigger event according to:
2
t
p
2
t
p
+
f
p
+
f
n
,
wherein t p denotes the count of true positive verdicts, f p denotes a count of false positive verdicts, and f n denotes a count of false negative verdicts within the other plurality of provisional verdicts.
17. The method of claim 14 , comprising determining the malware detection performance of the trigger event according to a count of false positive verdicts within the other plurality of provisional verdicts, and further according to a count of false negative verdicts within the other plurality of provisional verdicts.
18. The method of claim 11 , wherein configuring the malware detector comprises formulating a specification of the trigger event and transmitting the specification of the trigger event to a client device executing the malware detector.
19. The method of claim 18 , wherein the specification of the trigger event further includes a specification of a trigger predicate comprising a condition for executing the other instance of the AI module in response to the occurrence of the trigger event.
20. The method of claim 11 , wherein the malware detector comprises a plurality of detection modules including the other instance of the AI module, and wherein selectively executing the other instance of the AI module comprises selecting the other instance of the AI module for execution from the plurality of detection modules in response to the occurrence of the trigger event.
21. A non-transitory computer-readable medium storing instructions which, when executed by at least one hardware processor of a computer system, cause the computer system to:
determine a trigger event for executing a malware-detecting artificial intelligence (AI) module, wherein determining the trigger event comprises:
determining a plurality of provisional verdicts indicative of whether a training software entity is malicious, each verdict of the plurality of provisional verdicts associated with a distinct event of a plurality of events caused by an execution of the training software entity, and wherein determining each verdict comprises:
updating a feature vector characterizing the training software entity according to the distinct event, and
executing the AI module to determine a respective verdict according to the updated feature vector, and
in response to determining the plurality of provisional verdicts, selecting the trigger event from the plurality of events according to the plurality of provisional verdicts; and
in response to determining the trigger event, configure a malware detector to selectively execute another instance of the AI module in response to an occurrence of the trigger event, to determine whether a target software entity is malicious.