Using artificial intelligence models with intermediate representations to analyze malicious files
The present disclosure provides an approach of analyzing multiple modalities of a file to produce multiple analysis tokens. Each one of the analysis tokens corresponds to a respective modality of the file. The approach provides the multiple analysis tokens to an artificial intelligence model, which is trained to produce an intermediate representation vector based on the plurality of analysis tokens. In turn the approach uses the artificial intelligence model to produce, based on the intermediate representation vector, a classification that indicates whether the file corresponds to a cybersecurity threat.
1 . A method comprising:
analyzing a plurality of modalities of a file to produce a plurality of analysis tokens, wherein each one of the plurality of analysis tokens corresponds to a respective modality of the plurality of modalities of the file, wherein one of the plurality of modalities corresponds to decompiled binary and source code (DBSC) obtained by decompiling an executable macro embedded in the file;
providing the plurality of analysis tokens to an artificial intelligence model, wherein the artificial intelligence model is trained to produce an intermediate representation vector based on the plurality of analysis tokens; and
producing, by a processing device using the artificial intelligence model, a classification of the file based on the intermediate representation vector, wherein the classification indicates whether the file corresponds to a cybersecurity threat.
2 . The method of claim 1 , wherein each of the plurality of modalities corresponds to a different type of data, and wherein analyzing the plurality of modalities further comprises:
performing a plurality of parsings on the file to produce a plurality of views, wherein each one of the plurality of parsings is based on a respective modality of the plurality of modalities of the file; and
generating the plurality of analysis tokens from the plurality of views.
3 . The method of claim 2 , wherein each one of the plurality of analysis tokens provided to the artificial intelligence model is a numerical representation of its respective view of the plurality of views.
4 . The method of claim 1 , further comprising:
opening the file;
identifying one or more behaviors in response to opening the file;
parsing the one or more behaviors to produce a behavior view; and
generating behavior tokens based on the behavior view, wherein the plurality of analysis tokens comprise the behavior tokens.
5 . The method of claim 1 , wherein the artificial intelligence model comprises an intermediate representation layer, the method further comprising:
applying, by the intermediate representation layer, a numerical operation to the plurality of analysis tokens to produce the intermediate representation vector, wherein the numerical operation is based on a multi-modal matrix trained on different types of training tokens that correspond to the plurality of modalities of the file.
6 . The method of claim 5 , further comprising:
training the artificial intelligence model, wherein the training further comprises:
generating, based on a training file, first training tokens and second training tokens, wherein the first training tokens and the second training tokens correspond to first modality and a second modality of the training file;
pre-training the artificial intelligence model using the first training tokens and the second training tokens to produce a pretrained artificial intelligence model;
generating, based on the training file, third training tokens corresponding to a third modality of the training file; and
training the pre-trained artificial intelligence model using the third training tokens.
7 . The method of claim 1 , further comprising:
assigning a file category to the file based on the intermediate representation vector, wherein the intermediate representation vector is a compressed representation of the file;
determining a file group that corresponds to the file category; and
storing the file in the file group.
8 . A system comprising:
a processing device; and
a memory to store instructions that, when executed by the processing device cause the processing device to:
analyze a plurality of modalities of a file to produce a plurality of analysis tokens, wherein each one of the plurality of analysis tokens corresponds to a respective modality of the plurality of modalities of the file, wherein one of the plurality of modalities corresponds to decompiled binary and source code (DBSC) obtained by decompiling an executable macro embedded in the file;
provide the plurality of analysis tokens to an artificial intelligence model, wherein the artificial intelligence model is trained to produce an intermediate representation vector based on the plurality of analysis tokens; and
produce, using the artificial intelligence model, a classification of the file based on the intermediate representation vector, wherein the classification indicates whether the file corresponds to a cybersecurity threat.
9 . The system of claim 8 , wherein each of the plurality of modalities corresponds to a different type of data, and wherein the processing device, responsive to executing the instructions, further causes the system to:
perform a plurality of parsings on the file to produce a plurality of views, wherein each one of the plurality of parsings is based on a respective modality of the plurality of modalities of the file; and
generate the plurality of analysis tokens from the plurality of views.
10 . The system of claim 9 , wherein each one of the plurality of analysis tokens provided to the artificial intelligence model is a numerical representation of its respective view of the plurality of views.
11 . The system of claim 8 , wherein the processing device, responsive to executing the instructions, further causes the system to:
open the file;
identify one or more behaviors in response to opening the file;
parse the one or more behaviors to produce a behavior view; and
generate behavior tokens based on the behavior view, wherein the plurality of analysis tokens comprise the behavior tokens.
12 . The system of claim 8 , wherein the artificial intelligence model comprises an intermediate representation layer, and wherein the processing device, responsive to executing the instructions, further causes the system to:
apply, by the intermediate representation layer, a numerical operation to the plurality of analysis tokens to produce the intermediate representation vector, wherein the numerical operation is based on a multi-modal matrix trained on different types of training tokens that correspond to the plurality of modalities of the file.
13 . The system of claim 12 , wherein the processing device, responsive to executing the instructions, further causes the system to:
generate, based on a training file, first training tokens and second training tokens, wherein the first training tokens and the second training tokens correspond to first modality and a second modality of the training file;
pre-train the artificial intelligence model using the first training tokens and the second training tokens to produce a pretrained artificial intelligence model;
generate, based on the training file, third training tokens corresponding to a third modality of the training file; and
train the pre-trained artificial intelligence model using the third training tokens.
14 . The system of claim 8 , wherein the processing device, responsive to executing the instructions, further causes the system to:
assign a file category to the file based on the intermediate representation vector, wherein the intermediate representation vector is a compressed representation of the file;
determine a file group that corresponds to the file category; and
storing the file in the file group.
15 . A non-transitory computer readable medium, having instructions stored thereon which, when executed by a processing device, cause the processing device to:
analyze a plurality of modalities of a file to produce a plurality of analysis tokens, wherein each one of the plurality of analysis tokens corresponds to a respective modality of the plurality of modalities of the file, wherein one of the plurality of modalities corresponds to decompiled binary and source code (DBSC) obtained by decompiling an executable macro embedded in the file;
provide the plurality of analysis tokens to an artificial intelligence model, wherein the artificial intelligence model is trained to produce an intermediate representation vector based on the plurality of analysis tokens; and
produce, by the processing device using the artificial intelligence model, a classification of the file based on the intermediate representation vector, wherein the classification indicates whether the file corresponds to a cybersecurity threat.
16 . The non-transitory computer readable medium of claim 15 , wherein each of the plurality of modalities corresponds to a different type of data, and wherein the processing device is to:
perform a plurality of parsings on the file to produce a plurality of views, wherein each one of the plurality of parsings is based on a respective modality of the plurality of modalities of the file; and
generate the plurality of analysis tokens from the plurality of views.
17 . The non-transitory computer readable medium of claim 16 , wherein each one of the plurality of analysis tokens provided to the artificial intelligence model is a numerical representation of its respective view of the plurality of views.
18 . The non-transitory computer readable medium of claim 15 , wherein the processing device is to:
open the file;
identify one or more behaviors in response to opening the file;
parse the one or more behaviors to produce a behavior view; and
generate behavior tokens based on the behavior view, wherein the plurality of analysis tokens comprise the behavior tokens.
19 . The non-transitory computer readable medium of claim 15 , wherein the artificial intelligence model comprises an intermediate representation layer, and wherein the processing device is to:
apply, by the intermediate representation layer, a numerical operation to the plurality of analysis tokens to produce the intermediate representation vector, wherein the numerical operation is based on a multi-modal matrix trained on different types of training tokens that correspond to the plurality of modalities of the file.
20 . The non-transitory computer readable medium of claim 19 , wherein the processing device is to:
generate, based on a training file, first training tokens and second training tokens, wherein the first training tokens and the second training tokens correspond to first modality and a second modality of the training file;
pre-train the artificial intelligence model using the first training tokens and the second training tokens to produce a pretrained artificial intelligence model;
generate, based on the training file, third training tokens corresponding to a third modality of the training file; and
train the pre-trained artificial intelligence model using the third training tokens.