Abstract: Methods and systems are disclosed for training a malicious webpages detector for detecting malicious webpages, based on a training set comprising a plurality of samples representing malicious and non-malicious webpages. Text content can be extracted from the source code of each sample, and/or non-text content can be extracted from each sample, in order to train respectively at least a first deep learning neural network and a second deep learning neural network of the malicious webpages detector. A malicious webpages detector can detect whether or not a webpage is malicious, by extracting text content from the source code of the webpage, and/or non-text content from the webpage, thereafter providing prospects that the webpage is malicious based on the extracted data.

Abstract: According to some embodiments, a method for training a malware detector comprising a deep learning algorithm is described, which comprises converting a set of malware files and non malware files into vectors by using a feature based dictionary, and/or by using a conversion into an image, and providing prospects that the files constitute malware. Various features and combinations of features are described to build a feature based dictionary and adapt its size. According to some embodiments, a method for detecting a malware by using a malware detector comprising a deep learning algorithm is described, which comprises converting a file into a vector by using a feature based dictionary, and/or by using a conversion into an image, and providing prospects that the file constitutes malware. Methods for providing a plurality of prospects and aggregating these prospects are provided. Additional methods and systems in the field of malware detection are also described.

Abstract: A method of analyzing data exchange of at least one device includes feeding a plurality of data exchanged by the at least one device to a system for data exchange analysis that includes a deep learning algorithm. The deep learning algorithm includes at least an input layer, an output layer of the same size as the input layer, and hidden layers. Neurons of the hidden layers receive recurrently, at each time t, only a subset of the data exchanged by the at least one device up to time t, the subset of data comprising current data from time t and only a fraction of past data from time tpast to time t, with tpast<t. The method includes attempting to reconstruct, at the output layer, at each time t, data received at the input layer. The reconstructed data is compared with at least part of the plurality of data. In indication is provided on one or more anomalies in the data, based on at least the comparison.

Abstract: According to some embodiments, a method for training a malware detector comprising a deep learning algorithm is described, which comprises converting a set of malware files and non malware files into vectors by using a feature based dictionary, and/or by using a conversion into an image, and providing prospects that the files constitute malware. Various features and combinations of features are described to build a feature based dictionary and adapt its size. According to some embodiments, a method for detecting a malware by using a malware detector comprising a deep learning algorithm is described, which comprises converting a file into a vector by using a feature based dictionary, and/or by using a conversion into an image, and providing prospects that the file constitutes malware. Methods for providing a plurality of prospects and aggregating these prospects are provided. Additional methods and systems in the field of malware detection are also described.