Abstract: Some embodiments determine optimal trigger events for executing a malware-detecting artificial intelligence (AI) module by tracking a performance of the respective module over a lifetime of each software sample of a training corpus. Computational costs associated with the respective AI module may be substantially reduced by executing the respective module only sporadically, in response to detecting an occurrence of one of the identified trigger events. In some embodiments, a malware detector employs multiple AI modules, each having its own specific triggers. The choice of triggers may be updated at any time, without affecting other aspects of the malware detector.

Abstract: Described systems and methods allow protecting a computer system from computer security threats such as malware and spyware. In some embodiments, a security application executes a set of detection routines to determine whether a set of monitored entities (processes, threads, etc.) executing on the computer system comprise malicious software. The detection routines are formulated in bytecode and executed within a bytecode translation virtual machine. Execution of a detection routine comprises translating bytecode instructions of the respective routine into native processor instructions, for instance via interpretation or just-in-time compilation. Execution of the respective routines is triggered selectively, due to the occurrence of specific events within the protected client system. Detection routines may output a set of scores, which may be further used by the security application to determine whether a monitored entity is malicious.