Abstract: A method of determining a category of a malware file, using a malware determination system comprising a machine learning algorithm, the method comprising obtaining a file, which is assumed to constitute malware file, by the malware determination system, building a data structure representative of features present in said file, based on features present in at least one dictionary, wherein said dictionary stores at least, for each of one or more of categories Ci out of a plurality of N categories of malware files, with i from 1 to N and N>2, one or more features which are specific to said category Ci with respect to all other N?1 categories Cj, with j different from i, according to at least one first specificity criteria, feeding the data structure to the machine learning algorithm of the malware determination system, and providing prospects representative of one or more malware categories to which said file belongs, based on said data structure.

Abstract: Methods and systems are disclosed for training a malicious webpages detector for detecting malicious webpages, based on a training set comprising a plurality of samples representing malicious and non-malicious webpages. Text content can be extracted from the source code of each sample, and/or non-text content can be extracted from each sample, in order to train respectively at least a first deep learning neural network and a second deep learning neural network of the malicious webpages detector. A malicious webpages detector can detect whether or not a webpage is malicious, by extracting text content from the source code of the webpage, and/or non-text content from the webpage, thereafter providing prospects that the webpage is malicious based on the extracted data.

Abstract: Methods and systems are disclosed for training a malicious webpages detector for detecting malicious webpages, based on a training set comprising a plurality of samples representing malicious and non-malicious webpages. Text content can be extracted from the source code of each sample, and/or non-text content can be extracted from each sample, in order to train respectively at least a first deep learning neural network and a second deep learning neural network of the malicious webpages detector. A malicious webpages detector can detect whether or not a webpage is malicious, by extracting text content from the source code of the webpage, and/or non-text content from the webpage, thereafter providing prospects that the webpage is malicious based on the extracted data.

Abstract: According to some embodiments, a method for training a malware detector comprising a deep learning algorithm is described, which comprises converting a set of malware files and non malware files into vectors by using a feature based dictionary, and/or by using a conversion into an image, and providing prospects that the files constitute malware. Various features and combinations of features are described to build a feature based dictionary and adapt its size. According to some embodiments, a method for detecting a malware by using a malware detector comprising a deep learning algorithm is described, which comprises converting a file into a vector by using a feature based dictionary, and/or by using a conversion into an image, and providing prospects that the file constitutes malware. Methods for providing a plurality of prospects and aggregating these prospects are provided. Additional methods and systems in the field of malware detection are also described.

Abstract: A method of analyzing data exchange of at least one device includes feeding a plurality of data exchanged by the at least one device to a system for data exchange analysis that includes a deep learning algorithm. The deep learning algorithm includes at least an input layer, an output layer of the same size as the input layer, and hidden layers. Neurons of the hidden layers receive recurrently, at each time t, only a subset of the data exchanged by the at least one device up to time t, the subset of data comprising current data from time t and only a fraction of past data from time tpast to time t, with tpast<t. The method includes attempting to reconstruct, at the output layer, at each time t, data received at the input layer. The reconstructed data is compared with at least part of the plurality of data. In indication is provided on one or more anomalies in the data, based on at least the comparison.

Abstract: A method of determining a category of a malware file, using a malware determination system comprising a machine learning algorithm, the method comprising obtaining a file, which is assumed to constitute malware file, by the malware determination system, building a data structure representative of features present in said file, based on features present in at least one dictionary, wherein said dictionary stores at least, for each of one or more of categories Ci out of a plurality of N categories of malware files, with i from 1 to N and N>2, one or more features which are specific to said category Ci with respect to all other N?1 categories Cj, with j different from i, according to at least one first specificity criteria, feeding the data structure to the machine learning algorithm of the malware determination system, and providing prospects representative of one or more malware categories to which said file belongs, based on said data structure.

Abstract: According to some embodiments, a method for training a malware detector comprising a deep learning algorithm is described, which comprises converting a set of malware files and non malware files into vectors by using a feature based dictionary, and/or by using a conversion into an image, and providing prospects that the files constitute malware. Various features and combinations of features are described to build a feature based dictionary and adapt its size. According to some embodiments, a method for detecting a malware by using a malware detector comprising a deep learning algorithm is described, which comprises converting a file into a vector by using a feature based dictionary, and/or by using a conversion into an image, and providing prospects that the file constitutes malware. Methods for providing a plurality of prospects and aggregating these prospects are provided. Additional methods and systems in the field of malware detection are also described.

Abstract: According to some embodiments, a method for training a malware detector comprising a deep learning algorithm is described, which comprises converting a set of malware files and non malware files into vectors by using a feature based dictionary, and/or by using a conversion into an image, and providing prospects that the files constitute malware. Various features and combinations of features are described to build a feature based dictionary and adapt its size. According to some embodiments, a method for detecting a malware by using a malware detector comprising a deep learning algorithm is described, which comprises converting a file into a vector by using a feature based dictionary, and/or by using a conversion into an image, and providing prospects that the file constitutes malware. Methods for providing a plurality of prospects and aggregating these prospects are provided. Additional methods and systems in the field of malware detection are also described.

Abstract: Methods and systems are disclosed for training a malicious webpages detector for detecting malicious webpages, based on a training set comprising a plurality of samples representing malicious and non-malicious webpages. Text content can be extracted from the source code of each sample, and/or non-text content can be extracted from each sample, in order to train respectively at least a first deep learning neural network and a second deep learning neural network of the malicious webpages detector. A malicious webpages detector can detect whether or not a webpage is malicious, by extracting text content from the source code of the webpage, and/or non-text content from the webpage, thereafter providing prospects that the webpage is malicious based on the extracted data.

Abstract: According to some embodiments, there is provided a method of querying data in a data structure comprising a plurality of databases, at least a first database of the plurality of databases having a different structure than a second database of the plurality of databases. This method can involve the construction of one or more sub-queries and the use of at least a routing table for directing the sub-queries towards the database. According to some embodiments, the routing table is dynamic. According to some embodiments, there is provided a method of inserting data into the data structure, the method comprising updating the routing table based on the insertion of data. Various other methods and systems of querying and inserting data are described.

Abstract: According to some embodiments, a method for training a system for data traffic analysis is described, the system comprising a deep learning algorithm, wherein the deep learning algorithm comprises a prediction model which is trained to take into account the history of data. According to some embodiments, the deep learning algorithm is operated on a graphical processing unit. According to some embodiments, the system for data traffic analysis is configured to detect anomalies in the data, based also on past data. According to some embodiments, the system for data traffic analysis is configured to simultaneously detect anomalies in the data and update its prediction model. Additional methods and systems in the field of data traffic analysis are also described. According to some embodiments, data of a car are analyzed in order to detect anomalies.