Abstract: Systems and methods implement artificial intelligence to automatically generate malware detection rules. In a first phase, an AI model is trained on large amounts of data, so the AI model can learn to distinguish between benign applications and different malware families.

Abstract: Disclosed herein are systems and method for detecting malicious activity using a tuned machine learning model. In one aspect, a method includes receiving a plurality of logs indicative of software behavior from a plurality of endpoint devices and generating a plurality of event sequences from the plurality of logs. The method includes training a global machine learning model using the plurality of event sequences to predict resultant events for a sequence of lead up events and classify whether the resultant events indicate malicious activity. The method includes, for each respective endpoint device of the plurality of endpoint devices, generating a testing dataset comprising a plurality of benign event sequences that occurred on the respective endpoint device. The method includes generating a tuned machine learning model for the respective endpoint device by retraining the global machine learning model using the testing dataset. The method includes executing the tuned machine learning model.

Abstract: Systems and methods for detecting malicious activity on an endpoint, the endpoint having executing processes, including tracking behavior of executing processes, generating a provenance graph to group the behavior events, transforming the provenance graph into a sequence of behavior events, training a sequence classification machine learning model based on the sequence of behavior events, processing a sequence of test behavior events using the sequence classification machine learning model to generate a probability of maliciousness, and alerting for malicious activity when the probability of maliciousness for the sequence of test behavior events is greater than a threshold.