Abstract: An exemplary system and method are disclosed for detecting malware via an antimalware application employing adversarial machine learning such as generative adversarial machine learning and the training and/or configuring of such systems. The exemplary system and method are configured with two or more generative adversarial networks (GANs), including (i) a first generative adversarial network (GAN) that can be configured using a library of malware code or non-malware code and (ii) a second generative adversarial network (GAN) that operates in conjunction with the first generative adversarial network (GAN) in which the second generative adversarial network is configured using a library of non-malware code.

Abstract: A method including receiving, by a user device, harmful patterns indicating characteristics of harmful traits included in affected data known to include malicious content and clean patterns indicating characteristics of clean traits included in clean data known to be free of the malicious content; determining, by the user device, a pattern associated with traits included in given data; and determining, by the user device, whether the given data includes the malicious content based at least in part on comparing the determined pattern with the harmful patterns and the clean patterns. Various other aspects are contemplated.

Abstract: A method including determining, by an infrastructure device, harmful patterns indicating characteristics of harmful traits included in affected data known to include harmful content, and clean patterns indicating characteristics of clean traits included in clean data known to be free of the harmful content; training, by the infrastructure device, a machine learning model to indicate presence of the harmful content based at least in part on utilizing the harmful patterns and the clean patterns; transmitting, by the infrastructure device to a user device, the harmful patterns, the clean patterns, and the machine learning model; and determining, by the user device, whether given data includes the harmful content based at least in part on utilizing the harmful patterns, the clean patterns, and the machine learning model. Various other aspects are contemplated.

Abstract: A method including determining, by an infrastructure device, harmful patterns indicating characteristics of harmful traits included in affected data known to include harmful content, and clean patterns indicating characteristics of clean traits included in clean data known to be free of the harmful content; training, by the infrastructure device, a machine learning model to indicate presence of the harmful content based at least in part on utilizing the harmful patterns and the clean patterns; transmitting, by the infrastructure device to a user device, the harmful patterns, the clean patterns, and the machine learning model; and determining, by the user device, whether given data includes the harmful content based at least in part on utilizing the harmful patterns, the clean patterns, and the machine learning model. Various other aspects are contemplated.

Abstract: Systems and methods to intelligently optimize data collection requests are disclosed. In one embodiment, systems are configured to identify and select a complete set of suitable parameters to execute the data collection requests. In another embodiment, systems are configured to identify and select a partial set of suitable parameters to execute the data collection requests. The present embodiments can implement machine learning algorithms to identify and select the suitable parameters according to the nature of the data collection requests and the targets. Moreover, the embodiments provide systems and methods to generate feedback data based upon the effectiveness of the data collection parameters. Furthermore, the embodiments provide systems and methods to score the set of suitable parameters based on the feedback data and the overall cost, which are then stored in an internal database.

Abstract: Systems and methods for optimal load distribution and data processing of a plurality of files in anti-malware solutions are provided herein. In some embodiments, the system includes: a plurality of node processors; a control processor programmed to: receiving a plurality of files used for malware analysis and training of anti-malware ML models; separating the plurality of files into a plurality of subsets of files based on byte size of each of the files, such that processing of each subset of files produces similar workloads amongst all available node processors; distributing the plurality of subsets of files amongst all available node processors such that each node processor processes its respective subset of files in parallel and within a similar timeframe as the other node processors; and receiving, by the control processor, a report of performance and/or anti-malware processing results of the subset of files performed from each node processor.

Abstract: Systems and methods for computer security are provided by a processor programmed to: receive an Internet file and produce a hash of the Internet file; compare the hash to external malware databases and external antiviral databases for a file match to determine the Internet file's status that is based upon a weighted consensus algorithm derived from the external malware databases and the external antiviral databases; check if the Internet file's status determination matches the internal software database Internet file's status and update the internal software database based upon the Internet file's status determination if a threshold for the weighted consensus algorithm is exceeded; and train a machine learning algorithm using the Internet file's status determination to create a labeled data set based upon the Internet file's status determination, and provide a report via the input/output device based upon the Internet file's status determination.

Abstract: An exemplary system and method are disclosed for detecting malware via an antimalware application employing adversarial machine learning such as generative adversarial machine learning and the training and/or configuring of such systems. The exemplary system and method are configured with two or more generative adversarial networks (GANs), including (i) a first generative adversarial network (GAN) that can be configured using a library of malware code or non-malware code and (ii) a second generative adversarial network (GAN) that operates in conjunction with the first generative adversarial network (GAN) in which the second generative adversarial network is configured using a library of non-malware code.

Abstract: An exemplary system and method are disclosed for detecting malware via an antimalware application employing adversarial machine learning such as generative adversarial machine learning and the training and/or configuring of such systems. The exemplary system and method are configured with two or more generative adversarial networks (GANs), including (i) a first generative adversarial network (GAN) that can be configured using a library of malware code or non-malware code and (ii) a second generative adversarial network (GAN) that operates in conjunction with the first generative adversarial network (GAN) in which the second generative adversarial network is configured using a library of non-malware code.

Abstract: A method, apparatus and system for data augmentation include receiving a first plurality of binary files each having a first binary structure and including one or more known files containing malicious content and one or more known files not containing malicious content, altering a source code of each of the first plurality of binary files to produce a second plurality of binary files each having a second binary structure that is different from the first binary structure, wherein each altered binary file is functionality similar to the corresponding file in the first plurality of binary files from which it was produced, using the first and second plurality of binary files to train the AM machine learning model to distinguish between binary files containing malicious content and binary files not containing malicious content, and applying the trained AM machine learning model to identify unknown binary files containing malicious content.

Abstract: An exemplary system and method are disclosed for detecting malware via an antimalware application employing adversarial machine learning such as generative adversarial machine learning and the training and/or configuring of such systems. The exemplary system and method are configured with two or more generative adversarial networks (GANs), including (i) a first generative adversarial network (GAN) that can be configured using a library of malware code or non-malware code and (ii) a second generative adversarial network (GAN) that operates in conjunction with the first generative adversarial network (GAN) in which the second generative adversarial network is configured using a library of non-malware code.

Abstract: A method including receiving, by a user device, harmful patterns indicating characteristics of harmful traits included in affected data known to include malicious content and clean patterns indicating characteristics of clean traits included in clean data known to be free of the malicious content; receiving, by the user device, a first portion of given data; determining, by the user device, a pattern associated with traits included in the first portion of the given data; determining, by the user device, whether the first portion of the given data includes the malicious content based at least in part on comparing the determined pattern with the harmful patterns and the clean patterns; and selectively receiving, by the user device, a second portion of the given data based at least in part on determining whether the first portion of the given data includes the malicious content is disclosed. Various other aspects are contemplated.

Abstract: A malware detection method that uses federated learning includes transmitting file characterization information for one or more local files, receiving a first malware detection model and labeled training data that is generated by a remote device, training the first malware detection model using the labeled training data set, transmitting parameters of the trained first malware detection model to the remote device, and receiving, from the remote device, a second malware detection model, wherein the second malware detection model is trained by federated learning using the parameters of the trained first malware detection model and additional parameters provided by one or more additional remote devices.

Abstract: A system for detecting malware includes a server and processor that executes instructions to receive, from the server, a first malware detection model and a database of known malicious files; label each file of a training data set as either malicious or clean by comparing each file of the training data set to the database, where if a match is not found to in the database, the model is used to predict maliciousness; train the first malware detection model using the labeled training data set; transmit parameters of the trained first malware detection model to the server; and receive, from the server, a second malware detection model, wherein the second malware detection model is trained by federated learning using the parameters of the trained first malware detection model and additional parameters provided by one or more remote devices.

Abstract: Systems and methods for computer security are provided by a processor programmed to: receive an Internet file and produce a cryptographic hash of the Internet file; compare the cryptographic hash to external malware databases and external antiviral databases for a malicious file match to determine the Internet file's status that is based upon a weighted consensus algorithm derived from the external malware databases and the external antiviral databases; check if the Internet file's status determination matches the internal malicious software database Internet file's status and update the internal malicious software database based upon the Internet file's status determination if a threshold for the weighted consensus algorithm is exceeded; and train a machine learning algorithm using the Internet file's status determination to create a labelled data set based upon the Internet file's status determination, and provide a report via the input/output device based upon the Internet file's status determination.

Abstract: Systems and methods for computer security are provided by a processor programmed to: receive an Internet file and produce a cryptographic hash of the Internet file; compare the cryptographic hash to external malware databases and external antiviral databases for a malicious file match to determine the Internet file's status that is based upon a weighted consensus algorithm derived from the external malware databases and the external antiviral databases; check if the Internet file's status determination matches the internal malicious software database Internet file's status and update the internal malicious software database based upon the Internet file's status determination if a threshold for the weighted consensus algorithm is exceeded; and train a machine learning algorithm using the Internet file's status determination to create a labelled data set based upon the Internet file's status determination, and provide a report via the input/output device based upon the Internet file's status determination.

Abstract: Systems and methods for malware detection are provided herein. In some embodiments, a system having one or more processors is configured to: perform, on a plurality of user devices, at least one of a static analysis or a behavioral analysis of a file downloaded to a user device; receive a plurality of features extracted from the downloaded file; train at least one machine learning model, on a central server in communication with the plurality of user device, based on the plurality of features; distribute the at least one trained machine learning model to the plurality of user devices; and update at least one of a machine learning model used for the static analysis or behavioral analysis with the distributed at least one trained machine learning model.

Abstract: Systems and methods for malware filtering are provided herein. In some embodiments, a system having one or more processors is configured to: retrieve a file downloaded to a user device; break the downloaded file into a plurality of chunks; scan the plurality of chunks to identify potentially malicious chunks; predict whether the downloaded file is malicious based on the scan of the plurality of chunks; and determine whether the downloaded file is malicious based on the prediction.

Abstract: Systems and methods to intelligently optimize data collection requests are disclosed. In one embodiment, systems are configured to identify and select a complete set of suitable parameters to execute the data collection requests. In another embodiment, systems are configured to identify and select a partial set of suitable parameters to execute the data collection requests. The present embodiments can implement machine learning algorithms to identify and select the suitable parameters according to the nature of the data collection requests and the targets. Moreover, the embodiments provide systems and methods to generate feedback data based upon the effectiveness of the data collection parameters. Furthermore, the embodiments provide systems and methods to score the set of suitable parameters based on the feedback data and the overall cost, which are then stored in an internal database.

Abstract: A malware detection method that uses federated learning includes receiving a first malware detection model and a database of known malicious files, labeling each file of a training data set as either malicious or clean by comparing each file of the training data set to the database, where a match causes the file to be labeled as malicious. If a match cannot be found, the file is evaluated using the first malware detection model to predict maliciousness and the file is labeled based on the prediction. The method further includes training the first malware detection model using the labeled training data set; transmitting parameters of the trained first malware detection model to the remote device; and receiving a second malware detection model that is trained by federated learning using the parameters of the trained first malware detection model and additional parameters provided by one or more additional remote devices.