Abstract: In some embodiments, a behavior classifier comprises a set of neural networks trained to determine whether a monitored software entity is malicious according to a sequence of computing events caused by the execution of the respective entity. When the behavior classifier indicates that the entity is malicious, some embodiments execute a memory classifier comprising another set of neural networks trained to determine whether the monitored entity is malicious according to a memory snapshot of the monitored entity. Applying the classifiers in sequence may substantially reduce the false positive detection rate, while reducing computational costs.

Abstract: Some embodiments employ a consensus-building procedure to train a multitask graph comprising a plurality of nodes interconnected by a plurality of edges, wherein each node is associated with a task of determining a set of node-specific attributes of a set of input data, and each edge comprises an AI module (e.g., neural network) configured to determine attributes of an end node according to attributes of a start node of the respective edge. Training fosters consensus between all edges converging to a node. The trained multitask graph may then be deployed in a threat detector configured to determine whether an input set of data is indicative of malice (e.g., malware, intrusion, online threat, etc.).

Abstract: In some embodiments, a behavior classifier comprises a set of neural networks trained to determine whether a monitored software entity is malicious according to a sequence of computing events caused by the execution of the respective entity. When the behavior classifier indicates that the entity is malicious, some embodiments execute a memory classifier comprising another set of neural networks trained to determine whether the monitored entity is malicious according to a memory snapshot of the monitored entity. Applying the classifiers in sequence may substantially reduce the false positive detection rate, while reducing computational costs.