Abstract: The disclosed computer-implemented method for malware remediation may include constructing a malware detection model by (i) identifying multiple candidate hyperparameter sets, (ii) selecting, from the candidate hyperparameter sets, a set of hyperparameters for the malware detection model that optimizes a tradeoff between model efficacy and model size, and (iii) training the malware detection model on a set of training samples to distinguish between malicious samples and clean samples. After constructing the malware detection model, the disclosed computer-implemented method may also include using the constructed malware detection model to perform a security action. Various other methods, systems, and computer-readable media are also disclosed.

Abstract: A method for improving cascade classifier ordering is described. In one embodiment, the method may include determining an efficacy rating of a first current configuration, generating a decreasing sequence of values for a control parameter, and selecting a current value of the control parameter according to the decreasing sequence of values. In some cases, the method may include randomly selecting a first test configuration among the plurality of configurations based at least in part on the current value of the control parameter, analyzing the first test configuration in relation to the first current configuration, and implementing, based at least in part on the analyzing of the first test configuration, the first test configuration in a machine learning classification system of a computing device to improve a data classification accuracy of the computing device.

Abstract: The disclosed computer-implemented method for trichotomous malware classification may include (1) identifying a sample potentially representing malware, (2) selecting a machine learning model trained on a set of samples to distinguish between malware samples and benign samples, (3) analyzing the sample using a plurality of stochastically altered versions of the machine learning model to produce a plurality of classification results, (4) calculating a variance of the plurality of classification results, and (5) classifying the sample based at least in part on the variance of the plurality of classification results. Various other methods, systems, and computer-readable media are also disclosed.

Abstract: The disclosed computer-implemented method for detecting malware based on event dependencies may include (1) applying, to a malware detection system capable of analyzing event dependencies, an event sequence derived from the execution of an application, (2) obtaining, from the malware detection system, a malware confidence score for the event sequence which the malware detection system calculates after a certain event within the event sequence has executed based at least in part on one or more dependencies between the certain event and at least one other event within the event sequence, (3) determining that the malware confidence score exceeds a threshold, and (4) classifying the application as malicious in response to determining that the malware confidence score exceeds the threshold. Various other methods, systems, and computer-readable media are also disclosed.

Abstract: The disclosed computer-implemented method for detecting malware may include (1) identifying a plurality of programs represented in machine code, (2) deriving a plurality of opcode n-grams from opcode sequences within the plurality of programs, (3) training an autoencoder by using the plurality of opcode n-grams as input, (4) discovering a set of features within the autoencoder after training the autoencoder, each feature within the set of features comprising a linear combination of opcode n-grams from the plurality of opcode n-grams, and (5) classifying a potentially malicious program as malicious by using the set of features discovered within the autoencoder to analyze the potentially malicious program. Various other methods, systems, and computer-readable media are also disclosed.