Abstract: The disclosed computer-implemented method for executing decision trees may include (i) executing a security classification decision tree that classifies an input data item, (ii) gathering, simultaneously using a gather instruction, values for both a current threshold at a parent node of the security classification decision tree and a subsequent threshold at a child node of the parent node, (iii) gathering, simultaneously using the gather instruction, values for both a current measurement at the parent node and a subsequent measurement at the child node, (iv) comparing, simultaneously using a comparison instruction, the current threshold at the parent node with the current measurement at the parent node and the subsequent threshold at the child node with the subsequent measurement at the child node, and (v) performing a security action to protect the computing device. Various other methods, systems, and computer-readable media are also disclosed.

Abstract: Methods and systems are provided for detecting malware. One example method generally includes receiving a reference dataset comprising an aggregation of probability distributions of a plurality of intra-file patterns for a plurality of files of at least a first class and applying a logical query to the reference dataset to generate a template distribution with probability distributions of the plurality of intra-file patterns calculated according to one or more logical operators in the logical query. The method further includes detecting a likely presence of malware in a computer file by indicating one or more areas in the computer file based on at least a portion of the calculated probability distributions of the plurality of intra-file patterns in the template distribution.

Abstract: The disclosed computer-implemented method for improving performance of cascade classifiers for protecting against computer malware may include receiving a training dataset usable to train a cascade classifier of a machine-learning classification system. A sample to add to the training dataset may be received. A weight for the sample may be calculated. The training dataset may be modified using the sample and the weight. A weighted training for the cascade classifier of the machine-learning classification system may be performed using the modified training dataset. Computer malware may be identified using the cascade classifier. In response to identifying the computer malware, a security action may be performed to protect the one or more computing devices from the computer malware. Various other methods, systems, and computer-readable media are also disclosed.

Abstract: The disclosed computer-implemented method for malware remediation may include constructing a malware detection model by (i) identifying multiple candidate hyperparameter sets, (ii) selecting, from the candidate hyperparameter sets, a set of hyperparameters for the malware detection model that optimizes a tradeoff between model efficacy and model size, and (iii) training the malware detection model on a set of training samples to distinguish between malicious samples and clean samples. After constructing the malware detection model, the disclosed computer-implemented method may also include using the constructed malware detection model to perform a security action. Various other methods, systems, and computer-readable media are also disclosed.

Abstract: The disclosed computer-implemented method for detecting low-density training regions of machine-learning classification systems may include (i) receiving a training dataset that is used to train a classifier of a machine-learning classification system, (ii) calculating a density estimate of a distribution of the training dataset, (iii) receiving a sample that is to be classified by the classifier, (iv) using the density estimate to determine that the sample falls within a low-density region of the distribution of the training dataset, and (v) performing a security action in response to determining that the sample falls within the low-density region. Various other methods, systems, and computer-readable media are also disclosed.

Abstract: A method for improving cascade classifier ordering is described. In one embodiment, the method may include determining an efficacy rating of a first current configuration, generating a decreasing sequence of values for a control parameter, and selecting a current value of the control parameter according to the decreasing sequence of values. In some cases, the method may include randomly selecting a first test configuration among the plurality of configurations based at least in part on the current value of the control parameter, analyzing the first test configuration in relation to the first current configuration, and implementing, based at least in part on the analyzing of the first test configuration, the first test configuration in a machine learning classification system of a computing device to improve a data classification accuracy of the computing device.