Abstract: Systems and methods that determine an anomaly in a network are provided. A monitoring engine is installed on a computing device that monitors network information and application information for data flows generated on the computing device and transmitted over a network and for data flows received by the computing device from the network. The network information includes an internet protocol (IP) source address, a source port, an IP destination address, a destination port, and a transport protocol, and a number of bytes sent or received by the flow. The application information includes a process identifier (ID), the threads ID, an application ID and/or a function call, arguments passed to the function, a stack trace of the function, etc., that application used to generate the data flows. The network information and application information can be used to identify the application, thread and/or a function that caused an anomaly in the network.

Abstract: A method, product and computer program product for building a malware detector, the method including the steps of: receiving at least one characteristic for each of a plurality of malware variants; categorizing each of the characteristics as a malicious characteristic or a non-malicious characteristic; generating a detector; training the detector to distinguish between the malicious characteristic and the non-malicious characteristic; and rating the detector based on an accuracy of detection of an amount of malicious characteristics for each malware variant.

Abstract: A method, product and computer program product for building a malware detector, the method including the steps of: receiving at least one characteristic for each of a plurality of malware variants; categorizing each of the characteristics as a malicious characteristic or a non-malicious characteristic; generating a detector; training the detector to distinguish between the malicious characteristic and the non-malicious characteristic; and rating the detector based on an accuracy of detection of an amount of malicious characteristics for each malware variant.

Abstract: A method, product and computer program product for building a malware detector, the method including the steps of: receiving at least one characteristic for each of a plurality of malware variants; categorizing each of the characteristics as a malicious characteristic or a non-malicious characteristic; generating a detector; training the detector to distinguish between the malicious characteristic and the non-malicious characteristic; and rating the detector based on an accuracy of detection of an amount of malicious characteristics for each malware variant.

Abstract: A method, product and computer program product for evolving malware variants, the method including the steps of: receiving a malware specimen; generating a first generation of variants corresponding to the malware specimen, wherein the malware specimen is altered by one or more mutations to generate each variant of the first generation of variants; selecting variants from the first generation of variants; and mutating the selected variants to generate successive generations of variants, wherein the successive generations are generated until one or more criteria are met.

Abstract: A method, product and computer program product for providing evolutionary selection of malware variants, the method including the steps of: receiving a malware specimen; generating a first generation of variants corresponding to the malware specimen; evaluating each variant of the first generation of variants for one or more evasiveness characteristics and one or more maliciousness characteristics; based on the evaluating, selecting variants of the first generation of variants for further mutation; and generating a second generation of variants from each of the selected variants.

Abstract: A method, product and computer program product for evaluating a generation of malware variants, the method including the steps of: scanning, with one or more malware detectors, a variant of a malware specimen; determining an evasiveness characteristic of the variant and a maliciousness characteristic of the variant; determining a likelihood that the variant meets one or more criteria based at least on the evasiveness characteristic of the variant and the maliciousness characteristic of the variant; and based on the determined likelihood, selecting the variant for propagation.