Abstract: A method for producing a set of indicators of unwanted activity in a computer system, comprising: receiving a plurality of input data sets, each describing system activity and comprising an infection label and system activity information collected from a computer system; producing a plurality of training sets each comprising: 1) a plurality of activity values, each indicative of execution of an instruction, extracted from one of the plurality of input data sets, and 2) a respective infection label; producing for each training set one of a plurality of sets of relevant activity values by: training a model to output, in response to the respective training set, an infection classification equal to respective infection label; and analyzing the model to identify a set of relevant activity values, of the plurality of activity values, effecting the infection classification; and analyzing the plurality of sets of relevant activity values to produce the indicators.

Abstract: A method for producing a set of indicators of unwanted activity in a computer system, comprising: receiving a plurality of input data sets, each describing system activity and comprising an infection label and system activity information collected from a computer system; producing a plurality of training sets each comprising: 1) a plurality of activity values, each indicative of execution of an instruction, extracted from one of the plurality of input data sets, and 2) a respective infection label; producing for each training set one of a plurality of sets of relevant activity values by: training a model to output, in response to the respective training set, an infection classification equal to respective infection label; and analyzing the model to identify a set of relevant activity values, of the plurality of activity values, effecting the infection classification; and analyzing the plurality of sets of relevant activity values to produce the indicators.