Ca, Inc.

Qichao Lan

Tao Cheng

Rudy Senstad

XueFeng Tian

Mark Kevin Kennedy

Barry Laffoon

Junda Zhu

Shaolong Shu

The disclosed computer-implemented method for producing adjustments to malware-detecting services may include (1) receiving, from a plurality of malware-detecting services executing on a plurality of client computing devices, a respective plurality of probability scores with corresponding model identifiers for an analyzed file and a plurality of respective identifiers describing the malware-detecting services, (2) building a training dataset from at least a portion of the received plurality of probability scores with corresponding model identifiers, and (3) performing a security action including (A) training, with the training dataset, a malware-detecting linear regression ensemble machine learning model that is specific to an identifier in the plurality of identifiers and (B) sending the trained linear regression ensemble machine learning model to one of the plurality of malware-detecting services executing on one of the client computing devices. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for producing adjustments to malware-detecting services

The disclosed computer-implemented method for dynamically augmenting machine learning models based on contextual factors associated with execution environments may include (1) generating a base machine learning model and a supplemental set of machine learning models, (2) determining at least one contextual factor associated with an execution environment of a machine learning system that is configured to make predictions regarding a set of input data using at least the base machine learning model, (3) selecting, based on the contextual factor, a continuation set of machine learning models from the supplemental set of machine learning models, and (4) directing the machine learning system to utilize both the base machine learning model and the continuation set of machine learning models when making predictions regarding the set of input data. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for dynamically augmenting machine learning models based on contextual factors associated with execution environments

The disclosed computer-implemented method for malware detection using localized machine learning may include (i) generating a global score for a file using a global machine learning model, (ii) generating a localized score for the file using a localized machine learning model, (iii) determining that the file is malware using the global score, the localized score, and the local conviction threshold, and (iv) in response to determining that the file is malware, performing a security action to protect the computing device against malware. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for malware detection using localized machine learning

A computer-implemented method for identifying malicious computer files may include (i) receiving, by a computing device, a set of files from a set of client devices, (ii) performing, by the computing device, a machine learning classification of file attributes on the set of files, (iii) determining, based on the machine learning classification, a node pattern of a suspicious file in the set of files, (iv) calculating, by hashing the node pattern, a file prevalence score of the suspicious file, and (v) performing, by the computing device, a security action based on the file prevalence score of the suspicious file. Various other methods, systems, and computer-readable media are also disclosed.

Growing community of inventors

Torrance, CA, United States of America

Qichao Lan