Detection of computer security threats by machine learning

Abstract

A system for detecting computer security threats includes a machine learning model that has been trained using sequence codes generated from malware process chains that describe malware behavior. An endpoint computer monitors the behavior of a process and constructs a target process chain that describes the monitored behavior. The target process chain includes objects that are linked by computer operations of the monitored behavior. The target process chain is converted to a sequence code that is input to the machine learning model for classification. A response action is performed against one or more objects identified in the target process chain when the machine learning model deems the target process chain as describing malware behavior.