Systems and methods for classifying files as specific types of malware

Abstract

The disclosed computer-implemented method for classifying files as specific types of malware may include (i) identifying an unknown file on a computing device, (ii) performing an analysis of the unknown file by applying, to the unknown file, a machine-learning heuristic that employs at least one decision tree, (iii) classifying the unknown file as malicious based on the analysis, and (iv) after classifying the unknown file as malicious, using the same decision tree employed by the machine-learning heuristic to sub-classify the unknown file by (a) identifying at least one leaf node of the decision tree arrived at by the analysis performed by the machine-learning heuristic on the unknown file, (b) determining that the leaf node of the decision tree is associated with a particular type of malicious file, and (c) sub-classifying the unknown file as the particular type of malicious file. Various other methods, systems, and computer-readable media are also disclosed.