Prediction of execution behaviors in sandbox

Abstract

A sandbox module on a host computer executes sample programs and includes a dynamic analysis module that collects run-time behaviors of the sample program. A static analysis module collects static behaviors of the sample programs. The behaviors are sent to a recurrent neural network to train one or more models. Each model is trained on a type of sample file. During prediction, the sequence network inputs the behaviors from an unknown sample program. An encoder encodes the behaviors into numerical tuples. A recurrent neural network model inputs the tuples and outputs a predicted behavior of the sample program based upon the tuples. A decoder decodes a numerical tuple representing the predicted behavior and outputs the predicted behavior into a decision engine. The decision engine of the sandbox outputs a decision regarding whether the sample program is malicious or not. Look up tables permit mapping between tuples and the textual behaviors.