Selecting a malware scanner from multiple malware scanners

Abstract

In some cases, malicious code is injected into a legitimate software package to create an injected package. An AI extracts a plurality of parts of the injected package, mutates individual parts to create multiple mutated parts, and assembles at least a portion of them to create a mutated malware. A malware scanner determines a risk score associated with the mutated malware. If the risk score satisfies a predetermined threshold, the mutated malware is stored in a set of mutated malware. When a number of mutated malware in the set of mutated malware satisfies a requested number, a plurality of malware scanners are ranked based on their ability to identify malware from the set of mutated malware. Based at least in part on the ranking, a particular malware scanner that identified a maximum number of malware from the set of mutated malware is selected and deployed to detect malware.