COPYRIGHT NOTICE

Contained herein is material that is subject to copyright protection. The copyright owner has no objection to the facsimile reproduction of the patent disclosure by any person as it appears in the Patent and Trademark Office patent files or records, but otherwise reserves all rights to the copyright whatsoever. Copyright © 2018, Fortinet, Inc.

BACKGROUND

Field

Embodiments of the present invention generally relate to the fields of cybersecurity and artificial intelligence and more particularly to an artificial intelligence (AI) based approach for detection and classification of malicious software (malware), which may be used within a self-evolving cybersecurity fabric and which may be based upon automatically extracted features.

Description of the Related Art

Computer networks are continually targeted by attackers who inject viruses that may cause serious damage to computer systems. A computer virus is a form of malware that is an elaborately designed program that typically propagates by attaching itself to other programs or sets of computer instructions. The intent of a virus is usually to gain access to computer systems, disturb computer operations, steal personal information and the like. Therefore, several security techniques and methods have been developed to minimize exposure of computer systems to different types of viruses.

Widely used techniques to overcome the problems created by computer viruses include installing software known as anti-virus software. Conventional anti-virus software typically relies on a signature-based and/or a behavior-based approach to detect computer viruses, which requires analysts to generate specific signatures or rules based on examining the disassembled malicious code and/or based on observing the execution of the malicious code in a controlled environment. However, both traditional signature-based and behavior-based anti-virus software have intrinsic disadvantages. Firstly, a considerable amount of human resources must be invested in order to analyze virus patterns or behaviors, and then hand-crafted signatures or rules are developed to detect a particular family of viruses. Secondly, this manual process significantly increases the time between detection and response, which makes it difficult to provide immediate protection for zero-day attacks, for example, by traditional anti-virus approaches. Thirdly, as a result of the pursuit of low false positive rates, the specific patterns that trigger conventional signature-based and behavior-based anti-virus software may not be sufficiently generalized to detect new viruses. As a result, in order to evade detection attackers generally use techniques like obfuscation or polymorphism to create new variants of a virus family.

In recent years, anti-virus software using AI-based techniques has been developed for used in connection with detection of computer viruses; however, since such anti-virus software still uses conventional signature-based analysis (e.g., disassembly of the malicious code and extraction of a collection of static features to train a machine-learning model), conventional evasion approaches remain effective and can be used by virus writers to avoid detection. Therefore, there is a need in the art to develop improved techniques for malware detection.

SUMMARY

Systems and methods are described for detection and classification of malware using an artificial intelligence (AI) based approach. According to one embodiment, a central training node (T-node) of a cybersecurity fabric maintains a sample library having multiple samples. The samples include virus samples and benign samples. A global virus classification model is generated by the T-node by extracting features from the samples and training a machine-learning classifier or a deep-learning neural network. The global virus classification model is distributed by the T-node to multiple detection nodes (D-nodes) of the cybersecurity fabric for use as a local virus detection model in connection with virus detection and sample collection. Each of the D-nodes is associated with a respective customer network. Responsive to detection of a virus in network traffic being processed by one of the D-nodes, the T-Node receives a virus sample from the D-node. When an instance of the received virus sample is already present in the sample library, it is not incorporated into the sample library; otherwise it is incorporated into the sample library by adding the received virus sample into an appropriate category of multiple virus family categories based on a virus family with which the received virus sample is associated. A feature depository is created or updated by the T-node by extracting features from the samples. Responsive to a retraining event: (i) an improved global virus classification model is created by the T-node by retraining the machine-learning classifier or the deep-learning neural network based on features contained in the feature depository; and (ii) the D-nodes are caused to be upgraded by the T-Node by distributing the improved global virus classification model to the D-nodes to replace their respective local virus detection models.

Other features of embodiments of the present disclosure will be apparent from accompanying drawings and detailed description that follows.

