220. For example, if the received packet comprises a windows portable executable (PE) header, the filtering module 210 is configured to extract the content associated with the packet. In other example embodiments, the filtering module 210 determines that the packet is associated with a portable executable (PE) file, a portable document format (PDF) file, or a Microsoft Office File (e.g., Word, Excel, or PowerPoint). Here, content associated with the packet may comprise one of a binary sequence, a word sequence, or a script. The conversion module 220 is further described below.

In an embodiment, if the filtering module 210 is unable to determine a MIME-type associated with the packet, the packet is stored in a data store (e.g., the store 260). In the embodiment described above, the filtering module 210 stored the received packet (e.g., in the store 260) and waits to receive a next packet of the one or more packets associated with the file. In another embodiment, if a packet received by the MDE 110 is not a first packet associated with a file, the MDE 110 stores the received packet in a data store (e.g., store 260) until the first packet associated with the file is received. Here, once the first packet of the one or more packets is received, the filtering module 210 determines a MIME-type associated with the file associated with the received packet, extracts content associated with the packet, and transfers the content to the conversion module 220. The process performed by the filtering module 210 is further described below in conjunction with FIG. 3.

The conversion module 220 is configured to convert a binary content of a received packet into a digital representation that is useful for feature extraction by, for example, the feature extraction module 230. The feature extraction module 230 is further described below. Here examples of a digital representation include a decimal representation (base 10 representation), a Hexadecimal (base 16 representation), and a binary representation (base 2 representation). In an embodiment, the conversion module 220 converts the content associated with a received packet into decimal representation. In alternate embodiments, the conversion module 220 converts the content of a packet into hexadecimal representation, or a binary representation. For example, the converted packet is transmitted to the feature extraction module 230. Examples of a converted packet is further described, below, in conjunction with FIGS. 4A and 4B.

The conversion module 220 may extract scripts from packets associated with a PDF or other Microsoft Office document. For example, the conversion module 220 extracts JavaScript (JS) and/or Visual Basic for Applications (VBA) scripts from a packet. In embodiments, where the packet contains a JS or a VBA script, the extracted script is tokenized. The conversion module 220 may transmit the tokenized script to the feature extraction module 230.

The feature extraction module 230 extracts one or more features from a converted packet, tokenized script, and tokenized domain. At least one of the one or more extracted features may be an n-gram feature. Generally, an n-gram is a contiguous sequence of n items from a converted packet. Here, an extracted n-gram feature is related to the probability of particular sequence in a converted packet. In an embodiment, the feature extraction module 230 extracts, for example, n=1 or n=2. In an example embodiment in which a received packet is converted to a binary sequence comprising x bytes by the conversion module 220, the feature extraction module 230 extracts N n-grams (n=1) where N=x. Here, the probability, p(x), associated with a received packet is equal to a number of x in a packet divided by the number of bytes in the packet. That the number of n-gram features scales linearly with the number of bytes in a packet when the feature extraction module 230 extracts n-grams (n=1). For example, if a packet comprises 256 bytes, the feature extraction module 230 is configured to extract 256 features from the packet. In other embodiments, the feature extraction module 230 extracts n-grams of size 2 (n=2) from a received packet. Here, the feature extraction module 230 is configured to extract 65, 536 features. That is, when the feature extraction module 230 is configured to extract n-grams (n=2) from a received packet, the number of n-gram features extracted scales linearly with a square of the number of bytes in the packet. In still other embodiments, the feature extraction module 230 is configured to extract n-grams of size x. An illustrative process for extracting probability features from a converted packet is described below in conjunction with FIG. 4A.

The feature extraction module 230 may additionally, or alternatively, extract an entropy feature from a converted packet. Generally, an entropy feature associated with a converted packet is associated with a measure of the expectation of information associated with the converted packet. In an embodiment, the feature extraction module 230 determines a Shannon Entropy of a converted packet. For example, the Shannon entropy, H, of a converted packet is—Σp(x)log(p(x)). An illustrative process for extracting an entropy feature from a converted packet is described below in conjunction with FIG. 4B.

The feature extraction module 230 may extract a domain feature from a received packet. In an embodiment, extracting a domain feature from a received packet comprises determining the source uniform resource locator (URL) of a packet, extracting a host name (e.g., a subdomain, a domain, and a top level domain), and applying a domain model to determine if the packet is malicious or benign. For example, the feature extraction module 230 extracts one or more URLs from a content associated with a packet received from an third party system (e.g., third party system 130). In an embodiment, the feature extraction module 230 determines a probability of the one or more source URLs being seen in a malicious file. In various embodiments, the feature extraction module 230 determines both a probability of the one or more source URLs being seen in a malicious file and a probability of the one or more source URLs being seen in a benign file. In an embodiment, a process of determining the probability of the one or more source URLs being found in a benign file or a malicious file comprises extracting a host name associated with each of the one or more source URLs and applying a domain model to the extracted host names.

In various embodiments, applying a domain model to a source URL comprises tokenizing one or more source URLs associated with the packet, extracting one or more n-gram features based on the tokenized URL, and determining a probability of the URL as being malicious. For example, the feature extraction module 230 extracts the source URL “banc0esta.est.es” from a packet and tokenizes the source URL as “banc.esta,” “est,” and “es.” Here, the maximum probability of the domain in a malicious file is the tokenized source URL. In various embodiments, features extracted from the tokenized source URL are stored in the store 260.

The feature extraction module 230 may extract one or more features from a script or domain associated with a received packet. For example, an extracted script comprising the phase “PBin=ATTH+STT2+CDDD” extracted from a received packet is tokenized into four tokens (e.g., “PBin,” “ATTH,” “STT2,” and “CDDD”). The feature extraction module 230 extracts one or more n-gram from the tokenized script. Here, probabilities of each of the one or more n-grams extracted from the tokenized script is a feature. An illustrative process for extracting one or more features from a converted packet is described below in conjunction with FIG. 4C.

In one embodiment, the ML module 240 employs a random forest model to determine a probability of maliciousness associated with a received packet. In various embodiments, inputs to the Machine learning model include one or more features extracted from a received packet (e.g., domain features, entropy features, and n-gram features). An output of the Machine learning model is a probability of maliciousness associated with the received packet. The ML module 240 determines a probability by applying the one or more extracted features to a trained Machine learning model. In various embodiments, the random forest model is a random forest model comprising a plurality of decision trees. The plurality of decision trees may be received from a model trainer (e.g., MDP 120) based on a FP rate selected by a customer and one or more selection criteria. For example, the ML module 240 comprises N trained decision trees. A probability of maliciousness associated with a received packet as determined by the ML module 240 is equal to the summation of a probability of maliciousness determined by each of N trees divided by the number of decision trees in the random forest model. A random forest model used predict a probability of maliciousness by the ML module 240 is further described below in conjunction with FIG. 6.

The decision module 250 determines that the packet is malicious or benign. In various embodiments, the decision module 250 includes a threshold. In an embodiment, if the packet is above the threshold the decision module 250 determines that the received packet is malicious. For example, if the threshold is 0.7, and a probability of maliciousness associated with a received packet is greater than 0.7, the decision module 250 determines that a file associated with the received packet is malicious. Alternatively, in the example above, if the determined probability of maliciousness is less than 0.7, the decision module 250 determines that the packet is benign. In other embodiments, the decision module includes a first threshold and a second threshold. Here, if the probability of maliciousness associated with a received packet is above the second threshold, the decision module 250 determines that a file associated with the packet is malicious. Similarly, in the example above, if the probability of maliciousness is below the first threshold, the decision module 250 determines that the received packet is benign; and if the probability of maliciousness of a received packet greater than the first threshold and less than the second threshold, the decision module 250 determines that the maliciousness of the file associated with the received packet is uncertain.

The decision module 250 may provide a recommendation to a customer to take an action based on a determined probability. For example, the decision module 250 may provide a recommendation to a customer to, for example, drop a file associated with the received packet, terminate the connection, and/or block the remote host associated with the received packet.

FIG. 3 is a process flow diagram 300 for filtering a received packet, in accordance with an embodiment. The process 300 illustrated in conjunction with FIG. 3 may be performed by the MDE 110. In other embodiments, the process 400 may be performed by different and or additional modules.

The MDE 110 receives 310 a packet associated with a file. In one or more embodiments, the packet is received by a filtering module 210 as described above in conjunction with FIG. 2. In one or more embodiments, the filtering module 210 determines 320 a file mime-file type associated with the file associated with the received 310 packet.

The MDE 110 inspects 330 the packet to extract the content associated with packet. In one or more embodiments, inspecting 330 a packet comprises converting the content of the packet in a binary sequence. Here, converting the extracted content associated with a received packet is described above in conjunction with FIG. 2. In other embodiments, the feature extraction module 230 extracts one or more n-gram features and/or an entropy feature associated with the content associated with the packet. Extracting features from the received packet is described above in conjunction with FIG. 2. In still other embodiments, inspecting 330 the packet further includes applying the extracted one or more features to a trained machine learning model. The trained machine learning model is further described below in conjunction with FIG. 6.

The MDE 110 determines 340 a probability of maliciousness associated with the packet In an embodiment, the ML module 240 applies a trained Machine learning model to the extracted one or more features in order to determine 340 a probably of maliciousness associated with the received packet. Here, a received packet may be determined 340 to be malicious if a probability of maliciousness associated with the packet is above a threshold. In other embodiment the MDE 110 may additionally recommend an action based on the determined probability of maliciousness. Determining 340 a probability of maliciousness associated with a received packet is further described herein.

FIG. 4A illustrates a process 400 for extracting n-gram features from a received packet, in accordance with an embodiment. In one or more embodiments, the process 400 is performed by the MDE 110. FIG. 4A comprises a packet 410, a converted packet 420, one or more n-gram features 430a, and one or more n-gram features 430b. The process 400 illustrated in conjunction with FIG. 4A illustrates the steps of receiving a packet 410 associated with a file and converting the received packet 410 into a converted packet 420. In the embodiment, illustrated in conjunction with FIG. 4A, the converted packet 420 is a decimal representation of length 12 bytes. In other embodiments, the packet 410 additional or fewer bytes than those depicted in conjunction with FIG. 4A. Converting a packet is described above in conjunction with FIG. 2.

The one or more n-gram features 430a are extracted from the converted packet 420. Each of the one or more n-gram features 430a is a probability of an n-gram (n=1) in the one or more extracted n-grams (n=1). In FIG. 4A, for example, in packets, the n-gram features 430a comprises P(0)=0.42, P(1)=0.08, . . . , P(255)=0.08. The MDE 110 may additionally or alternatively determine a probability of an n-gram 430b of size 2. In FIG. 4A, for example, the probability of an individual non-repeating n-gram of the one or more n-gram features 430b is approximately 0.007. Extracting one or more n-grams 430a and 430b from a converted packet 420 is described above in conjunction with FIG. 2. In various embodiments, the extracted n-gram features are inputs to the trained Machine learning model as described above in conjunction with FIG. 2.

FIG. 4B illustrates a process 401 for extracting entropy features from a received packet, in accordance with an embodiment. In one or more embodiments, the process 401 is performed by the MDE 110 as described above in conjunction with FIGS. 1 and 2. FIG. 4B comprises the packet 410, the converted packet 420, and an entropy feature 440. In an embodiment, the entropy feature 440 is the Shannon Entropy of the converted packet 420. Extracting an entropy feature 440 from a converted packet 420 is described above in conjunction with FIG. 2. In various embodiments, the extracted entropy feature is an input to the trained Machine learning model as described above in conjunction with FIG. 2.

FIG. 4C illustrates a process 402 for extracting one or more n-gram features 460 from a script 450 associated with a received file, in accordance with an embodiment. The process 402 may be performed by the MDE 110 and comprises the script 450 associated with a document (e.g., PDF or Microsoft Office Document) and the one or more n-gram features 460. Each of the one or more n-gram features 460 is a probability of an n-gram extracted from the script 450. For example, in FIG. 4C the one or more n-grams are “if,” “then,” “else,” “end,” “atth,” “stt2,” and “cddd.” Extracting one or more n-gram features from a script 450 associated with a received packet is further described above in conjunction with FIG. 2.

FIG. 5 illustrates a data collection process 500 for a machine learning model, in accordance with an embodiment. The data collection process 500 comprises a benign source 510 and a malicious source 520. Here, the benign source 510 comprises a set of benign files and the malicious source 520 comprises a set of malicious files. Both the set of malicious files and the set of benign files include one or more PE files, Dynamic Loaded Libraries (DLLs), Microsoft Office Documents, Adobe PDF files, HTML files, JavaScript files, Java Archive (JAR) files, etc. Sources of benign files 510 include one or more benign sources 510. Example benign sources 510 include NIST, Google, and others. Example sources of malicious files 520 include virustotal.com, malwr.com. In some embodiments, sources of benign and malicious files include previously analyzed files at an MDE 110 associated with a customer. Both the benign sources 510 and the malicious sources 520 may also include metadata associated with a set of benign files and a set of malicious files. For example, virustotal.com provides information such as the number of antivirus engines that have considered the file malicious, a data collection time, a file type, and a hash associated with the file (e.g., MD5 and SHA256).

The selection module 530 may select one or more benign files from the benign source 510 and one or more malicious files from the malicious source 520 based on one or more selection criteria. In an embodiment, the one or more selection criteria include customer relevance, freshness (e.g., recentness) of the data, and credibility of data. In other embodiment, selection criteria may also include a date, a geographic location, and a reputations of the source. Selection criteria are described above in conjunction with FIGS. 1 and 2.

The malicious source 520 and the benign source 510 are inputs to a selection module 530. In various embodiments, the selection module 530 provides data for modeling to a model trainer (e.g., model trainer 120). In other embodiments, the selection module 530 retrieves one or more files from the malicious source 520 and the benign 510 periodically. For example, the selection module 530 may retrieve one or more files from the benign source 510 and the malicious source 520 on a monthly basis, weekly basis, or daily basis. In various embodiment, retrieving data from a malicious source 520 and a benign source 510 comprises using a web crawler.

FIG. 6 illustrates a trained machine learning model 600, in accordance with an embodiment. The machine learning model 600 comprises one or more features 610, a tree 610a, and a tree 610n. The tree 610a and the tree 610n are decision trees associated with a random forest or a random decision forest ML model. In various embodiments, the trees 610a and 610n are constructed during training and received from a MDP (e.g., MDP 120). While the ML model 600 in FIG. 6 is only depicted as having trees 620a and tree 620n, in other embodiments the machine learning model 600 includes a plurality of additional trees. The features 610 may include one or more n-gram features, a domain feature, and an entropy feature that are described above in conjunction with FIGS. 2, 4A-C.

The tree 620a includes nodes 630a and 630b and termini 640a, 640b, 640c, and 640d. That is, the node 630a is connected to termini 640a and 640b and node 630b is connected to termini 640c and 640d via one or more branches. The tree 620n includes nodes 650a and 650b and termini 660a, 660b, 660c, and 660d. That is, the node 650a is connected to termini 660a and 660b and node 650b is connected to termini 660c and 660d via one or more branches. In other embodiments, the trees 620a and 620n include one or more additional nodes, one or more additional branches, and one or more additional termini. In FIG. 6, the nodes 630a-b and the nodes 650a-b each represents a feature and a decision boundary for that feature. The termini 640a-d and the termini 660a-d are each associated with a probability of maliciousness. Generally, each of the one or more nodes leads to another node via a branch until a terminus is reached and a probability of maliciousness is assigned. The output of the trained ML model 600 is an average of a probability of maliciousness predicted by each of the trees 620a and the tree 620n.

In an example embodiment in which packet is converted into a decimal representation comprising the decimal sequences=[1, 9], the probability of n-gram features (n=I) P(I) in packets is equal to 0.5 and P(9) is equal to 0.7. Here, the n-gram features extracted from the converted packet are applied to the trained ML model illustrated in