公开(公告)号：US11003773B1

公开(公告)日：2021-05-11

申请号：US15942082

申请日：2018-03-30

申请人： FireEye, Inc.

发明人： Chunsheng Fang ,  Wei Quan ,  Richard Lai ,  Robert Venal ,  Benjamin Chang

IPC分类号： G06F21/56 ,  G06F21/55 ,  G06K9/62 ,  H04L29/06 ,  G06N20/00

摘要： A method for generating rule recommendation utilized in a creation of malware detection rules is described. Meta-information associated with a plurality of events collected during a malware detection analysis of an object by a cybersecurity system is received and a first plurality of features is selected from the received meta-information. Machine learning (ML) models are applied to each of the first plurality of features to generate a score that represents a level of maliciousness for the feature and thereby a degree of usefulness of the feature in classifying the object as malicious or benign. Thereafter, a second plurality of features is selected as the salient features, which are used in creation of the malware detection rules in controlling subsequent operations of the cybersecurity system. The second plurality of features being lesser in number that the first plurality of features.