Intelligent Mechanisms for Extracting Signs of File Modification in Dynamic Virus Analysis

Abstract

This paper proposes machine-learning pipelines that allow automatically generating the relevant feature spaces for virus detectors, detect the presence of viral modifications in JS-files and scripts in real time, and interpret and visualize the automatically obtained machine solution. It is shown that the best quality metrics will be demonstrated by models of an abstract syntactic tree using binary classifiers based on ensembles of decision trees. An explanation of the solution automatically generated by the virus detector is demonstrated.