Mandiant, Inc.
Framework for classifying an object as malicious with machine learning for deploying updated predictive models

Abstract:

According to one embodiment, an apparatus comprises a first analysis engine and a second analysis engine. The first analysis engine analyzes an object to determine if the object is malicious. The second analysis engine is configured to (i) receive results of the analysis of the object from the first analysis engine and (ii) analyze, based at least in part on the analysis by the first analysis engine, whether the object is malicious in accordance with a predictive model. Responsive to the first analysis engine and the second analysis engine differing in determinations as to whether the object is malicious, information associated with an analysis of the object by at least one of the first analysis engine and the second analysis engine is uploaded for determining whether an update of the predictive model is to occur. An update of the predictive model is subsequently received by the classification engine.