Methods and systems for using causal analysis for boosted decision stumps to identify and respond to non-benign behaviors

摘要

A computing device processor may be configured with processor-executable instructions to implement methods of detecting and responding non-benign behaviors of the computing device. The processor may be configured to monitor device behaviors to collect behavior information, generate a behavior vector information structure based on the collected behavior information, apply the behavior vector information structure to a classifier model to generate analysis results, use the analysis results to classify a behavior of the device, use the analysis results to determine the features evaluated by the classifier model that contributed most to the classification of the behavior, and select the top “n” (e.g., 3) features that contributed most to the classification of the behavior. The computing device may display the selected features on an electronic display of the computing device.

主权项

1. A method, comprising:
monitoring behaviors of a computing device to collect behavior information; generating a behavior vector information structure based on the collected behavior information; applying the behavior vector information structure to a classifier model to generate analysis results; using the analysis results to classify a behavior of the computing device; using the analysis results to determine features evaluated by the classifier model that contributed most to a classification of the behavior; selecting the features that contributed most to the classification of the behavior; and displaying the selected features on an electronic display of the computing device.