We address the problems of identifying malware in network telemetry logs and
providing \emph{indicators of compromise} -- comprehensible explanations of
behavioral patterns that identify the threat. In our system, an array of
specialized detectors abstracts network-flow data into comprehensible
\emph{network events} in a first step. We develop a neural network that
processes this sequence of events and identifies specific threats, malware
families and broad categories of malware. We then use the
\emph{integrated-gradients} method to highlight events that jointly constitute
the characteristic behavioral pattern of the threat. We compare network
architectures based on CNNs, LSTMs, and transformers, and explore the efficacy
of unsupervised pre-training experimentally on large-scale telemetry data. We
demonstrate how this system detects njRAT and other malware based on behavioral
patterns.

本文介绍了一种使用专业检测器和神经网络来识别威胁和恶意软件的方法，并且使用集成梯度方法来突出表现出威胁的特征行为模式，最后通过大规模数据的实验，探索了卷积神经网络、LSTMs 和变形金刚网络的有效性及无监督预训练技术在检测 njRAT 等恶意软件中的应用。