Polonium: Tera-Scale Graph Mining and Inference for Malware Detection

摘要: We present Polonium, a novel Symantec technology that detects malware through large-scale graph inference. Based on the scalable Belief Propagation algorithm, Polonium infers every file’s reputation, flagging files with low reputation as malware. evaluated billion-node constructed from largest file submissions dataset ever published (60 terabytes). attained high true positive rate of 87% in detecting malware; field, lifted detection existing methods by 10 absolute percentage points. detail Polonium’s design and implementation features instrumental to its success. has served 120 million people helped answer more than one trillion queries for reputation.