# US 10,121,105 B2 · Digital DNA sequence

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 10,121,105 B2
- Document ID: US10121105B2
- Status: Granted
- Kind: B2
- Application number: 14/317,958
- Filed: 2014-06-27
- Published: 2015-02-26
- Granted: 2018-11-06
- Earliest claimed: 2009-04-24
- Assignees: CounterTack, Inc.
- Applicants: CounterTack, Inc.
- Inventors: Michael Gregory Hoglund
- Web page: https://patentgrep.com/patent/US10121105B2

## CPC

- G06N 5/027: {Frames}
- G06F 21/554: {involving event detection and direct action}
- G06F 21/56: Computer malware detection or handling, e.g. anti-virus arrangements
- G06F 21/564: {by virus signature recognition}
- G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

In an embodiment of the invention, a method of classifying a data object includes: scanning the data object; evaluating contents of data objects base on at least one selected rule; and generating a digital DNA sequence that classifies at least some contents in the data object.

## Claims

### Claim 1

A computer-implemented method, comprising:
at an electronic device for generating a sequence that classifies a data object to determine whether the data object is a malicious object:
applying to the data object a plurality of rules, each rule of the plurality of rules associated with a respective weight value and with a respective trait, to select expressed traits, wherein an expressed trait corresponds to a rule that matches the data object;
generating a sequence comprising each of the weight values associated with the expressed traits, wherein each of the weight values corresponds to a likelihood of whether the data object belongs to a respective class of data objects;
calculating a sequence weight based on the weight values associated with each of the expressed traits, wherein calculating a sequence weight comprises reducing a weight value of an expressed trait for a subsequent expression of the same trait, including:
determining whether a first rule of the plurality of rules matches the data object for a first time;
in accordance with determining that the first rule of the plurality of rules matches the data object for the first time, utilizing a first weight value in calculating the sequence weight;
determining whether the first rule of the plurality of rules matches the data object for a second time that is subsequent to the first time; and
in accordance with determining that the first rule of the plurality of rules matches the data object for the second time that is subsequent to the first time, utilizing a second weight value that is less than the first weight value in calculating the sequence weight; and
storing the generated sequence in a selected target memory of the electronic device.

### Claim 2 (depends on 1)

The method of claim 1, wherein calculating a sequence weight comprises:
associating a decay rate with one or more of the weight values, wherein the decay rate diminishes an effect of successive instances of a repeated weight value on the sequence weight.

### Claim 3 (depends on 1)

The method of claim 1, wherein the weight values comprise positive and negative confidence values, the positive confidence values corresponding to a high likelihood that the data object belongs to a respective class of data objects, and the negative confidence values corresponding to a low likelihood that the data object belongs to a respective class of data objects.

### Claim 4 (depends on 1)

The method of claim 1, wherein each rule of the plurality of rules comprise a rule value; and wherein the data object comprises a data value.

### Claim 5 (depends on 1)

The method of claim 1, wherein one or more of the rules comprises a rule restriction indicating whether the rule is case-sensitive, and/or a rule restriction indicating a location of text to be searched.

### Claim 6 (depends on 1)

The method of claim 1, wherein:
the sequence weight is a sum of weight values multiplied by respective weight multipliers.

### Claim 7 (depends on 1)

The method of claim 1, including:
in accordance with determining that the first rule of the plurality of rules matches the data object for the first time, calculating a first sequence weight including multiplying a weight value for the first rule with an initial weight multiplier for the first rule; and,
in accordance with determining that the first rule of the plurality of rules matches the data object for a second time that is subsequent to the first time, calculating a second sequence weight including multiplying the weight value for the first rule with a reduced weight multiplier for the first rule.

### Claim 8 (depends on 1)

The method of claim 1, further comprising:
repeating application of the plurality of rules to the data object at different times for identifying subsequently expressed traits.

### Claim 9 (depends on 1)

The method of claim 1, wherein calculating the sequence weight includes:
utilizing a third weight value for a first time match of a second expressed trait in calculating the sequence weight; and
utilizing a fourth weight value, that is less than the third weight value, for a second time match of the second expressed trait in calculating the sequence weight.

### Claim 10 (depends on 4)

The method of claim 4, wherein the data value comprises one or more of: a string, a byte pattern, a code, and a name of a process.

### Claim 11 (depends on 4)

The method of claim 4, wherein applying the plurality of rules to the data object comprises determining, for each rule of the plurality of rules, whether the rule value matches the data value.

### Claim 12 (depends on 4)

The method of claim 4, further comprising:
associating a control code with a first trait to inter-associate the first trait with a second trait; and
wherein each of the inter-associated traits is selected as an expressed trait based on whether the rule value of the other inter-associated trait matches the data value.

### Claim 13 (depends on 4)

The method of claim 4, wherein one or more of the rule values comprise wildcard characters.

### Claim 14 (depends on 7)

The method of claim 7, wherein:
the reduced weight multiplier for the first rule is reduced from the initial weight multiplier by a decay rate for the first rule.

### Claim 15 (depends on 14)

The method of claim 14, including:
in accordance with determining that a second rule, distinct from the first rule, of the plurality of rules matches the data object for a first time, calculating a third sequence weight including multiplying a weight value for the second rule with an initial weight multiplier for the second rule; and,
in accordance with determining that the second rule of the plurality of rules matches the data object for a second time that is subsequent to the first time, calculating a fourth sequence weight including multiplying the weight value for the second rule with a reduced weight multiplier for the second rule.

### Claim 16 (depends on 15)

The method of claim 15, wherein:
the reduced weight multiplier for the second rule is reduced from the initial weight multiplier by a decay rate for the second rule; and
the decay rate for the second rule is distinct from the decay rate for the first rule.

### Claim 17

An electronic device for generating a sequence that classifies a data object to determine whether the data object is a malicious object, the device comprising:
a memory; and
a sequencing engine, wherein the sequencing engine is configured to be executed by one or more processors, the sequencing engine including instructions for:
applying to the data object a plurality of rules, each rule of the plurality of rules associated with a respective weight value and with a respective trait, to select expressed traits, wherein an expressed trait corresponds to a rule that matches the data object;
generating a sequence comprising each of the weight values associated with the expressed traits, wherein each of the weight values corresponds to a likelihood of whether the data object belongs to a respective class of data objects;
calculating a sequence weight based on the weight values associated with each of the expressed traits, wherein calculating a sequence weight comprises reducing a weight value of an expressed trait for a subsequent expression of the same trait, including:
determining whether a first rule of the plurality of rules matches the data object for a first time;
in accordance with determining that the first rule of the plurality of rules matches the data object for the first time, utilizing a first weight value in calculating the sequence weight;
determining whether the first rule of the plurality of rules matches the data object for a second time that is subsequent to the first time; and
in accordance with determining that the first rule of the plurality of rules matches the data object for the second time that is subsequent to the first time, utilizing a second weight value that is less than the first weight value in calculating the sequence weight; and
storing the generated sequence in a selected target memory.

### Claim 18 (depends on 17)

The device of claim 17, wherein the sequencing engine further include instructions for:
associating a decay rate with one or more of the weight values, wherein the decay rate diminishes an effect of successive instances of a repeated weight value on the sequence weight.

### Claim 19 (depends on 17)

The device of claim 17, wherein the weight values comprise positive and negative confidence values, the positive confidence values corresponding to a high likelihood that the data object belongs to a respective class of data objects, and the negative confidence values corresponding to a low likelihood that the data object belongs to a respective class of data objects.

### Claim 20 (depends on 17)

The device of claim 17, wherein each rule of the plurality of rules comprise a rule value; and wherein the data object comprises a data value.

### Claim 21 (depends on 17)

The device of claim 17, wherein one or more of the rules comprises a rule restriction indicating whether the rule is case-sensitive, and/or a rule restriction indicating a location of text to be searched.

### Claim 22 (depends on 17)

The device of claim 17, wherein the data object is stored in the memory.

### Claim 23 (depends on 17)

The device of claim 17, wherein the sequencing engine is executed when the data object is received by the device over a network.

### Claim 24 (depends on 20)

The device of claim 20, wherein the data value comprises one or more of: a string, a byte pattern, a code, and a name of a process.

### Claim 25 (depends on 20)

The device of claim 20, wherein applying the plurality of rules to the data object comprises determining, for each rule of the plurality of rules, whether the rule value matches the data value.

### Claim 26 (depends on 20)

The device of claim 20, wherein the sequencing engine further include instructions for:
associating a control code with a first trait to inter-associate the first trait with a second trait; and
wherein each of the inter-associated traits is selected as an expressed trait based on whether the rule value of the other inter-associated trait matches the data value.

### Claim 27 (depends on 20)

The device of claim 20, wherein one or more of the rule values comprise wildcard characters.

### Claim 28

A non-transitory computer-readable storage medium storing instructions for execution by an electronic device for generating a sequence that classifies a data object to determine whether the data object is a malicious object, the instructions comprising instructions for:
applying to the data object a plurality of rules, each rule of the plurality of rules associated with a respective weight value and with a respective trait, to select expressed traits, wherein an expressed trait corresponds to a rule that matches the data object;
generating a sequence comprising each of the weight values associated with the expressed traits, wherein each of the weight values corresponds to a likelihood of whether the data object belongs to a respective class of data objects;
calculating a sequence weight based on the weight values associated with each of the expressed traits, wherein calculating a sequence weight comprises reducing a weight value of an expressed trait for a subsequent expression of the same trait, including:
determining whether a first rule of the plurality of rules matches the data object for a first time;
in accordance with determining that the first rule of the plurality of rules matches the data object for the first time, utilizing a first weight value in calculating the sequence weight;
determining whether the first rule of the plurality of rules matches the data object for a second time that is subsequent to the first time; and
in accordance with determining that the first rule of the plurality of rules matches the data object for the second time that is subsequent to the first time, utilizing a second weight value that is less than the first weight value in calculating the sequence weight; and
storing the generated sequence in a selected target memory of the electronic device.