# US 10,482,248 B2 · Shellcode detection > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,482,248 B2 - Document ID: US10482248B2 - Status: Granted - Kind: B2 - Application number: 15/806,229 - Filed: 2017-11-07 - Published: 2018-05-10 - Granted: 2019-11-19 - Earliest claimed: 2016-11-09 - Assignees: Cylance Inc. - Applicants: Cylance Inc. - Inventors: Mahdi Azarafrooz; Derek A. Soeder - Web page: https://patentgrep.com/patent/US10482248B2 ## CPC - G06F 21/566: {Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities} - G06F 21/552: {involving long-term monitoring or reporting} - G06F 2221/033: Test or assess software - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Identifying shellcode in a sequence of instructions by identifying a first instruction, the first instruction identifying a first bound of a sequence of instructions, identifying a second instruction, the second instruction identifying a second bound of the sequence of instructions, and generating a distribution for the sequence of instructions, bounded by the first instruction and the second instructions, the distribution indicative of whether the sequence of instructions is likely to include shellcode. ## Claims ### Claim 1 A system comprising: at least one processor; and at least one memory including program code which when executed by the at least one processor causes operations comprising: identifying a first instruction, the first instruction identifying a first bound of a sequence of instructions; identifying a second instruction, the second instruction identifying a second bound of the sequence of instructions; generating a distribution for the sequence of instructions, bounded between the first bound and the second bound, the distribution indicative of whether the sequence of instructions is likely to include shellcode; determining, based on the distribution and by a machine-learning model, a likelihood of whether the sequence of instructions is likely to include shellcode; and preventing the sequence of instructions from being executed if it determined that the sequence of instructions is likely to include shellcode; wherein the machine-learning model is assumptionless as to a form of and as to a frequency distribution of one or more mnemonics within the sequence of instructions, based on observed distributions of the one or more mnemonics in a first section of the sequence of instructions. ### Claim 2 (depends on 1) The system according to claim 1, wherein the first instruction includes an identification of a first location in memory and the second instruction includes an identification of a second location in memory. ### Claim 3 (depends on 2) The system according to claim 2, wherein the shellcode includes a position-independent instruction referencing the identification of the first location in memory. ### Claim 4 (depends on 1) The system according to claim 1, wherein the first instruction and the second instruction are in a file and the identifying of the first instruction and the identifying of the second instruction further comprises: disassembling a binary form of the file into code, the code having a higher-level representation when compared to the binary form. ### Claim 5 (depends on 4) The system according to claim 4, wherein the identifying of the first instruction and the identifying of the second instruction further comprises: assigning a mnemonic to individual elements of the code of the file, the individual elements of the code including at least the first instruction and the second instruction, wherein the identifying of the first instruction includes identifying a first mnemonic associated with the first instruction, and wherein the identifying of the second instruction includes identifying a second mnemonic associated with the second instruction. ### Claim 6 (depends on 1) The system according to claim 1, wherein the distribution is a conditional probability distribution. ### Claim 7 (depends on 1) The system according to claim 1, wherein the determining of the likelihood includes assigning a score to the sequence of instructions. ### Claim 8 (depends on 7) The system according to claim 7, wherein the score is a perplexity score indicative of a level of difficulty to generate a prediction of the distribution. ### Claim 9 (depends on 1) The system according to claim 1, wherein the machine learning model determines, based on the observed distributions of the one or more mnemonics in the first section of the sequence of instructions, a prediction of the frequency distribution of the one or more mnemonics in a second section of the sequence of instructions. ### Claim 10 (depends on 9) The system according to claim 9, wherein the machine-learning model is a non-parametric and non-Markovian machine-learning model. ### Claim 11 (depends on 10) The system according to claim 10, wherein the machine-learning model comprises a sequence memoizer. ### Claim 12 (depends on 1) The system according to claim 1, wherein the machine-learning model comprises an online inference model. ### Claim 13 (depends on 1) The system according to claim 1, wherein the sequence of instructions includes instructions and data. ### Claim 14 (depends on 1) The system according to claim 1, wherein the sequence of instructions is inclusive of one or more of the first instruction and the second instruction. ### Claim 15 (depends on 1) The system according to claim 1, wherein the sequence of instructions is exclusive of one or more of the first instruction and the second instruction. ### Claim 16 A computer-implemented method comprising: identifying a first instruction, the first instruction identifying a first bound of a sequence of instructions; identifying a second instruction, the second instruction identifying a second bound of the sequence of instructions; and generating a distribution for the sequence of instructions, bounded between the first bound and the second bound, the distribution indicative of whether the sequence of instructions is likely to include shellcode; determining, based on the distribution and by a machine-learning model, a likelihood of whether the sequence of instructions is likely to include shellcode; and preventing the sequence of instructions from being executed if it determined that the sequence of instructions is likely to include shellcode; wherein the machine-learning model is assumptionless as to a form of and as to a frequency distribution of one or more mnemonics within the sequence of instructions, based on observed distributions of the one or more mnemonics in a first section of the sequence of instructions. ### Claim 17 (depends on 16) The method according to claim 16, wherein: the first instruction includes an identification of a first location in memory and the second instruction includes an identification of a second location in memory; and the shellcode includes a position-independent instruction referencing the identification of the first location in memory. ### Claim 18 (depends on 16) The method of claim 16, wherein the first instruction and the second instruction are in a file and the identifying of the first instruction and the identifying of the second instruction further comprises: disassembling a binary form of the file into code, the code having a higher-level representation when compared to the binary form. ### Claim 19 (depends on 18) The method according to claim 18, wherein the identifying of the first instruction and the identifying of the second instruction further comprises: assigning a mnemonic to individual elements of the code of the file, the individual elements of the code including at least the first instruction and the second instruction, wherein the identifying of the first instruction includes identifying a first mnemonic associated with the first instruction, and wherein the identifying of the second instruction includes identifying a second mnemonic associated with the second instruction. ### Claim 20 A non-transient computer readable medium containing program instructions which, when executed by at least one processor, cause the at least one processor to perform one or more operations, the operations comprising: identifying a first instruction, the first instruction identifying a first bound of a sequence of instructions; identifying a second instruction, the second instruction identifying a second bound of the sequence of instructions; generating a distribution for the sequence of instructions, bounded between the first bound and the second bound, the distribution indicative of whether the sequence of instructions is likely to include shellcode; and determining, based on the distribution and by a machine-learning model, a likelihood of whether the sequence of instructions is likely to include shellcode; and preventing the sequence of instructions from being executed if it determined that the sequence of instructions is likely to include shellcode; wherein the machine-learning model is assumptionless as to a form of and as to a frequency distribution of one or more mnemonics within the sequence of instructions, based on observed distributions of the one or more mnemonics in a first section of the sequence of instructions.