US 10,832,168 B2Granted

Computational modeling and classification of data streams

AssigneeCrowdStrike, Inc.

InventorsSven Krasser, David Elkind, Patrick Crenshaw, Brett Meyer

Life of this patent

Estimating the term…

Loading patent…

Abstract

Example techniques described herein determine a signature or classification of a data stream such as a file. The classification can indicate whether the data stream is associated with malware. A processor can locate training analysis regions of training data streams based on predetermined structure data, and determining training model inputs based on the training analysis regions. The processor can determine a computational model based on the training model inputs. The computational model can receive an input vector and provide a corresponding feature vector. The processor can then locate a trial analysis region of a trial data stream based on the predetermined structure data and determine a trial model input. The processor can operate the computational model based on the trial model input to provide a trial feature vector, e.g., a signature. The processor can operate a second computational model to provide a classification based on the signature.

Claims20

Dependent claims

A method comprising performing the following operations using at least one processor:

locating respective training analysis regions of individual training data streams of a plurality of training data streams based at least in part on predetermined structure data, wherein each respective training analysis region comprises a predetermined number of bits;
determining respective training model inputs based at least in part on the training analysis regions, wherein each respective training model input comprises a first number of values;
determining a computational model based at least in part on the training model inputs, wherein:
the computational model is configured to receive as input an input vector comprising the first number of values and to provide as output an output vector approximating the input vector and a feature vector comprising a second number of values;
and
the second number of values is less than the first number of values;
locating a trial analysis region of a trial data stream based at least in part on the predetermined structure data, wherein the trial analysis region comprises the predetermined number of bits;
determining a trial model input based at least in part on the trial analysis region, wherein the trial model input comprises the first number of values;
and
operating the computational model based at least in part on the trial model input to provide a trial feature vector comprising the second number of values.

7 more elements

Dependencies are inferred from the claim text.

Facts

Application: 15/402,524Filed 10 Jan 2017
Published: US 2018/0197089 A112 Jul 2018
Granted: 10 Nov 2020
Term ends: Not estimatedThe source records don’t support an estimate.

Classification15 codes

G06N 20/00
Machine learning
G06F 21/56
Detecting local intrusion or implementing counter-measures: computer malware detection or handling, e.g. anti-virus arrangements
G06N 3/044
Architecture, e.g. interconnection topology: recurrent networks, e.g. Hopfield networks
G06N 3/0442
Recurrent networks, e.g. Hopfield networks: characterised by memory or gating, e.g. long short-term memory [LSTM] or gated recurrent units [GRU]