Methods and apparatus for machine learning based malware detection
AssigneeInvincea, Inc.
InventorsJoshua Daniel Saxe, Konstantin Berlin
Life of this patent
Estimating the term…
Abstract
Apparatus and methods describe herein, for example, a process that can include receiving a potentially malicious file, and dividing the potentially malicious file into a set of byte windows. The process can include calculating at least one attribute associated with each byte window from the set of byte windows for the potentially malicious file. In such an instance, the at least one attribute is not dependent on an order of bytes in the potentially malicious file. The process can further include identifying a probability that the potentially malicious file is malicious, based at least in part on the at least one attribute and a trained threat model.
Claims21
A method, comprising:
- receiving a target file;
- calculating an attribute value associated with the target file, the attribute value being based on an indication of how often a combination of a string length range and a string hash value range occurs within the target file;
- calculating a probability that the target file is malicious based on the attribute value;
- communicating a threat score based on the probability, the threat score associated with at least one of a potential threat to a user, a potential threat to a device, or a potential threat to a network;
- and
- performing a remedial action based on the threat score.
An apparatus, comprising:
- a memory;
- and
- a hardware processor operatively coupled to the memory,
- the hardware processor configured to receive a target file, the hardware processor configured to calculate an attribute associated with the target file, the attribute based on a number of strings within the target file having a string length within a string length range,
- the hardware processor further configured to calculate, based on the attribute, a probability that the target file is malicious, and output a threat score based on the probability.
A non-transitory processor-readable medium storing code representing instructions to be executed by a processor, the instructions comprising code to cause the processor to:
- receive a target file;
- determine an attribute associated with the target file, the attribute based on a number of strings within the target file having a string hash value within a string hash value range;
- determine a probability that the target file is malicious based on the attribute;
- and
- output a threat score based on the probability.
Dependencies are inferred from the claim text.