# US 11,113,397 B2 · Detection of malicious executable files using hierarchical models > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,113,397 B2 - Document ID: US11113397B2 - Status: Granted - Kind: B2 - Application number: 16/413,880 - Filed: 2019-05-16 - Published: 2020-11-19 - Granted: 2021-09-07 - Earliest claimed: 2019-05-16 - Assignees: Cisco Technology, Inc. - Applicants: Cisco Technology, Inc. - Inventors: Tomas Pevny; Jan Franco̊; Petr Somol - Web page: https://patentgrep.com/patent/US11113397B2 ## CPC - G06F 21/562: {Static detection} - G06F 21/563: {by source code analysis} - G06F 21/567: {using dedicated hardware} - G06F 21/568: {eliminating virus, restoring damaged files} - G06N 3/0464: Convolutional networks [CNN, ConvNet] - G06N 3/08: Learning methods - G06N 3/0895: Weakly supervised learning, e.g. semi-supervised or self-supervised learning - G06N 3/09: Supervised learning - G06F 2221/033: Test or assess software - G06N 3/044: Recurrent networks, e.g. Hopfield networks - G06N 3/045: Combinations of networks - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS ## Abstract In one embodiment, a device disassembles an executable file into assembly instructions. The device maps each of the assembly instructions to a fixed length instruction vector using one-hot encoding and an instruction vocabulary and forms vector representations of blocks of a control flow graph for corresponding functions of the executable file by embedding and aggregating bags of the instruction vectors. The device generates, based on the vector representations of the blocks of the control flow graph, a call graph model of the functions in the executable file. The device forms a vector representation of the executable file based in part on the call graph model. The device determines, based on the vector representation of the executable file, whether the executable file is malware. ## Claims ### Claim 1 A method comprising: disassembling, by a device, an executable file into assembly instructions; mapping, by the device, each of the assembly instructions to a fixed length instruction vector using one-hot encoding and an instruction vocabulary; forming, by the device, vector representations of blocks of a control flow graph for corresponding functions of the executable file by embedding and aggregating bags of the instruction vectors; generating, by the device and based on the formed vector representations of the blocks of the control flow graph, a call graph model of the functions in the executable file; forming, by the device, a vector representation of the executable file based in part on the call graph model; and determining, by the device and based on the vector representation of the executable file, whether the executable file is malware. ### Claim 2 (depends on 1) The method as in claim 1, further comprising: initiating a corrective measure when the device determines that the executable file is malware. ### Claim 3 (depends on 1) The method as in claim 1, wherein the device uses a machine learning classifier to determine that the executable file is malware. ### Claim 4 (depends on 1) The method as in claim 1, wherein forming vector representations of blocks of the control flow graph for the executable file by embedding and aggregating bags of the instruction vectors comprises: concatenating the instruction vectors into bags; and processing the concatenated vectors using a neural network with aggregation. ### Claim 5 (depends on 1) The method as in claim 1, wherein forming vector representations of blocks of the control flow graph for the executable file by embedding and aggregating bags of the instruction vectors comprises: computing a histogram of n-grams using the instruction vectors, to form the vector representations of blocks of the control flow graph. ### Claim 6 (depends on 1) The method as in claim 1, wherein forming the vector representation of the executable file based in part on the call graph model of the executable file comprises: combining the call graph model with data regarding a portable executable (PE) header of the executable file. ### Claim 7 (depends on 1) The method as in claim 1, wherein forming vector representations of blocks of the control flow graph for the executable file by embedding and aggregating bags of the instruction vectors comprises: combining the instruction vectors with any associated string references or call names from the executable file. ### Claim 8 (depends on 1) The method as in claim 1, wherein generating, based on the formed vector representations of the blocks of the control flow graph, the call graph model of the executable file comprises: forming the control flow graph using the vector representations of the blocks of the control flow graph by constructing a block wrapper for the particular block using the vector representations of its incoming and outgoing blocks. ### Claim 9 An apparatus, comprising: one or more network interfaces to communicate with a network; a processor coupled to the network interfaces and configured to execute one or more processes; and a memory configured to store a process executable by the processor, the process when executed configured to: disassemble an executable file into assembly instructions; map each of the assembly instructions to a fixed length instruction vector using one-hot encoding and an instruction vocabulary; form vector representations of blocks of a control flow graph for corresponding functions of the executable file by embedding and aggregating bags of the instruction vectors; generate, based on the formed vector representations of the blocks of the control flow graph, a call graph model of the functions in the executable file; form, a vector representation of the executable file based in part on the call graph model of the executable file; and determine, based on the vector representation of the executable file, whether the executable file is malware. ### Claim 10 (depends on 9) The apparatus as in claim 9, wherein the process when executed is further configured to: initiate a corrective measure when the executable file is determined to be malware. ### Claim 11 (depends on 9) The apparatus as in claim 9, wherein the apparatus uses a machine learning classifier to determine that the executable file is malware. ### Claim 12 (depends on 9) The apparatus as in claim 9, wherein the apparatus forms vector representations of blocks of the control flow graph for corresponding functions of the executable file by embedding and aggregating bags of the instruction vectors by: concatenating the instruction vectors into bags; and processing the concatenated vectors using a neural network with aggregation. ### Claim 13 (depends on 9) The apparatus as in claim 9, wherein the apparatus forms vector representations of blocks of the control flow graph for the executable file by embedding and aggregating bags of the instruction vectors by: computing a histogram of n-grams using the instruction vectors, to form the vector representations of blocks of the control flow graph. ### Claim 14 (depends on 9) The apparatus as in claim 9, wherein the apparatus forms the vector representation of the executable file based in part on the call graph model of the executable file by: combining the call graph model with data regarding a portable executable (PE) header of the executable file. ### Claim 15 (depends on 9) The apparatus as in claim 9, wherein the apparatus forms vector representations of blocks of the control flow graph for the executable file by embedding and aggregating bags of the instruction vectors by: combining the instruction vectors with any associated string references or call names from the executable file. ### Claim 16 (depends on 9) The apparatus as in claim 9, wherein the apparatus generates, based on the formed vector representations of the blocks of the control flow graph, the call graph model of the executable file by: forming the control flow graph using the vector representations of the blocks of the control flow graph by constructing a block wrapper for the particular block using the vector representations of its incoming and outgoing blocks. ### Claim 17 A tangible, non-transitory, computer-readable medium storing program instructions that cause a device to execute a process comprising: disassembling, by a device, an executable file into assembly instructions; mapping, by the device, each of the assembly instructions to a fixed length instruction vector using one-hot encoding and an instruction vocabulary; forming, by the device, vector representations of blocks of a control flow graph for corresponding functions the executable file by embedding and aggregating bags of the instruction vectors; generating, by the device and based on the formed vector representations of the blocks of the control flow graph, a call graph model of the functions in the executable file; forming, by the device, a vector representation of the executable file based in part on the call graph model; and determining, by the device and based on the vector representation of the executable file, whether the executable file is malware. ### Claim 18 (depends on 17) The computer-readable medium as in claim 17, further comprising: initiating a corrective measure when the device determines that the executable file is malware. ### Claim 19 (depends on 17) The computer-readable medium as in claim 17, wherein forming vector representations of blocks of the control flow graph for corresponding functions of the executable file by embedding and aggregating bags of the instruction vectors comprises: concatenating the instruction vectors into bags; and processing the concatenated vectors using a neural network with aggregation. ### Claim 20 (depends on 17) The computer-readable medium as in claim 17, wherein forming vector representations of blocks of the control flow graph for the executable file by embedding and aggregating bags of the instruction vectors comprises: computing a histogram of n-grams using the instruction vectors, to form the vector representations of blocks of the control flow graph.