Machine learning classification using Markov modeling
AssigneeCylance Inc.
InventorsJian Luan, Derek A. Soeder
Life of this patent
Estimating the term…
Abstract
Systems, methods, and articles of manufacture, including computer program products, are provided for classification systems and methods using modeling. In some example embodiments, there is provided a system that includes at least one processor and at least one memory including program code which when executed by the at least one memory provides operations. The operations can include generating a representation of a sequence of sections of a file and/or determining, from a model including conditional probabilities, a probability for each transition between at least two sequential sections in the representation. The operations can further include classifying the file based on the probabilities for each transition.
Claims20
A system comprising:
- at least one data processor;
- and
- memory including program code which, when executed by the at least one data processor, result in operations comprising:
- generating a representation of a sequence of sections of a file, wherein at least a portion of the sequence of the sections of the file are arranged according to a virtual ordering, the virtual ordering representing an order in which the sections of the file will occur in memory, the generated sequence of the sections of the file being different than an order in which at least a portion of the sections occur within the file when not executing;
- determining, from a model including conditional probabilities, a probability for each transition between at least two sequential sections in the representation;
- and
- classifying the file based on the probabilities for each transition.
A computer-implemented method comprising:
- generating a representation of a sequence of sections of a file, wherein at least a portion of the sequence of the sections of the file are arranged according to a virtual ordering, the virtual ordering representing an order in which the sections of the file will occur in memory, the generated sequence of the sections of the file being different than an order in which at least a portion of the sections occur within the file when not executing;
- determining, from each of a plurality of different models including conditional probabilities that each correspond to a different type of malware, a probability for each transition between at least two sequential sections in the representation to generate a corresponding classification score;
- and
- classifying the file as one of the different types of malware based on the model having a highest magnitude classification score.
A non-transitory computer program product storing instructions which, when executed by at least one computing device, result in operations comprising:
- generating a representation of a sequence of sections of a file, the generating comprising determining which sections of the file to include in the representation using machine learning, wherein at least a portion of the sequence of the sections of the file are arranged according to a virtual ordering, the virtual ordering representing an order in which the sections of the file will occur in memory, the generated sequence of the sections of the file being different than an order in which at least a portion of the sections occur within the file when not executing;
- determining, from a trained model including conditional probabilities, a probability for each transition between at least two sequential sections in the representation;
- and
- classifying the file based on the probabilities for each transition.
Dependencies are inferred from the claim text.