# US 11,451,581 B2 · Systems and methods for malware detection and mitigation > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,451,581 B2 - Document ID: US11451581B2 - Status: Granted - Kind: B2 - Application number: 16/417,531 - Filed: 2019-05-20 - Published: 2020-11-26 - Granted: 2022-09-20 - Earliest claimed: 2019-05-20 - Assignees: Architecture Technology Corporation - Applicants: Architecture Technology Corporation - Inventors: Joseph Sirianni; Judson Powers; Robert Joyce - Web page: https://patentgrep.com/patent/US11451581B2 ## CPC - H04L 63/145: {the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms} - G06N 3/04: Architecture, e.g. interconnection topology - G06N 3/0464: Convolutional networks [CNN, ConvNet] - G06N 3/084: Backpropagation, e.g. using gradient descent - G06N 3/09: Supervised learning - G06N 20/10: using kernel methods, e.g. support vector machines [SVM] - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L 63/1433: {Vulnerability analysis} - G06N 3/045: Combinations of networks - G06N 3/08: Learning methods - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS ## Abstract Disclosed herein are embodiments of systems, methods, and products comprise an analytic server, which detects and defends against malware in-flight regardless of the specific nature and methodology of the underlying attack. The analytic server learns the system's normal behavior during testing and evaluation phase and trains a machine-learning model based on the normal behavior. The analytic server monitors the system behavior during runtime comprising the runtime behavior of each sub-system of the system. The analytic server executes the machine-learning model and compares the system runtime behavior with the normal behavior to identify anomalous behavior. The analytic server executes one or more mitigation instructions to mitigate malware. Based on multiple available options for mitigating malware, the analytic server makes an intelligent decision and takes the least impactful action that have the least impact on the system to maintain mission assurance. ## Claims ### Claim 1 A computer-implemented method, comprising: generating, by a server, kernel level feature vectors of system call hierarchy during testing phase of a computing system; training, by the server, a machine-learning model based upon the kernel level feature vectors for the machine-learning model to learn a normal behavior of the computing system; retrieving, by the server, a first set of system calls of a first sub-system of the computing system during runtime of the computing system; retrieving, by the server, a second set of system calls of a second sub-system of the computing system during runtime of the computing system; executing, by the server, the machine-learning model on the first and the second sets of system calls to compare the runtime behavior of the computing system with the normal behavior; and in response to the server determining that the runtime behavior deviates from the normal behavior over a predetermined threshold, instructing, by the server, the computing system to execute one or more mitigation instructions, wherein the one or more mitigation instructions comprises changing an anomalous system call parameter to a specific value, changing an anomalous return value to a specific value, halting the system calls, and executing a script on the computing system. ### Claim 2 (depends on 1) The computer-implemented method of claim 1, wherein the kernel level feature vectors comprise normal behavior features of both software and hardware components of the computing system. ### Claim 3 (depends on 1) The computer-implemented method of claim 1, further comprising: retrieving, by the server, the first and the second sets of system calls based on system call interception using dynamic kernel trace points. ### Claim 4 (depends on 1) The computer-implemented method of claim 1, further comprising: combining, by the server, the first and the second sets of system calls across sub-systems to generate an entire system call hierarchy. ### Claim 5 (depends on 1) The computer-implemented method of claim 1, further comprising: training, by the server, the machine-learning model based on a convolutional neural network. ### Claim 6 (depends on 1) The computer-implemented method of claim 1, further comprising: automatically evaluating, by the server, a risk for each system call within the first and the second sets of system calls; and determining, by the server, a weight value for each system call based on the corresponding risk. ### Claim 7 (depends on 1) The computer-implemented method of claim 1, further comprising: determining, by the server, the one or more mitigation instructions for anomalous system behavior based on a weight value of the system call associated with the anomalous system behavior. ### Claim 8 (depends on 1) The computer-implemented method of claim 1, further comprising: applying, by the server, a hybrid approach of rules combined with machine-learning model on the first and the second sets of system calls. ### Claim 9 (depends on 1) The computer-implemented method of claim 1, further comprising: determining, by the server, that the runtime behavior deviates from the normal behavior based on a hierarchical risk model comprising an attack tree. ### Claim 10 A computer system comprising: a computing system comprising a first sub-system and a second sub-system; a server in communication with the computing system and having a processor comprising instructions that when executed by the processor are configured to: generate kernel level feature vectors of system call hierarchy during testing phase of the computing system; train a machine-learning model based upon the kernel level feature vectors for the machine-learning model to learn a normal behavior of the computing system; retrieve a first set of system calls of the first sub-system of the computing system during runtime of the computing system; retrieve a second set of system calls of the second sub-system of the computing system during runtime of the computing system; execute the machine-learning model on the first and the second sets of system calls to compare the runtime behavior of the computing system with the normal behavior; and in response to determining that the runtime behavior deviates from the normal behavior over a predetermined threshold, instruct the computing system to execute one or more mitigation instructions, wherein the one or more mitigation instructions comprises changing an anomalous system call parameter to a specific value, changing an anomalous return value to a specific value, halting the system calls, and executing a script on the computing system. ### Claim 11 (depends on 10) The computer system of claim 10, wherein the kernel level feature vectors comprise normal behavior features of both software and hardware components of the computing system. ### Claim 12 (depends on 10) The computer system of claim 10, wherein the server is further configured to: retrieve the first and the second sets of system calls based on system call interception using dynamic kernel trace points. ### Claim 13 (depends on 10) The computer system of claim 10, wherein the server is further configured to: combine the first and the second sets of system calls across sub-systems to generate an entire system call hierarchy. ### Claim 14 (depends on 10) The computer system of claim 10, wherein the server is further configured to: train the machine-learning model based on a convolutional neural network. ### Claim 15 (depends on 10) The computer system of claim 10, wherein the server is further configured to: automatically evaluate a risk for each system call within the first and the second sets of system calls; and determine a weight value for each system call based on the corresponding risk. ### Claim 16 (depends on 10) The computer system of claim 10, wherein the server is further configured to: determine the one or more mitigation instructions for anomalous system behavior based on a weight value of the system call associated with the anomalous system behavior. ### Claim 17 (depends on 10) The computer system of claim 10, wherein the server is further configured to: apply a hybrid approach of rules combined with machine-learning model on the first and the second sets of system calls. ### Claim 18 (depends on 10) The computer system of claim 10, wherein the server is further configured to: determine that the runtime behavior deviates from the normal behavior based on a hierarchical risk model comprising an attack tree.