Detecting malware with deep generative models
AssigneeCylance Inc.
InventorMichael Thomas Wojnowicz
Life of this patent
Estimating the term…
Abstract
Features are extracted from an artifact so that a vector can be populated. The vector is then inputted into an anomaly detection model comprising a deep generative model to generate a first score. The first score can characterize the artifact as being malicious or benign to access, execute, or continue to execute. In addition, the vector is inputted into a machine learning-based classification model to generate a second score. The second score can also characterize the artifact as being malicious or benign to access, execute, or continue to execute. The second score is then modified based on the first score to result in a final score. The final score can then be provided to a consuming application or process. Related apparatus, systems, techniques and articles are also described.
Claims20
A method for execution by one at least one computing device having one or more processors and memory, the method comprising:
- receiving, by the at least one computing device, an artifact;
- extracting, by the at least one computing device, features from the artifact and populating a vector;
- inputting, by the at least one computing device, the vector into an anomaly detection model comprising a deep generative model to generate a first score, the first score characterizing the artifact as being malicious or benign to access, execute, or continue to execute;
- inputting, by the at least one computing device, the vector into a machine learning-based classification model to generate a second score, the second score characterizing the artifact as being malicious or benign to access, execute, or continue to execute;
- modifying, by the at least one computing device, the second score based on the first score to result in a final score;
- and
- providing, by the at least one computing device, the final score to a consuming application or process to determine, based on the final score, whether or not to access the artifact, execute, continue to execute the artifact, quarantine the artifact, or take a remedial action in relation to the artifact to prevent software or a computing system from being infected or otherwise infiltrated by malicious code or other information encapsulated within the artifact.
A system comprising:
- at least one data processor;
- and
- memory comprising instructions, which when executed by the at least one data processor, result in operations comprising:
- receiving an artifact;
- extracting features from the artifact and populating a vector;
- inputting the vector into an anomaly detection model comprising a deep generative model to generate a first score, the first score characterizing the artifact as being malicious or benign to access, execute, or continue to execute;
- inputting the vector into a machine learning-based classification model to generate a second score, the second score characterizing the artifact as being malicious or benign to access, execute, or continue to execute;
- modifying the second score based on the first score to result in a final score;
- and
- providing the final score to a consuming application or process.
A non-transitory computer program product comprising instructions which, when executed by at least one computing device, result in operations comprising:
- receiving an artifact;
- extracting features from the artifact and populating a vector;
- inputting the vector into an anomaly detection model comprising a deep generative model to generate a first score, the first score characterizing the artifact as being malicious or benign to access, execute, or continue to execute;
- inputting the vector into a machine learning-based classification model to generate a second score, the second score characterizing the artifact as being malicious or benign to access, execute, or continue to execute;
- modifying the second score based on the first score to result in a final score;
- and
- providing the final score to a consuming application or process.
Dependencies are inferred from the claim text.