System and method for analyzing binary code for malware classification using artificial neural network techniques
AssigneeMandiant, Inc.
InventorsJeffrey Thomas Johns, Brian Sanford Jones, Scott Eric Coull
Life of this patent
Estimating the term…
Loading patent…
AssigneeMandiant, Inc.
InventorsJeffrey Thomas Johns, Brian Sanford Jones, Scott Eric Coull
Estimating the term…
A system for detecting whether a file including content is associated with a cyber-attack is described. The content may include an executable file for example. The system includes an intelligence-driven analysis subsystem and a computation analysis subsystem. The intelligence-driven analysis subsystem is configured to (i) receive the file, (ii) inspect and compute features of the file for indicators associated with a cyber-attack, and (iii) produce a first output representing the detected indicators. The computational analysis subsystem includes an artificial neural network to (i) receive a network input being a first representation of at least one section of binary code from the file as input, and (ii) process the first representation of the section to produce a second output. The first output and the second output are used in determination a classification assigned to the file.
A method for identifying whether a file including binary code is associated with a cyber-attack, the method comprising:
A system, implemented with non-transitory storage medium including software that, when executed, identifies whether a file is associated with a cyber-attack, the system comprising:
Dependencies are inferred from the claim text.