# US 12,010,129 B2 · Methods and apparatus for using machine learning to classify malicious infrastructure > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,010,129 B2 - Document ID: US12010129B2 - Status: Granted - Kind: B2 - Application number: 17/239,128 - Filed: 2021-04-23 - Published: 2022-11-03 - Granted: 2024-06-11 - Earliest claimed: 2021-04-23 - Assignees: Sophos Limited - Applicants: Sophos Limited - Inventors: Tamás Vörös; Richard Harang; Joshua Daniel Saxe - Web page: https://patentgrep.com/patent/US12010129B2 ## CPC - G06F 21/552: {involving long-term monitoring or reporting} - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - G06F 21/566: {Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities} - G06N 3/045: Combinations of networks - G06N 3/0464: Convolutional networks [CNN, ConvNet] - G06N 3/08: Learning methods - G06N 3/09: Supervised learning - H04L 63/0236: {Filtering by address, protocol, port number or service, e.g. IP-address or URL} - H04L 63/14: {for detecting or protecting against malicious traffic} - H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)} - H04L 63/1416: {Event detection, e.g. attack signature detection} - H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - G06N 3/048: Activation functions - G06N 20/00: Machine learning - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS ## Abstract Embodiments disclosed include methods and apparatus for detecting a reputation of infrastructure associated with potentially malicious content. In some embodiments, an apparatus includes a memory and a processor. The processor is configured to identify an Internet Protocol (IP) address associated with potentially malicious content and define each row of a matrix by applying a different subnet mask from a plurality of subnet masks to a binary representation of the IP address to define that row of the matrix. The processor is further configured to provide the matrix as an input to a machine learning model, and receive, from the machine learning model, a score associated with a maliciousness of the IP address. ## Claims ### Claim 1 An apparatus, comprising: a memory; and a processor operatively coupled to the memory, the processor configured to: identify an internet protocol (IP) address associated with potentially malicious content, define each row from a set of rows of a matrix by applying a different subnet mask from a plurality of subnet masks to a binary representation of the IP address to define that row of the matrix, apply a convolutional window across the set of rows of the matrix to identify a relative contribution of each row from the set of rows to define a representation of the matrix, provide the representation of the matrix as an input to a machine learning model (ML model), and receive, from the ML model, a score associated with a maliciousness of the IP address, the score being based on a classification associated with the IP address. ### Claim 2 (depends on 1) The apparatus of claim 1, wherein the processor is further configured to: identify a set of characteristics associated with the IP address; define a feature vector based on the set of characteristics; and provide the feature vector as an input to the ML model. ### Claim 3 (depends on 1) The apparatus of claim 1, wherein the processor is further configured to perform a remedial action against the IP address based on the score meeting a predefined criterion. ### Claim 4 (depends on 1) The apparatus of claim 1, wherein the ML model is a first ML model and the processor is further configured to: infer a representation of an internet service provider (ISP) associated with the IP address by providing the IP address as an input to a second machine learning model; and provide the representation of the ISP as an input to the first ML model. ### Claim 5 (depends on 1) The apparatus of claim 1, wherein the processor is further configured to: identify a first subset of characteristics from a plurality of characteristics associated with the IP address, a second subset of characteristics from the plurality of characteristics being unidentified; define a feature vector based on the first subset of characteristics and a predefined value for each characteristic from the second subset of characteristics; and provide the feature vector as an input to the ML model. ### Claim 6 A non-transitory processor-readable medium storing code representing instructions to be executed by a processor, the instructions comprising code to cause the processor to: identify an internet protocol (IP) address associated with potentially malicious content; define a matrix based on the IP address; define each row from a set of rows of the matrix by applying a different subnet mask from a plurality of subnet masks to a binary representation of the IP address to define that row of the matrix; apply a convolutional window across the set of rows of the matrix to identify a relative contribution of each row from the set of rows to define a representation of the matrix; infer a representation of an internet service provider (ISP) associated with the IP address by providing the IP address as an input to a first machine learning model; provide the matrix and the representation of the ISP associated with the IP address as inputs to a second machine learning model trained to generate a classification associated with the IP address based on the matrix and the representation of the ISP associated with the IP address; and receive, from the second machine learning model, a score associated with a maliciousness of the IP address, the score being based on the classification associated with the IP address. ### Claim 7 (depends on 6) The non-transitory processor-readable medium of claim 6, wherein each row of the matrix includes a representation of a different subnet of the IP address. ### Claim 8 (depends on 6) The non-transitory processor-readable medium of claim 6, further comprising code to cause the processor to: perform a remedial action against the IP address based on the score meeting a predefined criterion. ### Claim 9 (depends on 6) The non-transitory processor-readable medium of claim 6, further comprising code to cause the processor to: identify a set of characteristics associated with the IP address, the set of characteristics includes an identifier associated with at least one of a country associated with the IP address, a name-server associated with the IP address, a registrar associated with the IP address, a registrant associated with the IP address, or a pointer (PTR) record associated with the IP address; and define a feature vector based on the set of characteristics, the code to cause the processor to provide the matrix and the representation of the ISP associated with the IP address including code to cause the processor to provide the feature vector as an input to the second machine learning model. ### Claim 10 (depends on 6) The non-transitory processor-readable medium of claim 6, further comprising code to cause the processor to: identify a first subset of characteristics from a plurality of characteristics associated with the IP address, a second subset of characteristics from the plurality of characteristics being unidentified; and define a feature vector based on the first subset of characteristics and a predefined value for each characteristic from the second subset of characteristics, the code to cause the processor to provide the matrix and the representation of the ISP associated with the IP address including code to cause the processor to provide the feature vector as an input to the second machine learning model. ### Claim 11 A method, comprising: identifying an internet protocol (IP) address associated with potentially malicious content; defining a matrix based on the IP address, each row of the matrix including a representation of a different subnet of the IP address; identifying a set of characteristics associated with the IP address; defining a feature vector based on the set of characteristics; providing the matrix and the feature vector as inputs to a convolutional neural network (CNN) trained to generate a classification associated with the IP address based on the matrix and the feature vector, wherein the CNN slides a convolutional window across the matrix to identify a relative contribution of a set of features in the matrix; and receiving, from the CNN, a score associated with a maliciousness of the IP address, the score being based on the classification associated with the IP address. ### Claim 12 (depends on 11) The method of claim 11, wherein the defining the feature vector includes providing each characteristic from the set of characteristics as an input to a hash function to define the feature vector. ### Claim 13 (depends on 11) The method of claim 11, wherein the set of characteristics is a first subset of characteristics from a plurality of characteristics, a second subset of characteristics from the plurality of characteristics being unidentified, the defining the feature vector including providing a predefined value in the feature vector to represent each characteristic from the second subset of characteristics. ### Claim 14 (depends on 11) The method of claim 11, wherein a characteristic from the set of characteristic includes a representation associated with an internet service provider (ISP) associated with the IP address, the identifying the set of characteristics including inferring the representation associated with the ISP by providing the IP address to a machine learning model. ### Claim 15 (depends on 11) The method of claim 11, wherein the defining the matrix includes defining the matrix based on a binary representation of the IP address. ### Claim 16 (depends on 11) The method of claim 11, wherein the set of characteristics includes an identifier associated with at least one of an internet service provider (ISP) associated with the IP address, a country associated with the IP address, a name-server associated with the IP address, a registrar associated with the IP address, a registrant associated with the IP address, or a pointer (PTR) record associated with the IP address. ### Claim 17 (depends on 11) The method of claim 11, further comprising: performing a remedial action against the IP address based on the score meeting a predefined criterion.