# US 12,111,930 B2 · Utilizing machine learning to detect ransomware in code > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,111,930 B2 - Document ID: US12111930B2 - Status: Granted - Kind: B2 - Application number: 17/818,262 - Filed: 2022-08-08 - Published: 2024-02-08 - Granted: 2024-10-08 - Earliest claimed: 2022-08-08 - Assignees: Saudi Arabian Oil Company - Applicants: Saudi Arabian Oil Company - Inventors: Maha Nasser Alasmari; Abdullah Abdulaziz Alturaifi; Sultan Saadaldean Alsharif - Web page: https://patentgrep.com/patent/US12111930B2 ## CPC - G06F 21/566: {Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities} - G06F 21/563: {by source code analysis} - G06F 21/568: {eliminating virus, restoring damaged files} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Implementations can provide a method that includes: accessing the source code of a script hosted by a remote server; extracting features from the source code in accordance with a machine-learning model comprising one or more layers of logic; at least based on the machine-learning model, determining, for each of the extracted features, a corresponding probability conditioned on the source code containing ransomware; and at least based on the machine-learning model, determining a combined probability for the extracted features conditioned on the source code containing ransomware when the extracted features are jointly present; comparing the combined probability with a threshold; in response to determining that the combined probability exceeds the threshold, flagging the source code as containing ransomware; and in response to determining that the combined probability does not exceed the threshold, flagging the source code as not containing ransomware. ## Claims ### Claim 1 A computer-implemented method for screening a source code for ransomware before the source code can be executed by a local computer, the method comprising: accessing the source code of a script hosted by a remote server; extracting features from the source code in accordance with a machine-learning model comprising one or more layers of logic; at least based on the machine-learning model, determining, for each of the extracted features, a corresponding probability conditioned on the source code containing ransomware; and at least based on the machine-learning model, determining a combined probability for the extracted features conditioned on the source code containing ransomware when the extracted features are jointly present; comparing the combined probability with a threshold; in response to determining that the combined probability exceeds the threshold, flagging the source code as containing ransomware; and in response to determining that the combined probability does not exceed the threshold, flagging the source code as not containing ransomware. ### Claim 2 (depends on 1) The computer-implemented method of claim 1, wherein extracting features comprises: extracting keywords corresponding to at least one category of: a file input/output (IO) operation, a cryptography operation, a key generating operation, and a data communication operation, and wherein the keywords are combined to be processed through the one or more layers of logic of the machine-learning model. ### Claim 3 (depends on 1) The computer-implemented method of claim 1, further comprising: at least based on the model, determining, for each of the extracted features, a corresponding probability conditioned on the source code not containing ransomware. ### Claim 4 (depends on 3) The computer-implemented method of claim 3, further comprising: at least based on the model, determining a combined probability for the extracted features conditioned on the source code not containing ransomware when the extracted features are jointly present. ### Claim 5 (depends on 4) The computer-implemented method of claim 4, wherein comparing the combined probability with a threshold comprises: comparing the combined probability for the extracted features conditioned on the source code containing ransomware when the extracted features are jointly present with the combined probability for the extracted features conditioned on the source code not containing ransomware when the extracted features are jointly present. ### Claim 6 (depends on 1) The computer-implemented method of claim 1, further comprising: in response to flagging the source code as containing ransomware, blocking the script from execution by the local computer. ### Claim 7 (depends on 1) The computer-implemented method of claim 1, further comprising: in response to flagging the source code as containing ransomware, blacklisting the remote server hosting the script. ### Claim 8 A computer system for screening a source code for ransomware, the computer system comprising one or more processors configured to perform operations of: accessing the source code of a script hosted by a remote server; extracting features from the source code in accordance with a machine-learning model comprising one or more layers of logic; at least based on the machine-learning model, determining, for each of the extracted features, a corresponding probability conditioned on the source code containing ransomware; and at least based on the machine-learning model, determining a combined probability for the extracted features conditioned on the source code containing ransomware when the extracted features are jointly present; comparing the combined probability with a threshold; in response to determining that the combined probability exceeds the threshold, flagging the source code as containing ransomware; and in response to determining that the combined probability does not exceed the threshold, flagging the source code as not containing ransomware. ### Claim 9 (depends on 8) The computer system of claim 8, wherein extracting features comprises: extracting keywords corresponding to at least one category of: a file input/output (IO) operation, a cryptography operation, a key generating operation, and a data communication operation, and wherein the keywords are combined to be processed through the one or more layers of logic of the machine-learning model. ### Claim 10 (depends on 8) The computer system of claim 8, wherein the operations further comprise: at least based on the model, determining, for each of the extracted features, a corresponding probability conditioned on the source code not containing ransomware when the feature is present. ### Claim 11 (depends on 10) The computer system of claim 10, wherein the operations further comprise: at least based on the model, determining a combined probability for the extracted features conditioned on the source code not containing ransomware when the extracted features are jointly present. ### Claim 12 (depends on 11) The computer system of claim 11, wherein comparing the combined probability with a threshold comprises: comparing the combined probability for the extracted features conditioned on the source code containing ransomware when the extracted features are jointly present with the combined probability for the extracted features conditioned on the source code not containing ransomware when the extracted features are jointly present. ### Claim 13 (depends on 8) The computer system of claim 8, wherein the operations further comprise: in response to flagging the source code as containing ransomware, blocking the script from execution by a local computer. ### Claim 14 (depends on 8) The computer system of claim 8, wherein the operations further comprise: in response to flagging the source code as containing ransomware, blacklisting the remote server hosting the script. ### Claim 15 A non-transitory computer-readable medium comprising software, which, when executed by a computer, causes the computer to execute operations of: accessing the source code of a script hosted by a remote server; extracting features from the source code in accordance with a machine-learning model comprising one or more layers of logic; at least based on the machine-learning model, determining, for each of the extracted features, a corresponding probability conditioned on the source code containing ransomware; and at least based on the machine-learning model, determining a combined probability for the extracted features conditioned on the source code containing ransomware when the extracted features are jointly present; comparing the combined probability with a threshold; in response to determining that the combined probability exceeds the threshold, flagging the source code as containing ransomware; and in response to determining that the combined probability does not exceed the threshold, flagging the source code as not containing ransomware. ### Claim 16 (depends on 15) The non-transitory computer-readable medium of claim 15, wherein extracting features comprises: extracting keywords corresponding to at least one category of: a file input/output (IO) operation, a cryptography operation, a key generating operation, and a data communication operation, and wherein the keywords are combined to be processed through the one or more layers of logic of the machine-learning model. ### Claim 17 (depends on 15) The non-transitory computer-readable medium of claim 15, wherein the operations further comprise: at least based on the model, determining, for each of the extracted features, a corresponding probability conditioned on the source code not containing ransomware when the feature is present. ### Claim 18 (depends on 17) The non-transitory computer-readable medium of claim 17, wherein the operations further comprise: at least based on the model, determining a combined probability for the extracted features conditioned on the source code not containing ransomware when the extracted features are jointly present. ### Claim 19 (depends on 18) The non-transitory computer-readable medium of claim 18, wherein comparing the combined probability with a threshold comprises: comparing the combined probability for the extracted features conditioned on the source code containing ransomware when the extracted features are jointly present with the combined probability for the extracted features conditioned on the source code not containing ransomware when the extracted features are jointly present. ### Claim 20 (depends on 15) The non-transitory computer-readable medium of claim 15, wherein the operations further comprise: in response to flagging the source code as containing ransomware, blocking the script from execution by a local computer; and in response to flagging the source code as containing ransomware, blacklisting the remote server hosting the script.