# US 12,118,075 B2 · Methods and apparatus to improve detection of malware in executable code > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,118,075 B2 - Document ID: US12118075B2 - Status: Granted - Kind: B2 - Application number: 16/941,111 - Filed: 2020-07-28 - Published: 2021-12-02 - Granted: 2024-10-15 - Earliest claimed: 2020-05-28 - Assignees: McAfee, Inc. - Applicants: McAfee, LLC - Inventors: Brajesh Kumar; Sumit Lohani; Sidney Gomindes - Web page: https://patentgrep.com/patent/US12118075B2 ## CPC - G06F 21/51: at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability - G06F 21/561: {Virus type analysis} - G06F 21/54: by adding security routines or objects to programs - G06F 21/563: {by source code analysis} - G06F 21/568: {eliminating virus, restoring damaged files} - G06N 3/045: Combinations of networks - G06N 3/0464: Convolutional networks [CNN, ConvNet] - G06N 3/08: Learning methods - G06N 3/09: Supervised learning - G06N 20/00: Machine learning - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS ## Abstract Methods, apparatus, systems, and articles of manufacture are disclosed to improve detection of malware in executable code. Examples disclosed herein include an apparatus comprising: a log file filtration controller to exclude at least one known clean function from a log file to generate a filtered log file; a log file normalization controller to normalize mnemonics of functions in the filtered log file to generate normalized functions; a feature vector generation controller to populate a feature vector with n-gram groupings of the normalized functions; and a machine learning engine to train a machine learning model with the feature vector, the machine learning model to be deployed to an end-user device to detect malware in executable code. ## Claims ### Claim 1 An apparatus comprising: a communication processor to access a log file, the log file including a memory dump of first functions corresponding to a first portable executable file that failed to execute in a sandbox environment; a log file filtration controller to exclude at least one known clean function from the first functions of the log file to generate a filtered log file; a log file normalization controller to generate normalized arguments of second functions of the filtered log file, the log file normalization controller to: identify a first argument of a first function of the second functions of the filtered log file; determine a data type of the first argument of the first function; identify a placeholder representative of the data type of the first argument; and replace the first argument of the first function with the placeholder representative of the data type of the first argument to generate a first normalized argument of the normalized arguments; a feature vector generation controller to: generate an empty version of a feature vector; and after generating the empty version of the feature vector, populate the feature vector with n-gram groupings of the second functions having the normalized arguments; and a machine learning engine to train, using stochastic gradient descent, a machine learning model with the feature vector, the machine learning model to be deployed to an end-user device to detect malware in a second portable executable file. ### Claim 2 (depends on 1) The apparatus of claim 1, wherein the first functions include low-level programming language functions corresponding to the first portable executable file, and failure to execute the first portable executable file in the sandbox environment includes a crash of the first portable executable file at a computer implementing the sandbox environment. ### Claim 3 (depends on 1) The apparatus of claim 1, wherein the n-gram groupings include bigram groupings. ### Claim 4 (depends on 1) The apparatus of claim 1, wherein the feature vector is to reduce latency between a query of the machine learning model and an inference of whether the second portable executable file is malicious or benign. ### Claim 5 A non-transitory computer readable storage medium comprising instructions which, when executed, cause one or more processors to at least: access a log file, the log file including a memory dump of first functions corresponding to a first portable executable file that failed to execute in a sandbox environment; exclude at least one known clean function from the first functions of the log file to generate a filtered log file including second functions; identify a first argument of a first function of the second functions of the filtered log file; determine a data type of the first argument of the first function; identify a placeholder representative of the data type of the first argument; replace the first argument of the first function with the placeholder representative of the data type of the first argument; generate normalized arguments using at least the first replaced argument; generate an empty version of a feature vector; after generating the empty version of the feature vector, populate the feature vector with n-gram groupings of the second functions having the normalized arguments; and train, using stochastic gradient descent, a machine learning model with the feature vector, the machine learning model to be deployed to an end-user device to detect malware in a second portable executable file. ### Claim 6 (depends on 5) The non-transitory computer readable storage medium of claim 5, wherein the first functions include low-level programming language functions corresponding to the first portable executable file, and failure to execute the first portable executable file in the sandbox environment includes a crash of the first portable executable file at a computer implementing the sandbox environment. ### Claim 7 (depends on 5) The non-transitory computer readable storage medium of claim 5, wherein the n-gram groupings include bigram groupings. ### Claim 8 (depends on 5) The non-transitory computer readable storage medium of claim 5, wherein the feature vector is to reduce latency between a query of the machine learning model and an inference of whether the second portable executable file is malicious or benign. ### Claim 9 An apparatus comprising: means for processing communications to access a log file, the log file including a memory dump of first functions corresponding to a first portable executable file that failed to execute in a sandbox environment; means for filtering log files to exclude at least one known clean function from the first functions of the log file to generate a filtered log file; means for normalizing log files to generate normalized arguments of second functions of the filtered log file, the means for normalizing log files is to: identify a first argument of a first function of the second functions of the filtered log file; determine a data type of the first argument of the first function; identify a placeholder representative of the data type of the first argument; and replace the first argument of the first function with the placeholder representative of the data type of the first argument to generate a first normalized argument of the normalized arguments; means for generating feature vectors to: generate an empty version of a feature vector; and after generating the empty version of the feature vector, populate the feature vector with n-gram groupings of the second functions having the normalized arguments; and means for training a machine learning model using stochastic gradient descent based on the feature vector, the machine learning model to be deployed to an end-user device to detect malware in a second portable executable file. ### Claim 10 (depends on 9) The apparatus of claim 9, wherein the first functions include low-level programming language functions corresponding to the first portable executable file, and failure to execute the first portable executable file in the sandbox environment includes a crash of the first portable executable file at a computer implementing the sandbox environment. ### Claim 11 (depends on 9) The apparatus of claim 9, wherein the n-gram groupings include bigram groupings.