# US 12,131,237 B2 · System and method for machine learning model determination and malware identification > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,131,237 B2 - Document ID: US12131237B2 - Status: Granted - Kind: B2 - Application number: 17/930,827 - Filed: 2022-09-09 - Published: 2023-07-13 - Granted: 2024-10-29 - Earliest claimed: 2015-07-31 - Assignees: BluVector, Inc. - Applicants: Bluvector, Inc. - Inventors: Scott B. Miserendino; Robert H. Klein; Ryan V. Peters; Peter E. Kaloroumakis - Web page: https://patentgrep.com/patent/US12131237B2 ## CPC - G06N 20/00: Machine learning - G06F 21/56: Computer malware detection or handling, e.g. anti-virus arrangements - G06F 21/566: {Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities} - G06N 5/04: Inference or reasoning models - H04W 12/128: Anti-malware arrangements, e.g. protection against SMS fraud or mobile malware - G06F 11/3006: {where the computing system is distributed, e.g. networked systems, clusters, multiprocessor systems (multiprogramming arrangements G06F9/46; allocation of resources G06F9/50)} - G06F 2221/033: Test or assess software - G06F 2221/2107: File encryption - G06F 2221/2115: Third party - H04L 63/1433: {Vulnerability analysis} - G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A system and method for batched, supervised, in-situ machine learning classifier retraining for malware identification and model heterogeneity. The method produces a parent classifier model in one location and providing it to one or more in-situ retraining system or systems in a different location or locations, adjudicates the class determination of the parent classifier over the plurality of the samples evaluated by the in-situ retraining system or systems, determines a minimum number of adjudicated samples required to initiate the in-situ retraining process, creates a new training and test set using samples from one or more in-situ systems, blends a feature vector representation of the in-situ training and test sets with a feature vector representation of the parent training and test sets, conducts machine learning over the blended training set, evaluates the new and parent models using the blended test set and additional unlabeled samples, and elects whether to replace the parent classifier with the retrained version. ## Claims ### Claim 1 A method comprising: receiving first information associated with a first plurality of files associated with a first organization, wherein the first information does not comprise sensitive data associated with the first plurality of files; based on the first information and second information associated with a second plurality of files associated with a second organization, training a machine learning model usable by the second organization for classifying files as comprising malicious content or benign content; receiving a file comprising unknown content; and causing output of an indication that the file comprises malicious content. ### Claim 2 (depends on 1) The method of claim 1, wherein the first information comprises a first feature vector representation of the first plurality of files. ### Claim 3 (depends on 2) The method of claim 2, wherein the first feature vector representation comprises non-sensitive data associated with the first organization. ### Claim 4 (depends on 1) The method of claim 1, wherein the first plurality of files is associated with a first plurality of adjudicated classifications. ### Claim 5 (depends on 1) The method of claim 1, wherein the training uses at least a portion of each of the first information and the second information to form a training data set. ### Claim 6 (depends on 5) The method of claim 5, further comprising: receiving an indication of an amount of each portion of each of the first information and the second information to be used in the training data set. ### Claim 7 (depends on 1) The method of claim 1, wherein the first information indicates at least one of a file header property, a component of a file, or a binary sequence. ### Claim 8 A device comprising: one or more processors; and memory storing instructions that, when executed by the one or more processors, cause the device to: receive first information associated with a first plurality of files associated with a first organization, wherein the first information does not comprise sensitive data associated with the first plurality of files; based on the first information and second information associated with a second plurality of files associated with a second organization, train a machine learning model usable by the second organization for classifying files as comprising malicious content or benign content; receive a file comprising unknown content; and cause output of an indication that the file comprises malicious content. ### Claim 9 (depends on 8) The device of claim 8, wherein the first information comprises a first feature vector representation of the first plurality of files. ### Claim 10 (depends on 9) The device of claim 9, wherein the first feature vector representation comprises non-sensitive data associated with the first organization. ### Claim 11 (depends on 8) The device of claim 8, wherein the first plurality of files is associated with a first plurality of adjudicated classifications. ### Claim 12 (depends on 8) The device of claim 8, wherein the training uses at least a portion of each of the first information and the second information to form a training data set. ### Claim 13 (depends on 12) The device of claim 12, wherein the instructions, when executed by the one or more processors, further cause the device to: receive an indication of an amount of each portion of each of the first information and the second information to be used in the training data set. ### Claim 14 (depends on 8) The device of claim 8, wherein the first information indicates at least one of a file header property, a component of a file, or a binary sequence. ### Claim 15 A non-transitory computer-readable storage medium storing computer-readable instructions that, when executed by one or more processors, cause: receiving first information associated with a first plurality of files associated with a first organization, wherein the first information does not comprise sensitive data associated with the first plurality of files; based on the first information and second information associated with a second plurality of files associated with a second organization, training a machine learning model usable by the second organization for classifying files as comprising malicious content or benign content; receiving a file comprising unknown content; and causing output of an indication that the file comprises malicious content. ### Claim 16 (depends on 15) The non-transitory computer-readable storage medium of claim 15, wherein the first information comprises a first feature vector representation of the first plurality of files, wherein the first feature vector representation comprises non-sensitive data associated with the first organization. ### Claim 17 (depends on 15) The non-transitory computer-readable storage medium of claim 15, wherein the first plurality of files is associated with a first plurality of adjudicated classifications. ### Claim 18 (depends on 15) The non-transitory computer-readable storage medium of claim 15, wherein the training uses at least a portion of each of the first information and the second information to form a training data set. ### Claim 19 (depends on 18) The non-transitory computer-readable storage medium of claim 18, wherein the instructions, when executed, further cause: receiving an indication of an amount of each portion of each of the first information and the second information to be used in the training data set. ### Claim 20 (depends on 15) The non-transitory computer-readable storage medium of claim 15, wherein the first information indicates at least one of a file header property, a component of a file, or a binary sequence. ### Claim 21 A system comprising: at least one first computer device configured to: receive first information associated with a first plurality of files associated with a first organization, wherein the first information does not comprise sensitive data associated with the first plurality of files; based on the first information and second information associated with a second plurality of files associated with a second organization, train a machine learning model usable by the second organization for classifying files as comprising malicious content or benign content; receive a file comprising unknown content; and cause output of an indication that the file comprises malicious content; and at least one second computer device configured to: send, to the first computer device, the first information. ### Claim 22 (depends on 21) The system of claim 21, wherein the first information comprises a first feature vector representation of the first plurality of files. ### Claim 23 (depends on 22) The system of claim 22, wherein the first feature vector representation comprises non-sensitive data associated with the first organization. ### Claim 24 (depends on 21) The system of claim 21, wherein the first plurality of files is associated with a first plurality of adjudicated classifications. ### Claim 25 (depends on 21) The system of claim 21, wherein the training uses at least a portion of each of the first information and the second information to form a training data set. ### Claim 26 (depends on 25) The system of claim 25, wherein the instructions, when executed by the one or more processors, further cause the device to: receive an indication of an amount of each portion of each of the first information and the second information to be used in the training data set. ### Claim 27 (depends on 21) The system of claim 21, wherein the first information indicates at least one of a file header property, a component of a file, or a binary sequence.