US 12,443,710 B2 · System and method for automated machine-learning, zero-day malware detection

Abstract

Improved systems and methods for automated machine-learning, zero-day malware detection. Embodiments include a system and method for detecting malware using multi-stage file-typing and, optionally pre-processing, with fall-through options. The system and method receive a set of training files which are each known to be either malign or benign, partition the set of training files into a plurality of categories based on file-type, in which the partitioning file-types a subset of the training files into supported file-type categories, train file-type specific classifiers that distinguish between malign and benign files for the supported file-type categories of files, associate supported file-types with a file-type processing chain that includes a plurality of file-type specific classifiers corresponding to the supported file-types, train a generic file-type classifier that applies to file-types that are not supported file-types, and construct a composite classifier using the file-type specific classifiers and the generic file-type classifier.

Claims19

Dependent claims

A method comprising:

determining, based at least on a file structure associated with each of a plurality of training files known to be malign or benign, a subset of the plurality of training files that are associated with a first file-type of a plurality of file-types;
training, based on the subset of the plurality of training files, a first classifier to determine whether files of the first file-type are at least malign or benign;
training, based on the plurality of training files, a second classifier to determine whether files of the plurality of file-types are at least malign or benign;
selecting, based on determining that a first file is associated with the first file-type, the first classifier to determine whether the first file is malign or benign;
causing, based on the determining whether the first file is malign or benign, access to the first file to be blocked or permitted;
selecting, based on a failure to determine if a second file is associated with the first file-type, the second classifier to determine whether the second file is malign or benign;
and
causing, based on the determining whether the second file is malign or benign, access to the second file to be blocked or permitted.

5 more elements

Dependencies are inferred from the claim text.

System and method for automated machine-learning, zero-day malware detection

Life of this patent

System and method for automated machine-learning, zero-day malware detection

Life of this patent

Abstract

Claims19