US 12,585,935 B2Granted

Execution behavior analysis text-based ensemble malware detector

AssigneePalo Alto Networks, Inc.

InventorsSujit Rokka Chhetri, William Redington Hewlett, II

Life of this patent

Estimating the term…

Loading patent…

Abstract

A malware detector has been designed that uses a combination of NLP techniques on dynamic malware analysis reports for malware classification of files. The malware detector aggregates text-based features identified in different pre-processing pipelines that correspond to different types of properties of a dynamic malware analysis report. From a dynamic malware analysis report, the pre-processing pipelines of the malware detector generate a first feature set based on individual text tokens and a second feature set based on n-grams. The malware detector inputs the first feature set into a trained neural network having an embedding layer. The malware detector then extracts a dense layer from the trained neural network and aggregates the extracted layer with the second feature set to form an input for a trained boosting model. The malware detector inputs the cross-pipeline feature values into the trained boosting model to generate a malware detection output.

Claims23

Dependent claims

A method comprising:

feeding first tokens that have been generated from a dynamic malware analysis report for a file into a trained neural network that includes an embedding layer, wherein the trained neural network has been trained to classify files as malware or benign based on corresponding dynamic malware analysis reports;
extracting first feature values output from a dense layer of the trained neural network after feeding the first tokens into the trained neural network;
generating second feature values based, at least in part, on at least a subset of first n-grams generated from the dynamic malware analysis report and statistical importance values calculated for the subset of first n-grams;
feeding first input into a first trained boosting model,
wherein the first input is based, at least in part, on the first feature values and the second feature values,
wherein the first trained boosting model has been trained to classify files as malware based, at least partly, on n-grams based features, and feature values from dense layers of the trained neural network;
and
indicating whether the file is malware or benign based, at least partly, on output of the first trained boosting model.

5 more elements

A non-transitory, machine-readable medium having program code stored thereon, the program code comprising instructions to:

feed first tokens that have been generated from a dynamic malware analysis report for a file into a trained neural network that includes an embedding layer, wherein the trained neural network has been trained to classify files as malware or benign based on corresponding dynamic malware analysis reports;
extract first feature values output from a dense layer of the trained neural network after feeding the first tokens into the trained neural network;
generate second feature values from at least a subset of first n-grams generated from the dynamic malware analysis report and from statistical importance values calculated for the subset of first n-grams;
feed first input into a first trained boosting model,
wherein the first input is based, at least in part, on the first feature values and the second feature values,
wherein the first trained boosting model has been trained to classify files as malware based, at least partly, on n-grams based features, and feature values from dense layers of the trained neural network;
and
indicate whether the file is malware or benign based, at least partly, on output of the first trained boosting model.

5 more elements

An apparatus comprising:

a processor;
and
a machine-readable medium having instructions stored thereon that are executable by the processor to cause the apparatus to,
feed first tokens that have been generated from a dynamic malware analysis report for a file into a trained neural network that includes an embedding layer, wherein the trained neural network has been trained to classify files as malware or benign based on corresponding dynamic malware analysis reports;
extract first feature values output from a dense layer of the trained neural network after feeding the first tokens into the trained neural network;
generate second feature values from at least a subset of first n-grams generated from the dynamic malware analysis report and from statistical importance values calculated for the subset of first n-grams;
feed first input into a first trained boosting model,
wherein the first input is based, at least in part, on the first feature values and the second feature values,
wherein the first trained boosting model has been trained to classify files as malware based, at least partly, on n-grams based features, and feature values from dense layers of the trained neural network;
and
indicate whether the file is malware or benign based, at least partly, on output of the first trained boosting model.

8 more elements

Dependencies are inferred from the claim text.

Facts

Application: 17/172,519Filed 10 Feb 2021
Published: US 2022/0253691 A111 Aug 2022
Granted: 24 Mar 2026
Term ends: Not estimatedThe source records don’t support an estimate.

Classification13 codes

G06F 21/561
Computer malware detection or handling, e.g. anti-virus arrangements: virus type analysis
G06N 3/08
Neural networks: learning methods
G06F 21/56
Detecting local intrusion or implementing counter-measures: computer malware detection or handling, e.g. anti-virus arrangements
G06F 21/562
Computer malware detection or handling, e.g. anti-virus arrangements: static detection