# US 12,602,309 B2 · Detecting unwanted software using a machine learning operation > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,602,309 B2 - Document ID: US12602309B2 - Status: Granted - Kind: B2 - Application number: 18/465,391 - Filed: 2023-09-12 - Published: 2025-03-13 - Granted: 2026-04-14 - Earliest claimed: 2023-09-12 - Assignees: Cylance Inc. - Applicants: Cylance Inc. - Inventors: Julian Collado Umana; Aaron Mark Tresch Fienberg - Web page: https://patentgrep.com/patent/US12602309B2 ## CPC - G06F 11/362: Debugging of software - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Systems, methods, and software can be used to determine whether a software code is unwanted. In some aspects, a method includes: obtaining, by an electronic device, a set of software features of a software code; obtaining, by the electronic device, a set of user features of a user of the electronic device; and determining, by the electronic device, a classification score of the software code based on the set of software features and the set of the user features, wherein the classification score indicates whether the software code is potentially unwanted for the user. ## Claims ### Claim 1 A method, comprising: obtaining, by an electronic device, a set of software features of a software code; obtaining, by the electronic device, a set of user features of a user of the electronic device; and determining, by the electronic device, a classification score of the software code based on the set of software features and the set of the user features, wherein the classification score indicates whether the software code is potentially unwanted for the user, wherein the determining the classification score comprises: obtaining a software output vector by using a first machine learning model to process a software feature vector representing the set of software features of the software code; obtaining a user output vector by using a second machine learning model to process a user feature vector representing the set of user features of the user, wherein the software feature vector and the user feature vector have different lengths, and the user output vector and the software output vector have a same length; and determining the classification score of the software code based on the software output vector and the user output vector; and outputting an indication indicating whether the software code is potentially unwanted for the user. ### Claim 2 (depends on 1) The method of claim 1, wherein the determining the classification score comprises: determining the software feature vector based on the set of software features; and determining the user feature vector based on the set of user features. ### Claim 3 (depends on 1) The method of claim 1, wherein the determining the classification score comprises: sending the set of software features and the set of user features to a server; and in response to the sending of the set of software features and the set of user features, receiving the software feature vector and the user feature vector from the server. ### Claim 4 (depends on 1) The method of claim 1, further comprising: comparing the classification score with a threshold score; and in response to determining that the classification score meets the threshold score, allowing access to the software code. ### Claim 5 (depends on 1) The method of claim 1, wherein the set of user features comprises a name of the user, a geographic location of the user, and an employer of the user. ### Claim 6 (depends on 1) The method of claim 1, wherein the set of user features comprises information of a browsing history, an access history, an application installation history, and an application usage history of the user. ### Claim 7 (depends on 1) The method of claim 1, wherein the set of user features comprises information of a hardware configuration of the electronic device and a software configuration of the electronic device. ### Claim 8 (depends on 1) The method of claim 1, wherein the set of software features comprises a file size of the software code, a file format of the software code, and a second indication indicating whether the software code is binary code or source code. ### Claim 9 (depends on 1) The method of claim 1, wherein the set of software features comprises at least a part of the software code. ### Claim 10 A non-transitory computer-readable medium containing instructions which, when executed, cause an electronic device to perform operations comprising: obtaining a set of software features of a software code; obtaining a set of user features of a user of the electronic device; and determining a classification score of the software code based on the set of software features and the set of the user features, wherein the classification score indicates whether the software code is potentially unwanted for the user, wherein the determining the classification score comprises: obtaining a software output vector by using a first machine learning model to process a software feature vector representing the set of software features of the software code; obtaining a user output vector by using a second machine learning model to process a user feature vector representing the set of user features of the user, wherein the software feature vector and the user feature vector have different lengths, and the user output vector and the software output vector have a same length; and determining the classification score of the software code based on the software output vector and the user output vector; and outputting an indication indicating whether the software code is potentially unwanted for the user. ### Claim 11 (depends on 10) The computer-readable medium of claim 10, wherein the determining the classification score comprises: determining the software feature vector based on the set of software features; and determining the user feature vector based on the set of user features. ### Claim 12 (depends on 10) The computer-readable medium of claim 10, wherein the determining the classification score comprises: sending the set of software features and the set of user features to a server; and in response to the sending of the set of software features and the set of user features, receiving the software feature vector and the user feature vector from the server. ### Claim 13 (depends on 10) The computer-readable medium of claim 10, the operations further comprising: comparing the classification score with a threshold score; and in response to determining that the classification score meets the threshold score, allowing access to the software code. ### Claim 14 A computer-implemented system, comprising: one or more computers; and one or more computer memory devices interoperably coupled with the one or more computers and having tangible, non-transitory, machine-readable media storing one or more instructions that, when executed by the one or more computers, perform one or more operations comprising: obtaining a set of software features of a software code; obtaining a set of user features of a user of an electronic device; and determining a classification score of the software code based on the set of software features and the set of the user features, wherein the classification score indicates whether the software code is potentially unwanted for the user, wherein the determining the classification score comprises: obtaining a software output vector by using a first machine learning model to process a software feature vector representing the set of software features of the software code; obtaining a user output vector by using a second machine learning model to process a user feature vector representing the set of user features of the user, wherein the software feature vector and the user feature vector have different lengths, and the user output vector and the software output vector have a same length; and determining the classification score of the software code based on the software output vector and the user output vector; and outputting an indication indicating whether the software code is potentially unwanted for the user. ### Claim 15 (depends on 14) The computer-implemented system of claim 14, wherein the determining the classification score comprises: determining the software feature vector based on the set of software features; and determining the user feature vector based on the set of user features. ### Claim 16 (depends on 14) The computer-implemented system of claim 14, wherein the determining the classification score comprises: sending the set of software features and the set of user features to a server; and in response to the sending of the set of software features and the set of user features, receiving the software feature vector and the user feature vector from the server. ### Claim 17 (depends on 14) The computer-implemented system of claim 14, the operations further comprising: comparing the classification score with a threshold score; and in response to determining that the classification score meets the threshold score, allowing access to the software code.