Back to results
US 12,613,962 B2Granted
Multi-level malware classification machine-learning method and system
AssigneeUab 360 It
InventorMantas Briliauskas
Life of this patent
Estimating the term…
Abstract
A cyber security method and system for detecting malware via an anti-malware application employing a fast locality-sensitive hashing evaluation using a vantage-point tree (VPT) structure for the indication of malicious files and non-malicious files. The locality-sensitive hashing evaluation using the VPT structure can be performed prior to initiating the deeper, more computationally intensive evaluation and is used to identify with high confidence a scanned file or data object being a malicious file, a non-malicious file, or a low confidence measure of the two.
Claims20
A system comprising:
- one or more processors;
- and
- memory having instructions stored thereon that, when executed by the one or more processors, cause the system to:
- generate, using a locality-sensitive hashing operation, fuzzy hashes for a first set of files that are known to be malicious and a second set of files that are known to be non-malicious;
- receive, from a remote device, fuzzy hashes for a third set of files that are local to the remote device, wherein the fuzzy hashes for the third set of files are generated by the remote device using the locality-sensitive hashing operation;
- determine a first malware classification output for each of the third set of files by assessing the fuzzy hashes of each of the third set of files using one or more vantage-point tree structures, wherein fuzzy hashes of each of the third set of files are assessed with respect to the fuzzy hashes of the first set of files and the second set of files;
- determine a second malware classification output for each of the third set of files by assessing additional characteristics of each of the third set of files using a machine learning model;
- and
- generate a prediction of whether each of the third set of files is malicious or not malicious based on the first malware classification output and the second malware classification output.
6 more elements
A method for malware detection, the method comprising:
- generating, by a first computing device, using a locality-sensitive hashing operation, fuzzy hashes for a first set of files that are known to be malicious and a second set of files that are known to be non-malicious;
- receiving, by the first computing device, from a remote device, fuzzy hashes for a third set of files that are local to the remote device, wherein the fuzzy hashes for the third set of files are generated by the remote device using the locality-sensitive hashing operation;
- determining, by the first computing device, a first malware classification output for each of the third set of files by assessing the fuzzy hashes of each of the third set of files using one or more vantage-point tree structures, wherein fuzzy hashes of each of the third set of files are assessed with respect to the fuzzy hashes of the first set of files and the second set of files;
- determining, by the first computing device, a second malware classification output for each of the third set of files by assessing additional characteristics of each of the third set of files using a machine learning model;
- and
- generating, by the first computing device, a prediction of whether each of the third set of files is malicious or not malicious based on the first malware classification output and the second malware classification output.
3 more elements
A non-transitory computer readable medium having instructions stored thereon that, when executed by one or more processors, cause a device to:
- generate, using a locality-sensitive hashing operation, fuzzy hashes for a first set of files that are known to be malicious and a second set of files that are known to be non-malicious;
- receive, from a remote device, fuzzy hashes for a third set of files that are local to the remote device, wherein the fuzzy hashes for the third set of files are generated by the remote device using the locality-sensitive hashing operation;
- determine a first malware classification output for each of the third set of files by assessing the fuzzy hashes of each of the third set of files using one or more vantage-point tree structures, wherein fuzzy hashes of each of the third set of files are assessed with respect to the fuzzy hashes of the first set of files and the second set of files;
- determine a second malware classification output for each of the third set of files by assessing additional characteristics of each of the third set of files using a machine learning model;
- and
- predict whether each of the third set of files is malicious or not malicious based on the first malware classification output and the second malware classification output.
3 more elements
Dependencies are inferred from the claim text.