# US 12,717,879 B2 · Targeted clustering using meta-buckets

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,717,879 B2
- Document ID: US12717879B2
- Status: Granted
- Kind: B2
- Application number: 18/401,180
- Filed: 2023-12-29
- Published: 2024-09-19
- Granted: 2026-08-25
- Earliest claimed: 2023-03-17
- Assignees: McAfee, Inc.
- Applicants: McAfee, LLC
- Inventors: German Lancioni; Steve L. Grobman; Jonathan B. King
- Web page: https://patentgrep.com/patent/US12717879B2

## CPC

- G06F 18/24: Classification techniques
- G06F 9/45558: {Hypervisor-specific management and integration aspects}
- G06F 18/232: Non-hierarchical techniques
- G06F 21/56: Computer malware detection or handling, e.g. anti-virus arrangements
- G06F 2009/45595: {Network integration; Enabling network access in virtual machine instances}
- G06F 2221/034: Test or assess a computer or a system
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

There is disclosed a computer-implemented system and method of classifying a target sample, wherein the target sample is a computer object having a feature vector, the method comprising: creating n sorted containers, comprising sorting a universe of samples based on feature vector distances from the samples to n vantage points, wherein n is a positive integer; storing the n sorted containers to a computer memory; bucketizing the n sorted containers; for the n vantage points, selecting, from the n bucketized sorted containers, n meta-buckets of that the target sample belongs to; creating an intersection container, comprising samples that appear in all n meta-buckets; selecting, as a target cluster, samples from the intersection container that have a feature vector distance from the target sample less than a threshold; and acting on the target cluster.

## Claims

### Claim 1

A computer-implemented method of classifying a target sample, wherein the target sample is a computer object having a feature vector, the method comprising:
creating n sorted containers, comprising sorting a universe of samples based on feature vector distances from the samples to n vantage points, wherein n is a positive integer;
storing the n sorted containers to a computer memory;
bucketizing the n sorted containers;
for the n vantage points, selecting, from the n bucketized sorted containers, n meta-buckets of that the target sample belongs to;
creating an intersection container, comprising samples that appear in all n meta-buckets;
selecting, as a target cluster, samples from the intersection container that have a feature vector distance from the target sample less than a threshold; and
acting on the target cluster.

### Claim 2 (depends on 1)

The method of claim 1, wherein n=1.

### Claim 3 (depends on 1)

The method of claim 1, wherein n>1.

### Claim 4 (depends on 1)

The method of claim 1, wherein n=3.

### Claim 5 (depends on 1)

The method of claim 1, wherein the feature vector distances are locality sensitive hashing (LSH) compliant distances.

### Claim 6 (depends on 5)

The method of claim 5, wherein the LSH compliant distances are TLSH distances.

### Claim 7 (depends on 1)

The method of claim 1, wherein the n meta buckets comprise buckets that have a range that includes distances from the target sample to the n vantage points.

### Claim 8 (depends on 1)

The method of claim 1, wherein the n meta buckets comprise buckets that have a range that includes distances from the target sample to the n vantage points, plus one or more adjacent buckets.

### Claim 9 (depends on 8)

The method of claim 8, wherein selecting the n meta-buckets comprises consolidating buckets that the target sample belongs to with respective adjacent buckets.

### Claim 10 (depends on 1)

The method of claim 1, wherein the n meta buckets comprise buckets that have a range that includes distances from the target sample to the n vantage points, plus a nearest adjacent bucket.

### Claim 11 (depends on 1)

The method of claim 1, wherein selecting samples from the intersection container comprises sorting the intersection container based on distance from the target sample, iterating through samples until a terminal sample is reached that has a feature vector distance greater than the threshold, and discarding the terminal sample from the target cluster.

### Claim 12 (depends on 1)

The method of claim 1, wherein sorting the intersection container based on distance from the target sample comprises computing locality-sensitive hashing (LSH) compliant distances between the samples of the intersection container and the target sample.

### Claim 13 (depends on 1)

The method of claim 1, wherein acting on the target cluster comprises assigning to the target sample a common label of samples in the target cluster.

### Claim 14 (depends on 1)

The method of claim 1, wherein acting on the target cluster comprises assigning to the target sample a majority label of samples in the target cluster.

### Claim 15

One or more tangible, nontransitory computer-readable storage media having stored thereon executable instructions to classify a target sample, wherein the target sample is a computer object having a feature vector, the instructions to:
create n sorted containers, comprising sorting a universe of samples based on feature vector distances from the samples to n vantage points, wherein n is a positive integer;
bucketize the n sorted containers;
for the n vantage points, select, from the n bucketized sorted containers, n meta- buckets of that the target sample belongs to;
create an intersection container, comprising samples that appear in all n meta- buckets;
select, as a target cluster, samples from the intersection container that have a feature vector distance from the target sample less than a threshold; and
act on the target cluster.

### Claim 16 (depends on 15)

The one or more tangible, nontransitory computer-readable storage media of claim 15, wherein the n meta buckets comprise buckets that have a range that includes distances from the target sample to the n vantage points, plus one or more adjacent buckets, and wherein selecting the n meta-buckets comprises consolidating buckets that the target sample belongs to with respective adjacent buckets.

### Claim 17 (depends on 15)

The one or more tangible, nontransitory computer-readable storage media of claim 15, wherein selecting samples from the intersection container comprises sorting the intersection container based on distance from the target sample, iterating through samples until a terminal sample is reached that has a feature vector distance greater than the threshold, and discarding the terminal sample from the target cluster.

### Claim 18

A computing apparatus, comprising:
one or more hardware platforms, comprising one or more processor circuits and one or more memories; and
instructions encoded within the one or more memories to instruct the one or more processor circuits to:
create n sorted containers, comprising sorting a universe of samples based on feature vector distances from the samples to n vantage points, wherein n is a positive integer;
bucketize the n sorted containers;
for the n vantage points, select, from the n bucketized sorted containers, n meta-buckets that a target sample belongs to;
create an intersection container, comprising samples that appear in all n meta-buckets;
select, as a target cluster, samples from the intersection container that have a feature vector distance from the target sample less than a threshold; and
act on the target cluster.

### Claim 19 (depends on 18)

The computing apparatus of claim 18, further comprising a virtualization infrastructure.

### Claim 20 (depends on 18)

The computing apparatus of claim 18, further comprising a containerization infrastructure.