# US 12,717,969 B2 · Methods and apparatus to translate hash-based signature signals for machine learning applications

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,717,969 B2
- Document ID: US12717969B2
- Status: Granted
- Kind: B2
- Application number: 17/894,919
- Filed: 2022-08-24
- Published: 2024-02-29
- Granted: 2026-08-25
- Earliest claimed: 2022-08-24
- Assignees: McAfee, Inc.
- Applicants: McAfee, LLC
- Inventors: German Lancioni; Steve Grobman; Jonathan King
- Web page: https://patentgrep.com/patent/US12717969B2

## CPC

- G06F 21/64: Protecting data integrity, e.g. using checksums, certificates or signatures
- G06F 18/214: Generating training patterns; Bootstrap methods, e.g. bagging or boosting
- G06F 18/22: Matching criteria, e.g. proximity measures
- G06F 18/23: Clustering techniques
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

Methods, apparatus, systems, and articles of manufacture are disclosed to translate hash-based signature signals for machine learning applications. In one example, the apparatus includes a processor to execute instructions to determine an element count for a plurality of hash elements of a locality sensitivity hash, preserve ones of hash elements of the plurality of hash elements that satisfy an element count threshold, and produce a cluster of encoded feature vectors of the preserved ones of the hash elements. The processor further to execute instructions to determine an occurrence frequency of hash elements in the cluster and create a synthetic hash of the cluster based on a subset of the hash elements in the cluster that satisfy an occurrence frequency threshold.

## Claims

### Claim 1

An apparatus comprising:
interface circuitry to communicatively couple a processor circuitry and a memory;
computer readable instructions; and
programmable circuitry to instantiate:
hash element counter circuitry to determine an element count for a plurality of hash elements of a locality sensitivity hash;
hash element preservation circuitry to preserve ones of hash elements of the plurality of hash elements that satisfy an element count threshold;
feature vector encoder circuitry to compare a hash element of the plurality of hash elements to the preserved ones of the hash elements and to encode at least one feature vector including the hash element at a location of the hash element based on the hash element being one of the preserved ones of the hash elements;
cluster production circuitry to produce a cluster of encoded feature vectors based on the at least one feature vector;
element occurrence determination circuitry to determine an occurrence frequency of hash elements in the cluster; and
synthetic hash creation circuitry to create a synthetic hash of the cluster based on a subset of the hash elements in the cluster that satisfy an occurrence frequency threshold, wherein the synthetic hash includes a hash element for a group of similar hash elements that satisfy the occurrence frequency threshold, the synthetic hash to represent relevant features of the plurality of hash elements.

### Claim 2 (depends on 1)

The apparatus of claim 1, wherein the locality sensitive hash is one of a plurality of locality sensitive hashes, and wherein the programmable circuitry is to instantiate locality sensitive hash obtainment circuitry to obtain the plurality of locality sensitive hashes corresponding to sections in a plurality of training samples, the plurality of training samples in a training dataset, wherein ones of the plurality of locality sensitive hashes include a plurality of hash elements.

### Claim 3 (depends on 2)

The apparatus of claim 2, wherein the programmable circuitry is to instantiate:
resemblance computing circuitry to compute a plurality of resemblances between each of the plurality of locality sensitivity hashes and the synthetic hash, each of the plurality of resemblances corresponding to a list of features;
resemblance sorting circuitry to sort the plurality of resemblances based on similarity value; and
resemblance incorporation circuitry to incorporate one or more resemblances of the plurality of resemblances into a feature set for the training dataset of samples, wherein the one or more resemblances of the plurality of resemblances satisfy a similarity value threshold.

### Claim 4 (depends on 3)

The apparatus of claim 3, wherein the plurality of resemblances is a first plurality of a resemblances, wherein the list of features is a first list of features, wherein the feature set is a first feature set, and wherein the programmable circuitry is to instantiate:
the resemblance computing circuitry to compute, using at least the first feature set, a second plurality of resemblances between the plurality of locality sensitivity hashes and the synthetic hash, the second plurality of resemblances corresponding to a second list of features;
the resemblance sorting circuitry to sort the second plurality of resemblances based on similarity value; and
resemblance incorporation circuitry to incorporate one or more resemblances of the second plurality of resemblances into a second feature set for a testing dataset of samples, wherein the one or more resemblances of the second plurality of resemblances satisfy the similarity value threshold.

### Claim 5 (depends on 3)

The apparatus of claim 3, wherein to compute a plurality of resemblances between the plurality of locality sensitivity hashes and the synthetic hash further includes the programmable circuitry is to instantiate the resemblance computing circuitry to compute a Jaccard distance between the plurality of locality sensitivity hashes and the synthetic hash.

### Claim 6 (depends on 5)

The apparatus of claim 5, wherein to obtain a plurality of locality sensitivity hashes further includes the programmable circuitry is to instantiate the locality sensitive hash obtainment circuitry to compute a MinHash for ones of the corresponding section of the plurality of training samples.

### Claim 7 (depends on 6)

The apparatus of claim 6, wherein to determine an occurrence frequency of the ones of the plurality of hash elements in the cluster further includes the programmable circuitry is to instantiate the element occurrence determination circuitry to determine one of a mode or a weighted mode of the ones of the plurality of hash elements in the cluster.

### Claim 8

A non-transitory machine readable storage medium comprising instructions that, when executed, cause processor circuitry to at least:
determine an element count for a plurality of hash elements of a locality sensitivity hash;
preserve ones of hash elements of the plurality of hash elements that satisfy an element count threshold;
compare a hash element of the plurality of hash elements to the preserved ones of the hash elements;
encode at least one feature vector including the hash element at a location of the hash element based on the hash element being one of the preserved ones of the hash elements;
produce a cluster of encoded feature vectors based on the at least one feature vector;
determine an occurrence frequency of hash elements in the cluster; and
create a synthetic hash of the cluster based on a subset of the hash elements in the cluster that satisfy an occurrence frequency threshold, wherein the synthetic hash includes a hash element for a group of similar hash elements that satisfy the occurrence frequency threshold, the synthetic hash to represent relevant features of the plurality of hash elements.

### Claim 9 (depends on 8)

The non-transitory machine readable storage medium of claim 8, wherein the locality sensitive hash is one of a plurality of locality sensitive hashes, including instructions that, when executed, cause processor circuitry to at least obtain the plurality of locality sensitive hashes corresponding to sections in a plurality of training samples, the plurality of training samples in a training dataset, wherein ones of the plurality of locality sensitive hashes include a plurality of hash elements.

### Claim 10 (depends on 9)

The non-transitory machine readable storage medium of claim 9, including instructions that, when executed, cause processor circuitry to at least:
compute a plurality of resemblances between each of the plurality of locality sensitivity hashes and the synthetic hash, each of the plurality of resemblances corresponding to a list of features;
sort the plurality of resemblances based on similarity value; and
incorporate one or more resemblances of the plurality of resemblances into a feature set for the training dataset of samples, wherein the one or more resemblances of the plurality of resemblances satisfy a similarity value threshold.

### Claim 11 (depends on 10)

The non-transitory machine readable storage medium of claim 10, wherein the plurality of resemblances is a first plurality of a resemblances, wherein the list of features is a first list of features, wherein the feature set is a first feature set, including instructions that, when executed, cause processor circuitry to at least:
compute, using at least the first feature set, a second plurality of resemblances between the plurality of locality sensitivity hashes and the synthetic hash, the second plurality of resemblances corresponding to a second list of features;
sort the second plurality of resemblances based on similarity value; and
incorporate one or more resemblances of the second plurality of resemblances into a second feature set for a testing dataset of samples, wherein the one or more resemblances of the second plurality of resemblances satisfy the similarity value threshold.

### Claim 12 (depends on 10)

The non-transitory machine readable storage medium of claim 10, including instructions that, when executed, cause processor circuitry to at least compute a Jaccard distance between the plurality of locality sensitivity hashes and the synthetic hash.

### Claim 13 (depends on 12)

The non-transitory machine readable storage medium of claim 12, including instructions that, when executed, cause processor circuitry to at least compute a MinHash for ones of the corresponding section of the plurality of training samples.

### Claim 14 (depends on 13)

The non-transitory machine readable storage medium of claim 13, including instructions that, when executed, cause processor circuitry to at least determine one of a mode or a weighted mode of the ones of the plurality of hash elements in the at least cluster.

### Claim 15

An apparatus comprising:
at least one memory;
machine readable instructions; and
processor circuitry to at least one of instantiate or execute the machine readable instructions to:
group ones of a plurality of locality sensitive hashes that are equal into a first locality sensitive hash group, the first locality sensitive hash group corresponding to a first locality sensitive hash of the plurality of locality sensitive hashes;
add the first locality sensitive hash to a list of anchor candidates in response to the first locality sensitive hash satisfying a minimum group maliciousness percentage, where the minimum group maliciousness percentage is based on a number of the ones of the plurality of locality sensitive hashes associated with a malicious origin;
compute a plurality of resemblances of the locality sensitivity hash to a plurality of anchor candidates in the list of anchor candidates;
sort the plurality of resemblances based on similarity value; and
incorporate a first resemblance of the plurality of resemblances into a feature set for a training dataset of samples, wherein the first resemblance satisfies a similarity value threshold.

### Claim 16 (depends on 15)

The apparatus of claim 15, including the processor circuitry to at least one of instantiate or execute the machine readable instructions to obtain the plurality of locality sensitive hashes from the training dataset of samples.

### Claim 17 (depends on 16)

The apparatus of claim 16, including the processor circuitry to at least one of instantiate or execute the machine readable instructions to compute a MinHash for ones of corresponding sections of the plurality of the training dataset of samples.

### Claim 18 (depends on 15)

The apparatus of claim 15, wherein the plurality of resemblances is a first plurality of a resemblances, the feature set is a first feature set, including the processor circuitry to at least one of instantiate or execute the machine readable instructions to:
compute, using the first feature set, a second plurality of resemblances between the plurality of locality sensitive hashes and the at least one of the minimum group maliciousness percentage or the minimum group sample threshold;
sort the second plurality of resemblances based on similarity value; and
incorporate a second resemblance that satisfies the similarity value threshold into a second feature set for a testing dataset.

### Claim 19 (depends on 15)

The apparatus of claim 15, including the processor circuitry to at least one of instantiate or execute the machine readable instructions to compute a Jaccard distance between the plurality of locality sensitivity hashes and the plurality of anchor candidates in the list of anchor candidates.

### Claim 20 (depends on 15)

The apparatus of claim 15, wherein the processor circuitry is to add the first locality sensitive hash to the list of anchor candidates in response to the first locality sensitive hash satisfying both of the minimum group maliciousness percentage and the minimum group sample threshold.

### Claim 21

A non-transitory machine readable storage medium comprising instructions that, when executed, cause processor circuitry to at least:
obtain a plurality of locality sensitive hashes from a training dataset of samples;
group ones of a plurality of locality sensitive hashes that are equal into a first locality sensitive hash group, the first locality sensitive hash group corresponding to a first locality sensitive hash of the plurality of locality sensitive hashes;
add the first locality sensitive hash to a list of anchor candidates in response to the first locality sensitive hash satisfying a minimum group maliciousness percentage, where the minimum group maliciousness percentage is based on a number of the ones of the plurality of locality sensitive hashes associated with a malicious origin;
compute a plurality of resemblances of the locality sensitivity hash to a plurality of anchor candidates in the list of anchor candidates;
sort the plurality of resemblances based on similarity value; and
incorporate a first resemblance of the plurality of resemblances into a feature set for the training dataset of samples, wherein the first resemblance satisfies a similarity value threshold.

### Claim 22 (depends on 21)

The non-transitory machine readable storage medium of claim 21, including instructions that, when executed, cause processor circuitry to at least compute a MinHash for ones of corresponding sections of the plurality of the training dataset of samples.

### Claim 23 (depends on 21)

The non-transitory machine readable storage medium of claim 21, wherein the plurality of resemblances is a first plurality of a resemblances, the feature set is a first feature set, including instructions that, when executed, cause processor circuitry to at least:
compute, using the first feature set, a second plurality of resemblances between the plurality of locality sensitive hashes and the at least one of the minimum group maliciousness percentage or the minimum group sample threshold;
sort the second plurality of resemblances based on similarity value; and
incorporate a second resemblance that satisfies the similarity value threshold into a second feature set for a testing dataset.