# US 12,762,236 B2 · Techniques for utilizing embeddings to monitor process trees > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,762,236 B2 - Document ID: US12762236B2 - Status: Granted - Kind: B2 - Application number: 18/216,833 - Filed: 2023-06-30 - Published: 2025-01-02 - Granted: 2026-10-13 - Earliest claimed: 2023-06-30 - Assignees: CrowdStrike, Inc. - Applicants: CrowdStrike, Inc. - Inventors: Vasile-Daniel Sava; Paul Sumedrea; Cristian Viorel Popa - Web page: https://patentgrep.com/patent/US12762236B2 ## CPC - G06F 21/566: {Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A process tree embedding is generated corresponding to a process tree. The process tree comprises a plurality of processes. The process tree embedding is processed with a machine learning model to generate an identification of malware associated with the process tree. In some embodiments, processing the process tree embedding with the machine learning model to generate the identification of malware associated with the process tree includes: processing the process tree embedding with the machine learning model to generate a classification of the process tree as being associated with malware; and, responsive to the classification indicating that the process tree is associated with malware, generating the identification of a first process of the plurality of processes that is relevant to the classification of the process tree as being associated with malware. ## Claims ### Claim 1 A method of detecting malware, the method comprising: generating a process tree embedding corresponding to a process tree, the process tree comprising a plurality of processes, wherein generating the process tree embedding comprises: generating, for each of the plurality of processes, a respective process embedding based on metadata associated with that process; and aggregating the respective process embeddings to generate the process tree embedding; and processing, by a processing device, the process tree embedding with a machine learning model to generate an identification of malware associated with the process tree, wherein the processing comprises: identifying a target process, from the plurality of processes, that correspond to an execution associated with the malware; identifying, from the plurality of processes, an ancestor process of the target process that is associated with spawning the target process; and producing, by the machine learning model a natural language explanation that describes, in human-readable terms, which one or more of the plurality of processes in the process tree are relevant in the identification of the malware, the natural language explanation identifying a comparative prioritization of which of the plurality of processes influence a classification of the process tree as being associated with the malware. ### Claim 2 (depends on 1) The method of claim 1, wherein processing the process tree embedding with the machine learning model to generate the identification of malware associated with the process tree comprises: processing the process tree embedding with the machine learning model to generate a classification of the process tree as being associated with malware; and responsive to the classification indicating that the process tree is associated with malware, generating, by the processing device, the identification of the ancestor process of the target process. ### Claim 3 (depends on 1) The method of claim 1, wherein generating the process tree embedding corresponding to the process tree comprises: generating a process embedding corresponding to a first process of the process tree; and generating the process tree embedding based on the process embedding. ### Claim 4 (depends on 3) The method of claim 3, wherein generating the process embedding comprises submitting metadata associated with the first process to a large language model (LLM). ### Claim 5 (depends on 4) The method of claim 4, wherein the metadata comprises at least one of an operating system process identifier (ID) of the first process, a unique generated process ID (UPID) of first process, an operating system process ID of an ancestor in the process tree of first process, a UPID of the ancestor in the process tree of the first process, a filename of an executable image of the first process, a command line used to create the first process, a filename of an executable image of the ancestor in the process tree of the first process, a command line of the ancestor in the process tree of the first process, or an identification of an action that caused a generation of the metadata for the first process. ### Claim 6 (depends on 1) The method of claim 1, wherein generating the process tree embedding corresponding to the process tree comprises: generating process embeddings for each of the plurality of processes of the process tree; and aggregating the process embeddings to generate the process tree embedding. ### Claim 7 (depends on 1) The method of claim 1, wherein generating the process tree embedding corresponding to the process tree comprises: generating the process tree embedding based on respective metadata of each of the plurality of processes of the process tree. ### Claim 8 A system comprising: a memory; and a processing device, operatively coupled to the memory, to: generate a process tree embedding corresponding to a process tree, the process tree comprising a plurality of processes, wherein the processing device is further to: generate, for each of the plurality of processes, a respective process embedding based on metadata associated with that process; and aggregate the respective process embeddings to generate the process tree embedding; and process the process tree embedding with a machine learning model to generate an identification of malware associated with the process tree, the processing device further to: identify a target process, from the plurality of processes, that correspond to an execution associated with the malware; identify, from the plurality of processes, an ancestor process of the target process that is associated with spawning the target process; and produce a natural language explanation that describes, in human-readable terms, which one or more of the plurality of processes in the process tree are relevant in the identification of the malware, the natural language explanation identifying a comparative prioritization of which of the plurality of processes influence a classification of the process tree as being associated with the malware. ### Claim 9 (depends on 8) The system of claim 8, wherein, to generate the process tree embedding corresponding to the process tree, the processing device is to: generate a process embedding corresponding to a first process of the process tree; and generate the process tree embedding based on the process embedding. ### Claim 10 (depends on 9) The system of claim 9, wherein, to generate the process embedding, the processing device is to submit metadata associated with the first process to a large language model (LLM). ### Claim 11 (depends on 10) The system of claim 10, wherein the metadata comprises at least one of an operating system process identifier (ID) of the first process, a unique generated process ID (UPID) of first process, an operating system process ID of an ancestor in the process tree of first process, a UPID of the ancestor in the process tree of the first process, a filename of an executable image of the first process, a command line used to create the first process, a filename of an executable image of the ancestor in the process tree of the first process, a command line of the ancestor in the process tree of the first process, or an identification of an action that caused a generation of the metadata for the first process. ### Claim 12 (depends on 8) The system of claim 8, wherein, to generate the process tree embedding corresponding to the process tree, the processing device is to: generate process embeddings for each of the plurality of processes of the process tree; and aggregate the process embeddings to generate the process tree embedding. ### Claim 13 (depends on 8) The system of claim 8, wherein, to generate the process tree embedding corresponding to the process tree, the processing device is to: generate the process tree embedding based on respective metadata of each of the plurality of processes of the process tree. ### Claim 14 (depends on 8) The system of claim 8, wherein the processing device is further to: responsive to the identification of malware associated with the process tree, initiate remediation on one or more of the plurality of processes of the process tree. ### Claim 15 A non-transitory computer-readable storage medium including instructions that, when executed by a processing device, cause the processing device to: generate a process tree embedding corresponding to a process tree, the process tree comprising a plurality of processes, wherein the processing device is further to: generate, for each of the plurality of processes, a respective process embedding based on metadata associated with that process; and aggregate the respective process embeddings to generate the process tree embedding; and process, by the processing device, the process tree embedding with a machine learning model to generate an identification of malware associated with the process tree, the processing device further to: identify a target process, from the plurality of processes, that correspond to an execution associated with the malware; identify, from the plurality of processes, an ancestor process of the target process that is associated with spawning the target process; and produce a natural language explanation that describes, in human-readable terms, which one or more of the plurality of processes in the process tree are relevant in the identification of the malware, the natural language explanation identifying a comparative prioritization of which of the plurality of processes influence a classification of the process tree as being associated with the malware. ### Claim 16 (depends on 15) The non-transitory computer-readable storage medium of claim 15, wherein, to generate the process tree embedding corresponding to the process tree, the processing device is to: generate a process embedding corresponding to a first process of the process tree; and generate the process tree embedding based on the process embedding. ### Claim 17 (depends on 16) The non-transitory computer-readable storage medium of claim 16, wherein, to generate the process embedding, the processing device is to submit metadata associated with the first process to a large language model (LLM). ### Claim 18 (depends on 15) The non-transitory computer-readable storage medium of claim 15, wherein, to process the process tree embedding with the machine learning model to generate the identification of malware associated with the process tree, the processing device is to: process the process tree embedding with the machine learning model to generate a classification of the process tree as being associated with malware; and responsive to the classification indicating that the process tree is associated with malware, generate the identification of the ancestor process of the target process. ### Claim 19 (depends on 15) The non-transitory computer-readable storage medium of claim 15, wherein, to generate the process tree embedding corresponding to the process tree, the processing device is to: generate process embeddings for each of the plurality of processes of the process tree; and aggregate the process embeddings to generate the process tree embedding. ### Claim 20 (depends on 15) The non-transitory computer-readable storage medium of claim 15, wherein, to generate the process tree embedding corresponding to the process tree, the processing device is to: generate the process tree embedding based on respective metadata of each of the plurality of processes of the process tree.