US 2019/0171816 A1 · FEATURE VECTOR AGGREGATION FOR MALWARE DETECTION

Abstract

A method, apparatus and product performing feature vector aggregation for malware detection. Two sets of measurements produced by a two dynamic analyses of an examined program are obtained, wherein the two dynamic analyses are performed with respect to the examined program executing two different execution paths. An aggregated feature vector representing the examined program is generated. The aggregated feature vector comprises a set of aggregated features, wherein a value of each aggregated feature is based on an aggregation of corresponding measurements in the first set of measurements and in the second set of measurements. A predictive model is applied on the aggregated feature vector to classify the examined program as malicious or benign.

Claims20

Dependent claims

A method comprising:

obtaining a first set of measurements produced by a first dynamic analysis of an examined program, wherein the first dynamic analysis is performed with respect to the examined program executing a first execution path;
obtaining a second set of measurements produced by a second dynamic analysis of the examined program, wherein the second dynamic analysis is performed with respect to the examined program executing a second execution path, wherein the first and second execution paths are different;
generating an aggregated feature vector representing the examined program, wherein the aggregated feature vector comprises a set of aggregated features, wherein a value of each aggregated feature is based on an aggregation of corresponding measurements in the first set of measurements and in the second set of measurements;
and
applying a predictive model on the aggregated feature vector to classify the examined program as malicious or benign.

2 more elements

A computer program product comprising a computer readable storage medium retaining program instructions, which program instructions when read by a processor, cause the processor to perform a method comprising:

obtaining a first set of measurements produced by a first dynamic analysis of an examined program, wherein the first dynamic analysis is performed with respect to the examined program executing a first execution path;
obtaining a second set of measurements produced by a second dynamic analysis of the examined program, wherein the second dynamic analysis is performed with respect to the examined program executing a second execution path, wherein the first and second execution paths are different;
generating an aggregated feature vector representing the examined program, wherein the aggregated feature vector comprises a set of aggregated features, wherein a value of each aggregated feature is based on an aggregation of corresponding measurements in the first set of measurements and in the second set of measurements;
and
applying a predictive model on the aggregated feature vector to classify the examined program as malicious or benign.

2 more elements

Dependencies are inferred from the claim text.

Feature vector aggregation for malware detection

Life of this patent

Feature vector aggregation for malware detection

Life of this patent

Abstract

Claims20