Machine Learning Model Score Obfuscation Using Coordinated Interleaving
AssigneeCylance Inc.
InventorHailey Buckingham
Life of this patent
Estimating the term…
Abstract
An artefact is received. Features are extracted from this artefact which are, in turn, used to populate a vector. The vector is then input into a classification model to generate a score. The score is then modified to result in a modified score by interleaving the generated score or a mapping thereof into digits of a pseudo-score. Thereafter, the modified score can be provided to a consuming application or process. Related apparatus, systems, techniques and articles are also described.
Claims20
A computer-implemented method comprising:
- receiving an artefact;
- extracting features from the artefact and populating a vector;
- inputting the vector into a classification model to generate a score;
- modifying the generated score to result in a modified score, the modifying comprising interleaving the generated score or a mapping thereof into digits of a pseudo-score;
- and
- providing the modified score to a consuming application or process.
A system comprising:
- at least one data processor;
- and
- memory storing instructions which, when executed by the at least one data processor, result in operations comprising:
- extracting features from the artefact and populating a vector;
- inputting the vector into a classification model to generate a score;
- modifying the generated score to result in a modified score, the modifying comprising interleaving the generated score or a mapping thereof into digits of a pseudo-score;
- and
- providing the modified score to a consuming application or process.
A computer-implemented method for preventing the execution of malicious files or code comprising:
- receiving an artefact;
- extracting features from the artefact and populating a vector;
- inputting the vector into a machine learning model to generate a score;
- modifying the generated score to result in a modified score, the modifying comprising interleaving the generated score or a mapping thereof into digits of a pseudo-score;
- providing the modified score to a consuming application or process;
- and
- preventing access or execution of the artefact when the modified score characterizes the artefact as being malicious.
Dependencies are inferred from the claim text.