# US 2020/0401697 A1 · Methods and apparatus to create malware detection rules

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2020/0401697 A1
- Document ID: US20200401697A1
- Status: Published application
- Kind: A1
- Application number: 16/446,196
- Filed: 2019-06-19
- Published: 2020-12-24
- Earliest claimed: 2019-06-19
- Assignees: McAfee, Inc.
- Applicants: McAfee, LLC
- Inventors: Nicholas T. Smith
- Web page: https://patentgrep.com/patent/US20200401697A1

## CPC

- G06F 21/566: {Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities}
- G06F 21/56: Computer malware detection or handling, e.g. anti-virus arrangements
- G06N 3/0464: Convolutional networks [CNN, ConvNet]
- G06N 3/09: Supervised learning
- G06N 5/01: Dynamic search techniques; Heuristics; Dynamic trees; Branch-and-bound
- G06N 5/027: {Frames}
- G06N 20/00: Machine learning
- G06F 2221/034: Test or assess a computer or a system
- G06N 3/045: Combinations of networks
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS

## Abstract

Methods, apparatus, systems and articles of manufacture to create malware detection rules are disclosed. An example apparatus includes a rule generator to generate an augmented rule set based on a first training data set. A matrix generator is to create a matrix using the augmented rule set and a second training data set. A rule regulator to apply regularization to the augmented rule set based on the matrix to remove any number of rules from the augmented rule set, the rule regulator to create a reduced rule set. A reduced rule set checker to validate the reduced rule set.

## Claims

### Claim 1

An apparatus to generate a rule set for detecting malware, the apparatus comprising:
a rule generator to generate an augmented rule set based on a first training data set;
a matrix generator to create a matrix using the augmented rule set and a second training data set;
a rule regulator to apply regularization to the augmented rule set based on the matrix to remove any number of rules from the augmented rule set, the rule regulator to create a reduced rule set; and
a reduced rule set checker to validate the reduced rule set.

### Claim 2 (depends on 1)

The apparatus of claim 1, wherein the rule regulator is to select the any number of rules for removal using a Least Absolute Shrinkage and Selection Operator algorithm.

### Claim 3 (depends on 1)

The apparatus of claim 1, wherein a third training data set includes labels to indicate whether a corresponding item in the third training data set is malware, the apparatus further including a model trainer to process the third training data set using the reduced rule set to create features, and train a machine learning model using the created features and the corresponding labels.

### Claim 4 (depends on 3)

The apparatus of claim 3, further including a model provider to provide the reduced rule set and the machine learning model to a malware detector.

### Claim 5 (depends on 1)

The apparatus of claim 1, wherein the rule generator is to generate the augmented rule set by incorporating an existing rule set into the augmented rule set.

### Claim 6 (depends on 1)

The apparatus of claim 1, wherein the rule generator is further to, in response to the determination that the reduced rule set is not valid, create a differentiator rule set, wherein the rule generator is to generate the augmented rule set based on the differentiator rule set.

### Claim 7 (depends on 6)

The apparatus of claim 6, wherein the rule generator is to create the differentiator rule set by at least one of boosting, re-weighting, or relabeling rules in the reduced rule set.

### Claim 8 (depends on 1)

The apparatus of claim 1, wherein the matrix is a binary rule matrix.

### Claim 9

At least one non-transitory computer readable medium comprising instructions that, when executed, cause at least one processor to at least:
generate an augmented rule set based on a first training data set;
process a second training data set using the augmented rule set to create a matrix;
apply regularization to the augmented rule set based on the matrix to form a reduced rule set, the regularization to remove rules from the augmented rule set; and
validate the reduced rule set.

### Claim 10 (depends on 9)

The at least one non-transitory computer readable medium of claim 9, wherein the instructions, when executed, cause the at least one processor to apply the regularization by selecting the rules for removal using a Least Absolute Shrinkage and Selection Operator algorithm.

### Claim 11 (depends on 9)

The at least one non-transitory computer readable medium of claim 9, wherein a third training data set includes labels to indicate whether a corresponding item in the third training data set is malware or benign, and the instructions, when executed, further cause the at least one processor to, in response to validation of the reduced rule set:
process the third training data set using the reduced rule set to create features;
train a machine learning model using the created features and the corresponding labels.

### Claim 12 (depends on 11)

The at least one non-transitory computer readable medium of claim 11, wherein the instructions, when executed, further cause the at least one processor to provide the reduced rule set and the machine learning model to a malware detector.

### Claim 13 (depends on 9)

The at least one non-transitory computer readable medium of claim 9, wherein the instructions, when executed, cause the at least one processor to generate the augmented rule set by incorporating an existing rule set into the augmented rule set.

### Claim 14 (depends on 9)

The at least one non-transitory computer readable medium of claim 9, wherein the instructions, when executed, cause the at least one processor to, in response to the determination that the reduced rule set is not valid, create a differentiator rule set, wherein the generating of the augmented rule set is further based on the differentiator rule set.

### Claim 15 (depends on 14)

The at least one non-transitory computer readable medium of claim 14, wherein the instructions, when executed, cause the at least one processor to create the differentiator rule set by at least one of boosting, re-weighting, or relabeling rules in the reduced rule set.

### Claim 16

A method of generating a rule set for detecting malware, the method comprising:
generating, by executing an instruction with a processor, an augmented rule set based on a first training data set;
processing, by executing an instruction with the processor, a second training data set using the augmented rule set to create a matrix;
applying regularization, by executing an instruction with the processor, to the augmented rule set based on the matrix to form a reduced rule set, the regularization to remove rules from the augmented rule set; and
validating, by executing an instruction with the processor, the reduced rule set.

### Claim 17 (depends on 16)

The method of claim 16, wherein the applying of the regularization includes selecting the rules for removal using a Least Absolute Shrinkage and Selection Operator algorithm.

### Claim 18 (depends on 16)

The method of claim 16, wherein a third training data set includes labels to indicate whether a corresponding item in the third training data set is malware or benign, the method further including, in response to validation of the reduced rule set:
processing the third training data set using the reduced rule set to create features;
training a machine learning model using the created features and the corresponding labels.

### Claim 19 (depends on 18)

The method of claim 18, further including providing the reduced rule set and the machine learning model to a malware detector.

### Claim 20 (depends on 16)

The method of claim 16, wherein the generating of the augmented rule set includes incorporating an existing rule set into the augmented rule set.

### Claim 21 (depends on 16)

The method of claim 16, further including, in response to the determination that the reduced rule set is not valid, creating a differentiator rule set, wherein the generating of the augmented rule set is further based on the differentiator rule set.

### Claim 22 (depends on 21)

The method of claim 21, wherein the differentiator rule set is created by at least one of boosting, re-weighting, or relabeling rules in the reduced rule set.