Centroid for Improving Machine Learning Classification and Info Retrieval
AssigneeCylance Inc.
InventorsJian Luan, Matthew Wolff, Brian Michael Wallace
Life of this patent
Estimating the term…
Abstract
Centroids are used for improving machine learning classification and information retrieval. A plurality of files are classified as malicious or not malicious based on a function dividing a coordinate space into at least a first portion and a second portion such that the first portion includes a first subset of the plurality of files classified as malicious. One or more first centroids are defined in the first portion that classify files from the first subset as not malicious. A file is determined to be malicious based on whether the file is located within the one or more first centroids.
Claims20
A system, comprising:
- at least one processor;
- and
- at least one memory including program code which when executed by the at least one memory provides operations comprising:
- receiving a file;
- determining whether a file is malicious based on whether the file is located within the one or more first centroids.
- preventing a file determined to be malicious from executing, opening,
- continuing to execute, writing, or being downloaded;
- wherein the one or more first centroids are generated by:
- classifying at least a portion of a plurality of files as malicious based on a function dividing a coordinate space into at least a first portion and a second portion, wherein the first portion includes a first subset of the plurality of files classified as malicious;
- defining one or more first centroids in the first portion that classify files from the first subset as not malicious;
- and
A computer-implemented method, comprising:
- classifying at least a portion of a plurality of files as malicious based on a function dividing a coordinate space into at least a first portion and a second portion, wherein the first portion includes a first subset of the plurality of files classified as malicious;
- defining one or more first centroids in the first portion that classify files from the first subset as not malicious;
- and
- determining whether a file is malicious based on whether the file is located within the one or more first centroids.
A computer-implemented method comprising:
- receiving files for classification from each of a plurality of endpoint computer systems;
- classifying at least one of the files as belonging to a specific classification type indicating that the file is malicious when the file is located within one or more first centroids;
- and
- preventing the classified files from executing, opening, continuing to execute, writing, or being downloaded in response to the classification;
- wherein the one or more centroids are generated by:
- searching for one or more clusters among a plurality of training files in a coordinate space;
- and
- defining one or more centroids around the one or more clusters, the one or more centroids classifying a set of training files within the one or more centroids as belonging to a specific classification type.
Dependencies are inferred from the claim text.