# US 2021/0240825 A1 · Multi-representational learning models for static analysis of source code > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2021/0240825 A1 - Document ID: US20210240825A1 - Status: Published application - Kind: A1 - Application number: 16/779,268 - Filed: 2020-01-31 - Published: 2021-08-05 - Earliest claimed: 2020-01-31 - Assignees: Palo Alto Networks, Inc. - Applicants: Palo Alto Networks, Inc. - Inventors: Brody James Kutt; William Redington Hewlett, II; Oleksii Starov; Yuchen Zhou; Fang Liu - Web page: https://patentgrep.com/patent/US20210240825A1 ## CPC - G06F 21/563: {by source code analysis} - G06F 8/42: {Syntactic analysis} - G06F 8/75: Structural analysis for program understanding - G06N 3/0464: Convolutional networks [CNN, ConvNet] - G06N 3/09: Supervised learning - G06N 3/0985: Hyperparameter optimisation; Meta-learning; Learning-to-learn - G06N 20/00: Machine learning - G06N 3/045: Combinations of networks - G06N 3/08: Learning methods - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS ## Abstract Techniques for multi-representational learning models for static analysis of source code are disclosed. In some embodiments, a system/process/computer program product for multi-representational learning models for static analysis of source code includes storing on a networked device a set comprising one or more multi-representation learning (MRL) models for static analysis of source code; performing a static analysis of source code associated with a sample received at the network device, wherein performing the static analysis includes using at least one stored MRL model; and determining that the sample is malicious based at least in part on the static analysis of the source code associated with the received sample, and in response to determining that the sample is malicious, perform an action based on a security policy. ## Claims ### Claim 1 A system, comprising: a processor configured to: store on a networked device a set comprising one or more multi-representation learning (MRL) models for static analysis of source code; perform a static analysis of source code associated with a sample received at the network device, wherein performing the static analysis includes using at least one stored MRL model; and determine that the sample is malicious based at least in part on the static analysis of the source code associated with the received sample, and in response to determining that the sample is malicious, perform an action based on a security policy; and a memory coupled to the processor and configured to provide the processor with instructions. ### Claim 2 (depends on 1) The system of claim 1, wherein the processor is configured to enumerate the source code is associated with the received sample. ### Claim 3 (depends on 1) The system of claim 1, wherein the processor is configured to enumerate the source code associated with the received sample into a set of characters. ### Claim 4 (depends on 1) The system of claim 1, wherein the processor is configured to enumerate the source code associated with the received sample into a set of characters and a set of tokens. ### Claim 5 (depends on 1) The system of claim 1, wherein the processor is configured to enumerate the source code associated with the received sample into a set of characters, a set of tokens, and an Abstract Syntax Tree (AST). ### Claim 6 (depends on 1) The system of claim 1, wherein the processor is further configured to determine a file type associated with the file. ### Claim 7 (depends on 1) The system of claim 1, wherein the processor is configured to determine a file type associated with the file and to select, from the set of one or more MRL models, based on the determined file type associated with the file. ### Claim 8 (depends on 1) The system of claim 1, wherein the processor is further configured to receive at least one updated classification model. ### Claim 9 (depends on 1) The system of claim 1, wherein the processor is further configured to receive another MRL model for another programming language. ### Claim 10 (depends on 1) The system of claim 1, wherein the processor is further configured to transmit a copy of the received file to a security platform and perform the n-gram analysis while awaiting a verdict from the security platform. ### Claim 11 A method, comprising: storing on a networked device a set comprising one or more multi-representation learning (MRL) models for static analysis of source code; performing a static analysis of source code associated with a sample received at the network device, wherein performing the static analysis includes using at least one stored MRL model; and determining that the sample is malicious based at least in part on the static analysis of the source code associated with the received sample, and in response to determining that the sample is malicious, perform an action based on a security policy. ### Claim 12 (depends on 11) The method of claim 11, further comprising: enumerating the source code associated with the received sample. ### Claim 13 (depends on 11) The method of claim 11, further comprising: enumerating the source code associated with the received sample into a set of characters. ### Claim 14 (depends on 11) The method of claim 11, further comprising: enumerating the source code associated with the received sample into a set of characters and a set of tokens. ### Claim 15 (depends on 11) The method of claim 11, further comprising: enumerating the source code associated with the received sample into a set of characters, a set of tokens, and an Abstract Syntax Tree (AST). ### Claim 16 (depends on 11) The method of claim 11, further comprising: determining a file type associated with the file. ### Claim 17 (depends on 11) The method of claim 11, further comprising: determining a file type associated with the file; and selecting, from the set of one or more MRL models, based on the determined file type associated with the file. ### Claim 18 (depends on 11) The method of claim 11, further comprising: receiving at least one updated MRL model. ### Claim 19 (depends on 11) The method of claim 11, further comprising: receiving another MRL model for another programming language. ### Claim 20 A computer program product embodied in a tangible computer readable storage medium and comprising computer instructions for: storing on a networked device a set comprising one or more multi-representation learning to (MRL) models for static analysis of source code; performing a static analysis of source code associated with a sample received at the network device, wherein performing the static analysis includes using at least one stored MRL model; and determining that the sample is malicious based at least in part on the static analysis of the is source code associated with the received sample, and in response to determining that the sample is malicious, perform an action based on a security policy.