# US 2021/0240826 A1 · Building multi-representational learning models for static analysis of source code > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2021/0240826 A1 - Document ID: US20210240826A1 - Status: Published application - Kind: A1 - Application number: 16/779,271 - Filed: 2020-01-31 - Published: 2021-08-05 - Earliest claimed: 2020-01-31 - Assignees: Palo Alto Networks, Inc. - Applicants: Palo Alto Networks, Inc. - Inventors: Brody James Kutt; William Redington Hewlett, II; Oleksii Starov; Yuchen Zhou; Fang Liu - Web page: https://patentgrep.com/patent/US20210240826A1 ## CPC - G06F 21/563: {by source code analysis} - G06F 8/42: {Syntactic analysis} - G06F 8/75: Structural analysis for program understanding - G06F 18/24: Classification techniques - G06F 18/24143: {Distances to neighbourhood prototypes, e.g. restricted Coulomb energy networks [RCEN]} - G06F 21/577: {Assessing vulnerabilities and evaluating computer system security} - G06N 3/045: Combinations of networks - G06N 3/0464: Convolutional networks [CNN, ConvNet] - G06N 3/08: Learning methods - G06N 3/09: Supervised learning - G06N 3/0985: Hyperparameter optimisation; Meta-learning; Learning-to-learn - G06N 5/022: Knowledge engineering; Knowledge acquisition - G06N 20/00: Machine learning - G06F 2221/033: Test or assess software - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS ## Abstract Techniques for building multi-representational learning models for static analysis of source code are disclosed. In some embodiments, a system/process/computer program product for building multi-representational learning models for static analysis of source code includes receiving training data, wherein the training data includes a set of source code files for training a multi-representational learning (MRL) model for classifying malicious source code and benign source code based on a static analysis; generating a first feature vector based on a set of characters extracted from the set of source code files; generating a second feature vector based on a set of tokens extracted from the set of source code files; and performing an ensemble of the first feature vector and the second feature vector to form a target feature vector for classifying malicious source code and benign source code based on the static analysis. ## Claims ### Claim 1 A system, comprising: a processor configured to: receive training data, wherein the training data includes a set of source code files for training a multi-representational learning (MRL) model for classifying malicious source code and benign source code based on a static analysis; generate a first feature vector based on a set of characters extracted from the set of source code files; generate a second feature vector based on a set of tokens extracted from the set of source code files; and ensemble the first feature vector and the second feature vector to form a target feature vector for classifying malicious source code and benign source code based on the static analysis; and a memory coupled to the processor and configured to provide the processor with instructions. ### Claim 2 (depends on 1) The system of claim 1, wherein the processor is configured to enumerate the source code associated with each of the source code files. ### Claim 3 (depends on 1) The system of claim 1, wherein the processor is configured to enumerate the source code associated with each of the source code files into a set of characters. ### Claim 4 (depends on 1) The system of claim 1, wherein the processor is configured to enumerate the source code associated with each of the source code files into a set of characters and a set of tokens. ### Claim 5 (depends on 1) The system of claim 1, wherein the processor is configured to enumerate the source code associated with each of the source code files into a set of characters, a set of tokens, and an Abstract Syntax Tree (AST). ### Claim 6 (depends on 1) The system of claim 1, wherein the processor is configured to enumerate the source code associated with each of the source code files into a set of characters, a set of tokens, an Abstract Syntax Tree (AST), and/or another abstraction layer. ### Claim 7 (depends on 1) The system of claim 1, wherein the processor is further configured to determine a file type associated with the file. ### Claim 8 (depends on 1) The system of claim 1, wherein the processor is configured to determine a file type associated with the file and to select, one or more abstraction layers, based on the determined file type associated with the file. ### Claim 9 (depends on 1) The system of claim 1, wherein the processor is configured to generate the MRL model using a Convolutional Neural Network (CNN) feature extraction model. ### Claim 10 (depends on 1) The system of claim 1, wherein the processor is configured to perform a two-phase training procedure, wherein a first phase is performed using a first set of the training data for implementing a Convolutional Neural Network (CNN) feature extraction model, and wherein a second phase is performed using a second set of the training data for implementing an ensemble of a plurality of feature vectors resulting from the CNN feature extraction model. ### Claim 11 A method, comprising: receiving training data, wherein the training data includes a set of source code files for training a multi-representational learning (MRL) model for classifying malicious source code and benign source code based on a static analysis; generating a first feature vector based on a set of characters extracted from the set of source code files; generating a second feature vector based on a set of tokens extracted from the set of source code files; and performing an ensemble of the first feature vector and the second feature vector to form a target feature vector for classifying malicious source code and benign source code based on the static analysis. ### Claim 12 (depends on 11) The method of claim 11, wherein the processor is configured to enumerate the source code associated with each of the source code files. ### Claim 13 (depends on 11) The method of claim 11, wherein the processor is configured to enumerate the source code associated with each of the source code files into a set of characters. ### Claim 14 (depends on 11) The method of claim 11, wherein the processor is configured to enumerate the source code associated with each of the source code files into a set of characters and a set of tokens. ### Claim 15 (depends on 11) The method of claim 11, wherein the processor is configured to enumerate the source code associated with each of the source code files into a set of characters, a set of tokens, and an Abstract Syntax Tree (AST). ### Claim 16 (depends on 11) The method of claim 11, wherein the processor is configured to enumerate the source code associated with each of the source code files into a set of characters, a set of tokens, an Abstract Syntax Tree (AST), and/or another abstraction layer. ### Claim 17 (depends on 11) The method of claim 11, wherein the processor is further configured to determine a file type associated with the file. ### Claim 18 (depends on 11) The method of claim 11, wherein the processor is configured to determine a file type associated with the file and to select, one or more abstraction layers, based on the determined file type associated with the file. ### Claim 19 (depends on 11) The method of claim 11, wherein the processor is configured to generate the MRL model using a Convolutional Neural Network (CNN) feature extraction model. ### Claim 20 (depends on 11) The method of claim 11, wherein the processor is configured to perform a two-phase training procedure, wherein a first phase is performed using a first set of the training data for implementing a Convolutional Neural Network (CNN) feature extraction model, and wherein a second phase is performed using a second set of the training data for implementing an ensemble of a plurality of feature vectors resulting from the CNN feature extraction model. ### Claim 21 A computer program product embodied in a tangible computer readable storage medium and comprising computer instructions for: receiving training data, wherein the training data includes a set of source code files for training a multi-representational learning (MRL) model for classifying malicious source code and benign source code based on a static analysis; generating a first feature vector based on a set of characters extracted from the set of source code files; generating a second feature vector based on a set of tokens extracted from the set of source code files; and performing an ensemble of the first feature vector and the second feature vector to form a target feature vector for classifying malicious source code and benign source code based on the static analysis.