Systems and methods for determining measurements of similarity between various types of data
AssigneeCybereason Inc.
InventorsYonatan Perry, Assaf Ben-David, Uri Sternfeld
Life of this patent
Estimating the term…
Abstract
Systems and methods are provided to measure the similarity between a first and second data sample. The method can include creating a plurality of k-mers from the first data sample, each k-mer having a first length; generating a first vector from the plurality of k-mers by processing the plurality of k-mers with a plurality of hash functions; calculating a similarity level between the first and second data sample by comparing the first vector to a second vector, the second vector representing the second data sample; and based on the similarity level, determining a maliciousness level of the first data sample.
Claims30
A computer-implemented method for classifying a data sample comprising:
- creating a plurality of k-mers from the data sample, each k-mer having a first length;
- generating a vector from the plurality of k-mers by processing the plurality of k-mers with a plurality of hash functions;
- comparing the vector to at least one other vector to determine at least one distance metric, the at least one other vector representing at least one other sample;
- and
- based on the at least one distance metric, determining a characteristic of the data sample.
A computer-implemented method for preventing data leaks from a protected environment:
- detecting, at an egress gateway, a data sample being transmitted outside of the protected environment;
- creating a plurality of k-mers from the data sample, each k-mer having a first length;
- generating a vector from the plurality of k-mers by processing the plurality of k-mers with a plurality of hash functions;
- comparing the vector to a set of protected vectors to determine at least one distance metric, the protected vectors representing a plurality of protected data samples;
- and
- based on the at least one distance metric, preventing the data sample from leaving the protected environment.
A computer-implemented method for vectorizing a data sample comprising:
- executing the data sample;
- collecting runtime data associated with the execution of the data sample;
- creating a plurality of k-mers from the runtime data, each k-mer having a first length;
- mapping the plurality of k-mers to a plurality of integers with a plurality of hash functions;
- and
- generating a vector from the mapped plurality of k-mers with a MinHash function.
A computer-implemented method for vectorizing a data sample comprising:
- creating a plurality of k-mers from the data sample, each k-mer having a first length;
- mapping the plurality of k-mers to a plurality of integers with a plurality of hash functions;
- and
- generating a vector from the mapped plurality of k-mers with a MinHash function.
Dependencies are inferred from the claim text.