# US 2023/0056936 A1 · Multi-dimensional malware analysis > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2023/0056936 A1 - Document ID: US20230056936A1 - Status: Published application - Kind: A1 - Application number: 17/978,624 - Filed: 2022-11-01 - Published: 2023-02-23 - Earliest claimed: 2020-09-15 - Assignees: McAfee, Inc. - Applicants: McAfee, LLC - Inventors: Steven Grobman; Jonathan B. King; Yonghong Huang; Amit Kumar - Web page: https://patentgrep.com/patent/US20230056936A1 ## CPC - G06F 21/56: Computer malware detection or handling, e.g. anti-virus arrangements - G06F 21/566: {Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities} - G06F 21/54: by adding security routines or objects to programs - G06F 21/563: {by source code analysis} - G06F 21/568: {eliminating virus, restoring damaged files} - G06N 3/045: Combinations of networks - G06N 3/084: Backpropagation, e.g. using gradient descent - G06N 3/09: Supervised learning - G06N 20/00: Machine learning - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS ## Abstract There is disclosed in one example a computing apparatus, including: a hardware platform, including a processor, a memory, and a network interface; a bucketized reputation modifier table; and instructions encoded within the memory to instruct the processor to: perform a feature-based malware analysis of an object; assign the object a malware reputation according to the feature-based malware analysis; query and receive via the network interface a complementary score for a complementary property of the object; query the bucketized reputation modifier table according to the complementary score to receive a reputation modifier for the object; adjust the object's reputation according to the reputation modifier; and take a security action according to the adjusted reputation. ## Claims ### Claim at position 1 1-40. (canceled) ### Claim 41 A computer-implemented method of detecting computer malware, comprising: bucketizing analysis results for a class of objects based on one or more features shared by the class of objects; computing respective probabilistic curves for buckets of the bucketized analysis results; computing respective feature analysis thresholds for the probabilistic curves; performing feature analysis on an object under analysis, including computing a malware score; comparing the malware score to a feature analysis threshold for a bucket associated with the object under analysis; and taking a malware action on the object under analysis based on the comparing. ### Claim 42 (depends on 41) The computer-implemented method of claim 41, wherein bucketizing analysis results comprises computing a set of probabilistic curves associated with the bucketized analysis results. ### Claim 43 (depends on 41) The computer-implemented method of claim 41, wherein bucketizing analysis results comprises computing bucketized predictions for one or more objects. ### Claim 44 (depends on 41) The computer-implemented method of claim 41, wherein bucketizing analysis results comprises computing uniform resource locator (URL) reputations for one or more objects. ### Claim 45 (depends on 41) The computer-implemented method of claim 41, wherein bucketizing analysis results comprises bucketizing internet protocol (IP) address reputations for one or more objects. ### Claim 46 (depends on 41) The computer-implemented method of claim 41, wherein bucketizing analysis results comprises bucketizing certificate reputation for one or more objects. ### Claim 47 A computer-implemented method of detecting computer malware, comprising: applying a fusion model for malware detection to an object under analysis, wherein the fusion model is to account for a plurality of data sources associated with the object under analysis, and includes a first data source having quantized score groups, wherein a quantized score group for the object under analysis is used to modify a score from a second data source; based on a result of the fusion model, detecting the object under analysis as malware; and taking a malware remediation action in response to the detecting. ### Claim 48 (depends on 47) The computer-implemented method of claim 47, wherein the first data source comprises a set of probabilistic curves associated with the quantized score groups. ### Claim 49 (depends on 47) The computer-implemented method of claim 47, wherein the first data source comprises a reputation prediction for the object under analysis. ### Claim 50 (depends on 47) The computer-implemented method of claim 47, wherein the first data source comprises a uniform resource locator (URL) reputation associated with the object under analysis. ### Claim 51 (depends on 47) The computer-implemented method of claim 47, wherein the first data source comprises an internet protocol (IP) address associated with the object under analysis. ### Claim 52 (depends on 47) The computer-implemented method of claim 47, wherein the first data source comprises a certificate reputation associated with the object under analysis. ### Claim 53 (depends on 47) The computer-implemented method of claim 47, wherein the second data source comprises a feature-based malware analysis score for the object under analysis. ### Claim 54 (depends on 47) The computer-implemented method of claim 47, wherein the second data source comprises a static analysis score for the object under analysis. ### Claim 55 (depends on 47) The computer-implemented method of claim 47, wherein the second data source comprises a dynamic analysis score for the object under analysis. ### Claim 56 (depends on 47) The computer-implemented method of claim 47, wherein detecting the object under analysis as malware comprises comparing a numerical result of the fusion model to a malware detection threshold. ### Claim 57 (depends on 47) The computer-implemented method of claim 47, wherein applying the fusion model comprises computing a score from the second data source, receiving a bucketized score adjustment from the first data source, and adjusting a reputation for the object under analysis with the bucketized score adjustment. ### Claim 58 One or more tangible, nontransitory computer-readable storage media having stored thereon executable instructions to instruct a processor circuit to: apply, or cause a device to apply, a fusion model for malware detection to an object under analysis, wherein the fusion model is to account for a plurality of data sources associated with the object under analysis, and includes a first data source having quantized score groups, wherein a quantized score group for the object under analysis is used to modify a score from a second data source; based on a result of the fusion model, detect, or cause a device to detect, the object under analysis as malware; and take, or cause a device to take, a malware remediation action in response to the detecting. ### Claim 59 (depends on 58) The one or more tangible, nontransitory computer-readable media of claim 58, wherein the first data source comprises a set of probabilistic curves associated with the quantized score groups. ### Claim 60 (depends on 58) The one or more tangible, nontransitory computer-readable media of claim 58, wherein the second data source comprises a feature-based malware analysis score for the object under analysis.