Pattern similarity measures to quantify uncertainty in malware classification
AssigneeZscaler, Inc.
InventorsChangsha Ma, Dianhuan Lin, Rex Shang, Kevin Guo, Howie Xu
Life of this patent
Estimating the term…
Abstract
A method includes monitoring content inline between any of users, enterprises, and the Internet by a cloud-based system; analyzing the content with a trained machine learning model to provide an initial classification of benign or malicious; determining an uncertainty associated with the initial classification; and one of allowing the content, blocking the content, and sandboxing the content, based on the initial classification and the uncertainty. The uncertainty is used to minimize latency for user experience while avoiding incorrect classifications, in the inline monitoring.
Claims20
A method comprising steps of:
- monitoring content inline between any of users, enterprises, and the Internet by a cloud-based system;
- analyzing the content with a trained machine learning model to provide an initial classification of benign or malicious;
- determining an uncertainty associated with the initial classification;
- and
- one of allowing the content, blocking the content, and sandboxing the content, based on the initial classification and the uncertainty.
A cloud-based system comprising a plurality of nodes each including one or more processors configured to:
- monitor content inline between any of users, enterprises, and the Internet by a cloud-based system;
- analyze the content with a trained machine learning model to provide an initial classification of benign or malicious;
- determine an uncertainty associated with the initial classification;
- and
- one of allow the content, block the content, and sandbox the content, based on the initial classification and the uncertainty.
Dependencies are inferred from the claim text.