# US 2025/0086093 A1 · Detecting unwanted software using a machine learning operation

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2025/0086093 A1
- Document ID: US20250086093A1
- Status: Published application
- Kind: A1
- Application number: 18/465,391
- Filed: 2023-09-12
- Published: 2025-03-13
- Earliest claimed: 2023-09-12
- Assignees: Cylance Inc.
- Applicants: Cylance Inc.
- Inventors: Julian COLLADO UMANA; Aaron Mark Tresch FIENBERG
- Web page: https://patentgrep.com/patent/US20250086093A1

## CPC

- G06F 11/362: Debugging of software
- G06F 21/562: {Static detection}
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

Systems, methods, and software can be used to determine whether a software code is unwanted. In some aspects, a method includes: obtaining, by an electronic device, a set of software features of a software code; obtaining, by the electronic device, a set of user features of a user of the electronic device; and determining, by the electronic device, a classification score of the software code based on the set of software features and the set of the user features, wherein the classification score indicates whether the software code is potentially unwanted for the user.

## Claims

### Claim 1

A method, comprising:
obtaining, by an electronic device, a set of software features of a software code;
obtaining, by the electronic device, a set of user features of a user of the electronic device; and
determining, by the electronic device, a classification score of the software code based on the set of software features and the set of the user features, wherein the classification score indicates whether the software code is potentially unwanted for the user.

### Claim 2 (depends on 1)

The method of claim 1, wherein the determining the classification score comprises:
determining a software feature vector based on the set of software features;
determining a user feature vector based on the set of user features; and
determining the classification score based on the software feature vector and the user feature vector.

### Claim 3 (depends on 1)

The method of claim 1, wherein the determining the classification score comprises:
sending the set of software features and the set of user features to a server; and
in response to the sending set of software features and the set of user features, receiving the classification score from the server.

### Claim 4 (depends on 1)

The method of claim 1, further comprising:
comparing the classification score with a threshold score; and
in response to determining that the classification score meets the threshold score, allowing access to the software code.

### Claim 5 (depends on 1)

The method of claim 1, wherein the classification score is calculated using machine learning operations.

### Claim 6 (depends on 5)

The method of claim 5, wherein the machine learning operations comprise processing a software feature vector by using a first machine learning model and processing a user feature vector by using a second machine learning model.

### Claim 7 (depends on 1)

The method of claim 1, further comprising: outputting an indication indicating whether the software code is potentially unwanted for the user.

### Claim 8

A computer-readable medium containing instructions which, when executed, cause an electronic device to perform operations comprising:
obtaining a set of software features of a software code;
obtaining a set of user features of a user of the electronic device; and
determining a classification score of the software code based on the set of software features and the set of the user features, wherein the classification score indicates whether the software code is potentially unwanted for the user.

### Claim 9 (depends on 8)

The computer-readable medium of claim 8, wherein the determining the classification score comprises:
determining a software feature vector based on the set of software features;
determining a user feature vector based on the set of user features; and
determining the classification score based on the software feature vector and the user feature vector.

### Claim 10 (depends on 8)

The computer-readable medium of claim 8, wherein the determining the classification score comprises:
sending the set of software features and the set of user features to a server; and
in response to the sending set of software features and the set of user features, receiving the classification score from the server.

### Claim 11 (depends on 8)

The computer-readable medium of claim 8, the operations further comprising:
comparing the classification score with a threshold score; and
in response to determining that the classification score meets the threshold score, allowing access to the software code.

### Claim 12 (depends on 8)

The computer-readable medium of claim 8, wherein the classification score is calculated using machine learning operations.

### Claim 13 (depends on 12)

The computer-readable medium of claim 12, wherein the machine learning operations comprise processing a software feature vector by using a first machine learning model and processing a user feature vector by using a second machine learning model.

### Claim 14 (depends on 8)

The computer-readable medium of claim 8, the operations further comprising: outputting an indication indicating whether the software code is potentially unwanted for the user.

### Claim 15

A computer-implemented system, comprising:
one or more computers; and
one or more computer memory devices interoperably coupled with the one or more computers and having tangible, non-transitory, machine-readable media storing one or more instructions that, when executed by the one or more computers, perform one or more operations comprising:
obtaining a set of software features of a software code;
obtaining a set of user features of a user of an electronic device; and
determining a classification score of the software code based on the set of software features and the set of the user features, wherein the classification score indicates whether the software code is potentially unwanted for the user.

### Claim 16 (depends on 15)

The computer-implemented system of claim 15, wherein the determining the classification score comprises:
determining a software feature vector based on the set of software features;
determining a user feature vector based on the set of user features; and
determining the classification score based on the software feature vector and the user feature vector.

### Claim 17 (depends on 15)

The computer-implemented system of claim 15, wherein the determining the classification score comprises:
sending the set of software features and the set of user features to a server; and
in response to the sending set of software features and the set of user features, receiving the classification score from the server.

### Claim 18 (depends on 15)

The computer-implemented system of claim 15, the operations further comprising:
comparing the classification score with a threshold score; and
in response to determining that the classification score meets the threshold score, allowing access to the software code.

### Claim 19 (depends on 15)

The computer-implemented system of claim 15, wherein the classification score is calculated using machine learning operations.

### Claim 20 (depends on 19)

The computer-implemented system of claim 19, wherein machine learning operations comprise processing a software feature vector by using a first machine learning model and processing a user feature vector by using a second machine learning model.