Binary file threat detection based on pattern matching rule embeddings
AssigneeRed Hat, Inc.
InventorsAndrea Cosentino, Paolo Antinori
Life of this patent
Estimating the term…
Abstract
A method, a system, and a non-transitory computer-readable medium are provided. The method includes generating a pattern matching rule based on a binary file. The method includes converting, by a processing device, the pattern matching rule to an embedding. The method includes performing a similarity search for the embedding in a pattern matching rule embedding database to obtain a similarity score. The method includes determining whether the binary file is a security threat based on the similarity score.
Claims20
A method comprising:
- generating a pattern matching rule based on a binary file;
- converting, by a processing device, the pattern matching rule to an embedding;
- performing a similarity search for the embedding in a pattern matching rule embedding database to obtain a similarity score;
- and
- determining whether the binary file is a security threat based on the similarity score.
A system comprising:
- a memory;
- and
- a processing device operatively couple to the memory, to:
- generate a pattern matching rule based on a binary file;
- convert the pattern matching rule to an embedding;
- perform a similarity search for the embedding in a pattern matching rule embedding database to obtain a similarity score;
- and
- determine whether the binary file is a security threat based on the similarity score.
A non-transitory computer-readable medium storing instructions that, when executed by a processing device, cause the processing device to:
- generate a pattern matching rule based on a binary file;
- convert the pattern matching rule to an embedding;
- perform a similarity search for the embedding in a pattern matching rule embedding database to obtain a similarity score;
- and
- determine whether the binary file is a security threat based on the similarity score.
Dependencies are inferred from the claim text.