Methods and apparatus for machine learning based malware detection
AssigneeInvincea, Inc.
InventorsJoshua Daniel Saxe, Konstantin Berlin
Life of this patent
Estimating the term…
Abstract
Apparatus and methods describe herein, for example, a process that can include receiving a potentially malicious file, and dividing the potentially malicious file into a set of byte windows. The process can include calculating at least one attribute associated with each byte window from the set of byte windows for the potentially malicious file. In such an instance, the at least one attribute is not dependent on an order of bytes in the potentially malicious file. The process can further include identifying a probability that the potentially malicious file is malicious, based at least in part on the at least one attribute and a trained threat model.
Claims21
An apparatus, comprising:
- a memory;
- and
- a hardware processor operatively coupled to the memory,
- the hardware processor configured to receive a potentially malicious file, the hardware processor configured to calculate an attribute value associated with the potentially malicious file, the attribute value being at least one of:
- (1) an indication of how often a byte value within a byte value range is within each byte window (a) from a plurality of byte windows of the potentially malicious file and (b) having an informational entropy within an informational entropy range,
- (2) an indication of how often a combination of the informational entropy range and a byte standard deviation range is associated with the plurality of byte windows of the potentially malicious file, or
- (3) an indication of how often a combination of a string length range and a string hash value range occurs within the potentially malicious file,
- the hardware processor configured to calculate, based on the attribute value and using a trained threat model, a probability that the potentially malicious file is malicious.
A non-transitory processor-readable medium storing code representing instructions to be executed by a processor, the instructions comprising code to cause the processor to:
- receive a potentially malicious file;
- define an indication of a degree of variance of byte values within each portion from a plurality of portions of the potentially malicious file;
- identify a number of occurrences, within each portion from the plurality of portions, of each byte value from a set of byte values;
- and
- calculate a probability that the potentially malicious file is malicious using (1) the indication for each portion from the plurality of portions and (2) the number of occurrences of the set of byte values for each portion from the plurality of portions.
A method, comprising:
- receiving a potentially malicious file;
- dividing the potentially malicious file into a plurality of byte windows;
- calculating at least one attribute associated with each byte window from the plurality of byte windows for the potentially malicious file, the at least one attribute not dependent on an order of bytes in the potentially malicious file;
- and
- identifying, based at least in part on the at least one attribute and a trained threat model, a probability that the potentially malicious file is malicious.
Dependencies are inferred from the claim text.