Training a machine learning model for analysis of instruction sequences

Patent metadata

Field	Value
Publication number	US-10922604-B2
Application number	US-201615345436-A
Country	US
Kind code	B2
Filing date	Nov 7, 2016
Priority date	Sep 9, 2016
Publication date	Feb 16, 2021
Grant date	Feb 16, 2021

Abstract

In one respect, there is provided a system for training a neural network adapted for classifying one or more instruction sequences. The system may include at least one processor and at least one memory. The memory may include program code which when executed by the at least one processor provides operations including: training, based at least on training data, a machine learning model to detect one or more predetermined interdependencies amongst a plurality of tokens in the training data; and providing the trained machine learning model to enable classification of one or more instruction sequences. Related methods and articles of manufacture, including computer program products, are also provided.

First claim

What is claimed is:

1. A system for detecting malicious instruction sequences in a script which, when executed causes undesirable or harmful behavior to a computing device, the system comprising:
at least one processor; and
at least one memory including program code which when executed by the at least one processor provides operations comprising:
tokenizing a plurality of historical instruction sequences each forming part of a different script to generate training data, wherein the instruction sequences are configured to be executed without compilation;
training, based at least on the training data, at least one machine learning model to detect one or more predetermined interdependencies amongst a plurality of tokens in the training data, wherein at least one of the predetermined interdependencies indicates that the corresponding instructions sequence is malicious, the trained at least one machine learning model using encoding to vectorize instruction sequences so as to preserve similarities between tokens; and
providing the trained at least one machine learning model to enable classification of one or more instruction sequences as either being malicious or benign based on the detected one or more predetermined interdependencies, the trained at least one machine learning model, when deployed, being used to prevent instruction sequences classified as malicious from being executed and causing undesirable or harmful behavior to the computing device;

wherein:
the trained at least one machine learning model comprises a recursive neural tensor network that assigns weights and tensors to nodes and connections of an abstract syntax tree representation of the instruction sequence such that a weight of a parent node p in the abstract syntax tree representation is based on:

p
=

f
⁡

(

[

c
1

c
2

]

⁢

V
⁡

[

c
1

c
2

]

+

W
⁡

[

c
1

c
2

]

)

,

wherein c 1 , and c 2 , correspond to scores assigned to children nodes in the abstract syntax tree representation, wherein tensor V and weight W connect the children nodes to the parent node, wherein a tensor V is defined as V∈R 2dx2dxd , and wherein d is a dimension of a vector representing a token;
the abstract syntax tree representation of the instruction sequence preserves a structure of the instruction sequence including one or more rules for combining the tokens in the instruction sequence;
the encoding maximizes an objective function J(θ) in order to generate v vector representations that preserve similarities between tokens:

J
⁡

(
θ
)

=

1
T

⁢

∑

t
=
1

T

⁢

∑

-
c

≤
j
≤
c

,

j
≠
0

⁢

log
⁢

⁢

p
⁡

(

w

t
+
j

|

w
t

)

,

⁢

Assignees

• Cylance Inc

Inventors

• Zhao Xuan
• Wolff Matthew
• Brock John
• Wallace Brian
• Wortman Andy
• Luan Jian
• Azarafrooz Mahdi
• Davis Andrew
• Wojnowicz Michael
• Soeder Derek
• Beveridge David
• Petersen Eric
• Jin Ming
• Permeh Ryan

Classifications

• G06F21/563 Primary

  by source code analysis · CPC title

• G06N3/044

  Recurrent networks, e.g. Hopfield networks · CPC title

• G06N3/0442 Primary

  characterised by memory or gating, e.g. long short-term memory [LSTM] or gated recurrent units [GRU] · CPC title

• G06N3/09

  Supervised learning · CPC title

• G06N3/084

  Backpropagation, e.g. using gradient descent · CPC title