Machine learning model for analysis of instruction sequences

Patent metadata

Field	Value
Publication number	US-11074494-B2
Application number	US-201615345433-A
Country	US
Kind code	B2
Filing date	Nov 7, 2016
Priority date	Sep 9, 2016
Publication date	Jul 27, 2021
Grant date	Jul 27, 2021

Abstract

In one respect, there is provided a system for classifying an instruction sequence with a machine learning model. The system may include at least one processor and at least one memory. The memory may include program code that provides operations when executed by the at least one processor. The operations may include: processing an instruction sequence with a trained machine learning model configured to detect one or more interdependencies amongst a plurality of tokens in the instruction sequence and determine a classification for the instruction sequence based on the one or more interdependencies amongst the plurality of tokens; and providing, as an output, the classification of the instruction sequence. Related methods and articles of manufacture, including computer program products, are also provided.

First claim

What is claimed is:

1. A system for classifying code as malicious or benign to prevent the code from introducing undesirable and/or harmful behavior to a computing device, the system comprising:
at least one processor; and
at least one memory including program code which when executed by the at least one processor provides operations comprising:
processing an instruction sequence with at least two trained machine learning models configured to at least detect one or more interdependencies amongst a plurality of tokens in the instruction sequence and to determine a classification for the instruction sequence based on the one or more interdependencies amongst the plurality of tokens, the classification indicating whether the instruction sequence is malicious or benign, at least one of the trained machine learning models using encoding to vectorize the instruction sequence so as to preserve similarities between tokens; and
providing, as an output, the classification of the instruction sequence, the classification being used to determine whether to access, execute, or continue to execute the instruction sequence to prevent the undesirable and/or harmful behavior to the computing device;

wherein:
a first layer of the trained machine learning model encodes the tokens using one or more encoding techniques and generates vector representations of the tokens to pass to a next layer of the trained machine learning model;
the instruction sequence comprises a script that requires compilation prior to execution;
the one or more interdependencies indicate at least one function and/or behavior associated with the script;
the trained machine learning model comprises a trained long short-term memory neural network that is trained to classify instruction sequences by at least using the long short-term memory neural network to process a plurality of training data, the training including instruction sequences that includes tokens having predetermined interdependencies, the long short-term memory neural network is trained to detect the predetermined interdependencies amongst the tokens in the training data, the long short-term memory neural network is trained to minimize an error function or a loss function associated with a corresponding output of the long short-term memory neural network;
the encoding maximizes an objective function J(θ) in order to generate v vector representations that preserve similarities between tokens:

J
⁡

(
θ
)

=

1
T

⁢

∑

t
=
1

T

⁢

⁢

∑

-
c

≤
j
≤
c

,

j
≠
0

⁢

log
⁢

⁢

p
⁡

(

w

t
+
j

❘

w
t

)

,

wherein T is a total number of tokens in a training corpus, w t is a current token, c is a window size, w t+j represents a token in a window before or after w t , and p(w t+j |w t ) represents a probability of w t+j given w t , wherein p(w t+j |w t ) is:

p
⁡

(

w

t
+
j

❘

w
t

)

=

exp
⁡

(

v

w

t
+
j

'
T

⁢

v

w
t

)

∑

w
=
1

W

⁢

exp
⁡

(

V
w

'
T

⁢

v

w
t

)

,

whe

Assignees

• Cylance Inc

Inventors

• Zhao Xuan
• Wolff Matthew
• Brock John
• Wallace Brian
• Wortman Andy
• Luan Jian
• Azarafrooz Mahdi
• Davis Andrew
• Wojnowicz Michael
• Soeder Derek
• Beveridge David
• Petersen Eric
• Jin Ming
• Permeh Ryan

Classifications

• G06F21/563 Primary

  by source code analysis · CPC title

• G06N3/044

  Recurrent networks, e.g. Hopfield networks · CPC title

• G06N3/0442 Primary

  characterised by memory or gating, e.g. long short-term memory [LSTM] or gated recurrent units [GRU] · CPC title

• G06N3/09

  Supervised learning · CPC title

• G06N20/00

  Machine learning · CPC title