Systems and methods for executable code detection, automatic feature extraction and position independent code detection

Patent metadata

Field	Value
Publication number	US-11210392-B2
Application number	US-202016920630-A
Country	US
Kind code	B2
Filing date	Jul 3, 2020
Priority date	May 20, 2019
Publication date	Dec 28, 2021
Grant date	Dec 28, 2021

Abstract

Disclosed herein are systems and methods for enabling the automatic detection of executable code from a stream of bytes. In some embodiments, the stream of bytes can be sourced from the hidden areas of files that traditional malware detection solutions ignore. In some embodiments, a machine learning model is trained to detect whether a particular stream of bytes is executable code. Other embodiments described herein disclose systems and methods for automatic feature extraction using a neural network. Given a new file, the systems and methods may preprocess the code to be inputted into a trained neural network. The neural network may be used as a “feature generator” for a malware detection model. Other embodiments herein are directed to systems and methods for identifying, flagging, and/or detecting threat actors which attempt to obtain access to library functions independently.

First claim

What is claimed is:

1. A computer-implemented method for automatic ally extracting a machine learning feature from executable code for input to a malware detection model, the method comprising:
accessing, by a computer system, the executable code from a file;
inputting, by the computer system, the executable code to an image rescaling algorithm comprising an embedding matrix, wherein the image rescaling algorithm is configured to convert each byte of the executable code to a numerical vector using the embedding matrix to produce an embedded vector space, and wherein the order of the executable code is maintained during the conversion;
channel filtering, by the computer system, one or more vector layers of the embedded vector space, wherein the channel filtering comprises:
consolidating the one or more vector layers into a plurality of blocks; and
applying a filter mechanism to produce one or more fixed size vector inputs, each fixed size vector input representing a corresponding vector layer or a block of the corresponding vector layer;

inputting, by the computer system, the one or more fixed size vector inputs into an input layer of a neural network, the neural network comprising a plurality of layers of processing units, wherein the plurality of layers comprise at least the input layer, one or more hidden layers, and an output layer, wherein each successive layer of the plurality of layers uses an output value from a previous layer as an input value, wherein each of the one or more hidden layers is configured to perform a transformation on the input value to generate the output value for an immediately consecutive layer, and wherein the output layer is configured to generate a classification of maliciousness of the executable code;
extracting, by the computer system, the output value of a final hidden layer immediately preceding the output layer of the neural network; and
providing, by the computer system, the output value of the final hidden layer as a machine learning feature to the malware detection model,
wherein the computer system comprises a computer processor and an electronic storage medium.

2. The method of claim 1 , wherein the neural network comprises a supervised, semi-supervised, or unsupervised learning model.

3. The method of claim 1 , wherein the executable code is part of a portable executable (PE) file.

4. The method of claim 1 , wherein the image rescaling algorithm comprises a pre-processing neural network, the pre-processing neural network comprising Word2Vec.

5. The method of claim 1 , further comprising discarding the classification of maliciousness of the executable code from the output layer of the neural network.

6. The method of claim 1 , wherein the neural network comprises between 1 and 2000 hidden layers.

7. The method of claim 1 , wherein the filter mechanism comprises a low-pass filter, box filter, delta filter, or Gaussian filter.

8. The method of claim 1 , wherein the neural network comprises a feedforward or recurrent neural network.

9. The method of claim 1 , wherein the output value of a final hidden layer comprises an indication of maliciousness of the executable code.

10. A computer system for automatically extracting a machine learning feature from executable code for input to a malware detection model, the system comprising:
one or more computer readable storage devices configured to store a plurality of computer executable instructions; and
one or more hardware computer processors in communication with the one or more computer readable storage devices and configured to execute the plurality of computer executable instructions in order to cause the system to:
access the executable code from a file; input the executable code to an image rescaling algorithm comprising an embedding matrix, wherein the image rescaling algorithm converts each byte of the executable code to a numerical vector using the embedding matrix to produce an embedded vector space, and wherein the order of the executable code is maintained during the conversion;
channel filter one or more vector layers of the embedded vector space by:
consolidating the one or more vector layers into a plurality of blocks; and
applying a filter mechanism to produce one or more fixed size vector inputs, each fixed size vector input representing a corresponding vector layer or a block of the corresponding vector layer;

input the one or more fixed size vector inputs into an input layer of a neural network, the neural network comprising a plurality of layers of processing units, wherein the plurality of layers comprise at least the input layer, one or more hidden layers, and an output layer, wherein each successive layer of the plurality of layers uses an output value from a previous layer as an input value, wherein each of the one or more hidden layers is configured to perform a transformation on the input value to generate the output value for an immediately consecutive layer, and wherein the output layer is configured to generate a classification of maliciousness of the executable code;
extract the output value of a final hidden layer immediately preceding the output layer of the neural network; and
provide the output value of the final hidden layer as a machine learning feature to the malware detection model.

11. The system of claim 10 , wherein the neural network comprises a supervised, semi-supervised, or unsupervised learning model.

12. The system of claim 10 , wherein the executable code is part of a portable executable (PE) file.

13. The system of claim 10 , wherein the image rescaling algorithm comprises a pre-processing neural network, the pre-processing neural network comprising Word2Vec.

14. The system of claim 10 , wherein the system is further caused to discard the classification of maliciousness of the executable code from the output layer of the neural network.

15. The system of claim 10 , wherein the neural network comprises between 1 and 2000 hidden layers.

16. The system of claim 10 , wherein the filter mechanism comprises a low-pass filter, box filter, delta filter, or Gaussian filter.

17. The system of claim 10 , wherein the neural network comprises a feedforward or recurrent neural network.

18. The system of claim 10 , wherein the output value of a final hidden layer comprises an indication of maliciousness of the executable code.

19. A computer-implemented method for automatically extracting a machine learning feature from executable code for input to a malware detection model, the method comprising:
accessing, by a computer system, the executable code from a file;
inputting, by the computer system, the executable code to an image rescaling algorithm comprising an embedding matrix, wherein the image rescaling algorithm is configured to convert each byte of the executable code to a numerical vector using the embedding matrix to produce an embedded vector space, wherein the image rescaling algorithm comprises a pre-processing neural network, the pre-processing neural network comprising Word2Vec, and wherein the order of the executable code is maintained during the conversion;
channel filtering, by the computer system, one or more vector layers of the embedded vector space, wherein the channel filtering comprises:
consolidating the one or more vector layers into a plurality of blocks; and
applying a filter mechanism to produce one or more fixed size vector inputs, each fixed size vector input representing a corresponding vector layer or a block of the corresponding vector layer;

inputting, by the compute

Assignees

• Sentinel Labs Israel Ltd

Inventors

• Salem Shlomi
• Ronen Roy
• Nativ Assaf
• Zohar Amit
• Braun Gal
• Ferencz Pavel
• Shterenbaum Eitan
• Maimon Tai

Classifications

• G06F21/577

  Assessing vulnerabilities and evaluating computer system security · CPC title

• G06F21/566

  Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities · CPC title

• G06F2221/033

  Test or assess software · CPC title

• G06F21/564 Primary

  by virus signature recognition · CPC title

• G06F21/54 Primary

  by adding security routines or objects to programs · CPC title