Artefact classification using xenospace centroids

Patent metadata

Field	Value
Publication number	US-11386308-B2
Application number	US-201816219616-A
Country	US
Kind code	B2
Filing date	Dec 13, 2018
Priority date	Dec 13, 2018
Publication date	Jul 12, 2022
Grant date	Jul 12, 2022

Abstract

An artefact is received and parsed into a plurality of observations. A first subset of the observations are inputted into a machine learning model trained using historical data to classify the artefact. In addition, a second subset of the observations are inputted into a xenospace centroid configured to classify the artefact. Thereafter, the artefact is classified based on a combination of an output of the machine learning model and an output of xenospace centroid. Related apparatus, systems, techniques and articles are also described.

First claim

What is claimed is:

1. A computer-implemented method comprising:
receiving an artefact;
parsing the artefact into a plurality of observations;
inputting a first subset of the observations into a machine learning model trained using historical data to classify the artefact;
inputting a second subset of the observations into a xenospace centroid configured to indicate whether cloud processing is needed to classify the artefact, the second subset of the observations being at least partially different than the first subset of the observations;
providing the second subset of observations to a remote computing system for analysis when an output of the xenospace centroid generated in response to inputting the second subset of observations indicates that the artefact requires cloud processing and receiving a classification from the remote computing system;
classifying the artefact as malicious or benign based on a combination of (i) an output of the machine learning model generated in response to inputting the first subset of observations and (ii) the received classification from the remote computing system when the output of the xenospace centroid indicates that the artefact requires cloud processing; classifying the artefact as malicious or benign based solely on the output of the machine learning model when the xenospace centroid indicates that the artefact does not need cloud processing; and
preventing the artefact from being executed, from continuing to execute, and from being accessed when the artefact is classified as malicious.

2. The method of claim 1 , wherein the artefact comprises at least one of: a file, a portion of a file, metadata characterizing a file, or source code.

3. The method of claim 1 , wherein all of the observations in the first subset of the observations differ from all of the observations in the second subset of the observations.

4. The method of claim 1 , wherein a portion of the observations in the first subset of the observations are common to a portion of the observations in the second subset of the observations.

5. The method of claim 1 , wherein the machine learning model comprises at least one of: a logistic regression model, a neural network, a concurrent neural network, a recurrent neural network, a generative adversarial network, a support vector machine, or a random forest.

6. The method of claim 1 further comprising: logging the output of the xenospace centroid for informational purposes along with an identification of the artefact.

7. The method of claim 1 , wherein at least a portion of the plurality of observations are hierarchical.

8. The method of claim 1 , wherein the observations comprise one or more of: Boolean flags, continuous values, existence values, categorical values, map values, or array values.

9. A system comprising:
at least one data processor; and
memory storing instructions which, when executed by the at least one data processor, result in operations comprising:
receiving an artefact;
parsing the artefact into a plurality of observations;
inputting a first subset of the observations into a machine learning model trained using historical data to classify the artefact;
inputting a second subset of the observations into a xenospace centroid configured to indicate whether cloud processing is needed to classify the artefact, the second subset of the observations being at least partially different than the first subset of the observations;
providing the second subset of observations to a remote computing system for analysis when an output of the xenospace centroid generated in response to inputting the second subset of observations indicates that the artefact requires cloud processing and receiving a classification from the remote computing system;
classifying the artefact as malicious or benign based on a combination of (i) an output of the machine learning model generated in response to inputting the first subset of observations and (ii) the received classification from the remote computing system when the output of the xenospace centroid indicates that the artefact requires cloud processing;
classifying the artefact as malicious or benign based solely on the output of the machine learning model when the xenospace centroid indicates that the artefact does not need cloud processing; and
preventing the artefact from being executed, from continuing to execute, and from being accessed when the artefact is classified as malicious.

10. The system of claim 9 , wherein the artefact comprises at least one of: a file, a portion of a file, metadata characterizing a file, or source code.

11. The system of claim 9 , wherein the machine learning model comprises at least one of: a logistic regression model, a neural network, a concurrent neural network, a recurrent neural network, a generative adversarial network, a support vector machine, or a random forest.

12. The system of claim 9 , wherein all of the observations in the first subset of the observations differ from all of the observations in the second subset of the observations.

13. The system of claim 9 , wherein a portion of the observations in the first subset of the observations are common to a portion of the observations in the second subset of the observations.

14. The system of claim 9 , wherein the operations further comprise: logging the output of the xenospace centroid for informational purposes along with an identification of the artefact.

15. A computer-implemented method comprising:
receiving an artefact;
parsing the artefact into a plurality of observations;
inputting a first subset of the observations into a machine learning model trained using historical data to classify the artefact as being malicious or benign;
inputting a second subset of the observations into a xenospace centroid configured to indicate whether the artefact requires cloud processing;
providing the second subset of observations to a remote computing system for analysis when an output of the xenospace centroid generated in response to inputting the second subset of observations indicates that the artefact requires cloud processing and receiving a classification from the remote computing system;
classifying the artefact as malicious or benign based on a combination of (i) an output of the machine learning model generated in response to inputting the first subset of observations and (ii) the received classification from the remote computing system when the output of the xenospace centroid indicates that the artefact requires cloud processing; classifying the artefact as malicious or benign based solely on the output of the machine learning model when the xenospace centroid indicates that the artefact does not need cloud processing; and
preventing the artefact from being executed, from continuing to execute, and from being accessed when the artefact is classified as malicious.

16. The method of claim 15 , wherein the machine learning model comprises at least one of: a logistic regression model, a neural network, a concurrent neural network, a recurrent neural network, a generative adversarial network, a support vector machine, or a random forest.

17. The method of claim 15 , wherein the artefact comprises at least one of: a file, a portion of a file, metadata characterizing a file, or source code.

18. The method of claim 15 , wherein all of the observations in the first subset of the observations differ from all of the observations in the second subset of the observations.

19. The method of claim 15 , wherein a portion of the observations in the

Assignees

• Cylance Inc

Inventors

• Beveridge David N
• Buckingham Hailey
• Oliinyk Yaroslav
• Petersen Eric

Classifications

• G06N20/20 Primary

  Ensemble learning · CPC title

• G06F18/24137

  Distances to cluster centroïds · CPC title

• G06F21/56

  Computer malware detection or handling, e.g. anti-virus arrangements · CPC title

• G06N20/00

  Machine learning · CPC title

• G06K9/6272 Primary

  Physics · mapped topic