Training a machine learning model for analysis of instruction sequences

Patent metadata

Field	Value
Publication number	US-2018075349-A1
Application number	US-201615345436-A
Country	US
Kind code	A1
Filing date	Nov 7, 2016
Priority date	Sep 9, 2016
Publication date	Mar 15, 2018
Grant date	—

Abstract

In one respect, there is provided a system for training a neural network adapted for classifying one or more instruction sequences. The system may include at least one processor and at least one memory. The memory may include program code which when executed by the at least one processor provides operations including: training, based at least on training data, a machine learning model to detect one or more predetermined interdependencies amongst a plurality of tokens in the training data; and providing the trained machine learning model to enable classification of one or more instruction sequences. Related methods and articles of manufacture, including computer program products, are also provided.

First claim

1 . A system, comprising:
at least one processor; and at least one memory including program code which when executed by the at least one processor provides operations comprising: training, based at least on training data, a machine learning model to detect one or more predetermined interdependencies amongst a plurality of tokens in the training data; and providing the trained machine learning model to enable classification of one or more instruction sequences.

2 . The system of claim 1 further comprising:
receiving the training data, wherein the training data comprises a sequence of instructions.

3 . The system of claim 2 , wherein the sequence of instructions includes the plurality of tokens, and wherein at least one of the plurality of tokens comprises at least one character and/or binary digit.

4 . The system of claim 1 , wherein the one or more predetermined interdependencies include a presence, in the training data, of a first token subsequent to at least a second token.

5 . The system of claim 1 , wherein the one or more predetermined interdependencies indicate at least one function and/or behavior associated with the training data.

6 . The system of claim 1 , wherein the machine learning model comprises a neural network.

7 . The system of claim 6 , wherein the neural network comprises a long short-term memory neural network.

8 . The system of claim 7 , wherein the long short-term memory neural network comprises an embedding layer configured to generate vector representations of the plurality of tokens in the training data.

9 . The system of claim 8 , wherein the embedding layer is configured to use one-hot encoding to generate the vector representations of the plurality of tokens in the training data.

10 . The system of claim 8 , wherein the embedding layer is configured word2vec to generate the vector representations of the plurality of tokens in the training data.

11 . The system of claim 7 , wherein the long short-term memory neural network comprises a first long short-term memory layer, and wherein the first long short-term memory layer comprises a memory cell having an input gate, an output gate, and a forget gate.

12 . The system of claim 11 , wherein the first long short-term memory layer is configured to receive a first token from the plurality of tokens included in the training data.

13 . The system of claim 12 , wherein a current hidden state of the first long short-term memory layer is determined based at least on the first token and a previous hidden state of the first long-short term memory layer, wherein the previous hidden state of the first long short-term memory layer corresponds to one or more tokens already processed by the long short-term memory neural network, and wherein an output of the first long-short term memory layer corresponds to the current hidden state of the first long short-term memory layer.

14 . The system of claim 11 , wherein the long short-term memory neural network further comprises a second long short-term memory layer, wherein the first long short-term memory layer is configured to detect one or more predetermined interdependencies in one direction by at least processing the plurality of tokens in a forward order, and wherein the second long short-term memory layer is configured to detect one or more other predetermined interdependencies in an opposite direction by at least processing the plurality of tokens in an opposite order.

15 . The system of claim 6 , wherein the neural network comprises a recursive neural tensor network.

16 . The system of claim 15 , wherein training the recursive neural tensor network includes processing an abstract syntax tree representation of the training data with the recursive neural tensor network.

17 . The system of claim 16 , further comprising:
generating, based at least on a structure of the plurality of tokens in the training data, the abstract syntax tree representation of the training data.

18 . The system of claim 17 , wherein the abstract syntax tree representation of the training data includes a parent node corresponding to a first token from the plurality of tokens in the training data, and a leaf node corresponding to a second token from the plurality of tokens in the training data, and wherein the leaf node comprises a child node of the parent node.

19 . The system of claim 18 , wherein the first token indicates a rule for combining the second token and a third token from the plurality of tokens in the training data.

20 . The system of claim 19 , wherein the parent node is associated with a weight that is determined based at least on a first weight and a first tensor associated with the leaf node, and a second weight and a second tensor associated with another leaf node corresponding to the third token.

21 .- 38 . (canceled)

Assignees

• Cylance Inc

Inventors

• Zhao Xuan
• Wolff Matthew
• Brock John
• Wallace Brian
• Wortman Andrew
• Luan Jian
• Azarafrooz Mahdi
• Davis Andrew
• Wojnowicz Michael
• Soeder Derek
• Beveridge David
• Petersen Eric
• Jin Ming
• Permeh Ryan

Classifications

• G06F21/563 Primary

  by source code analysis · CPC title

• G06N3/044

  Recurrent networks, e.g. Hopfield networks · CPC title

• G06N3/0442 Primary

  characterised by memory or gating, e.g. long short-term memory [LSTM] or gated recurrent units [GRU] · CPC title

• G06N3/09

  Supervised learning · CPC title

• G06N3/08 Primary

  Learning methods · CPC title