Machine learning data filtering in a cross-domain environment

Patent metadata

Field	Value
Publication number	US-2020036732-A1
Application number	US-201816047926-A
Country	US
Kind code	A1
Filing date	Jul 27, 2018
Priority date	Jul 27, 2018
Publication date	Jan 30, 2020
Grant date	—

Abstract

Techniques for transferring data from a first domain to a second domain in a cross-domain environment are presented. The techniques can include accepting computer readable data in the first domain for transfer to the second domain, passing the computer readable data to a first machine learning classifier at the first domain trained with at least malware files publicly identified as malicious, passing the computer readable data to a second machine learning classifier at the first domain trained with at least malware files specific to the first domain, and transferring the computer readable data to a destination in the second domain.

First claim

What is claimed is:

1 . A method of transferring data from a first domain to a second domain in a cross-domain environment, the method comprising:
accepting computer readable data in the first domain for transfer to the second domain; passing the computer readable data to a first machine learning classifier at the first domain trained with at least malware files publicly identified as malicious; passing the computer readable data to a second machine learning classifier at the first domain trained with at least malware files specific to the first domain; and transferring the computer readable data to a destination in the second domain.

2 . The method of claim 1 , further comprising:
passing the computer readable data to a third machine learning classifier at the second domain trained with at least malware files publicly identified as malicious; and passing the computer readable data to a fourth machine learning classifier at the second domain trained with at least malware files specific to the second domain.

3 . The method of claim 1 , further comprising passing the computer readable data to at least one filter configured to filter computer files based on at least one of: malware file signatures, sandbox behavior, metadata, or normalization.

4 . The method of claim 1 , wherein the malware files publicly identified as malicious comprise files of malware used to generate signatures for a signature-based malware detection system.

5 . The method of claim 1 , wherein the malware publicly identified as malicious comprise files with well formed formats.

6 . The method of claim 1 , wherein the malware files specific to the first domain comprise malformed files.

7 . The method of claim 1 , wherein the malware specific to the first domain comprise camera data.

8 . The method of claim 7 , wherein the camera data comprises camera control data.

9 . The method of claim 1 , wherein the malware files specific to the first domain comprise command and control data.

10 . The method of claim 1 , wherein the malware files specific to the first domain comprise audio sensor data.

11 . A computer system for transferring data from a first domain to a second domain in a cross-domain environment, the system comprising:
an interface at the first domain for accepting computer readable data in the first domain for transfer to the second domain; a first machine learning classifier at the first domain trained with at least malware files publicly identified as malicious; and a second machine learning classifier at the first domain trained with at least malware files specific to the first domain; wherein the interface is configured to accept computer readable data and pass it to at least the first machine learning classifier and the second machine learning classifier before passing the computer readable data to the second cross-domain environment.

12 . The system of claim 11 , further comprising:
a third machine learning classifier at the second domain trained with at least malware files publicly identified as malicious; and a fourth machine learning classifier at the second domain trained with at least malware files specific to the second domain; wherein the system is configured to pass the computer readable data to at least the third machine learning classifier and to the fourth machine learning classifier in the second cross-domain environment.

13 . The system of claim 11 , further comprising at least one filter communicatively coupled to receive the computer readable data and configured to filter computer files based on at least one of: malware file signatures, sandbox behavior, metadata, or normalization.

14 . The system of claim 11 , wherein the malware files publicly identified as malicious comprise files of malware used to generate signatures for a signature-based malware detection system.

15 . The system of claim 11 , wherein the malware files publicly identified as malicious comprise files with well formed formats.

16 . The system of claim 11 , wherein the malware files specific to the first domain comprise malformed files.

17 . The system of claim 11 , wherein the malware files specific to the first domain comprise camera data.

18 . The system of claim 17 , wherein the camera data comprises camera control data.

19 . The system of claim 11 , wherein the malware files specific to the first domain comprise command and control data.

20 . The system of claim 11 , wherein the malware specific to the first domain comprise audio sensor data.

Assignees

• Boeing Co

Inventors

• Grubel Brian C
• Ward Raymond L

Classifications

• G06F21/556

  involving covert channels, i.e. data leakage between processes (inhibiting the analysis of circuitry or operation with measures against power attack G06F21/755) · CPC title

• G06F2221/2113

  Multi-level security, e.g. mandatory access control · CPC title

• G06F21/564 Primary

  by virus signature recognition · CPC title

• H04L63/0227 Primary

  Filtering policies (mail message filtering H04L51/212) · CPC title

• H04L63/145 Primary

  the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms · CPC title