Identify malicious software

Patent metadata

Field	Value
Publication number	US-2025053654-A1
Application number	US-202418925605-A
Country	US
Kind code	A1
Filing date	Oct 24, 2024
Priority date	May 21, 2018
Publication date	Feb 13, 2025
Grant date	—

Abstract

A method for identifying malicious software includes receiving and executing a software application, identifying a plurality of uniform resource identifiers the software application interacts with during execution of the software application, and generating a vector representation for the software application using a feed-forward neural network configured to receive the plurality of uniform resource identifiers as feature inputs. The method also includes determining similarity scores for a pool of training applications, each similarity score associated with a corresponding training application and indicating a level of similarity between the vector representation for the software application and a respective vector representation for the corresponding training application. The method also includes flagging the software application as belonging to a potentially harmful application category when one or more of the training applications have similarity scores that satisfy a similarity threshold and include a potentially harmful application label.

First claim

What is claimed is:

1 . A computer-implemented method executed by data processing hardware that causes the data processing hardware to perform operations comprising:
receiving an application install pattern from a user device, the application install pattern indicating a sequence of applications installed on the user device; for each application in the sequence of applications, predicting, based on the sequence of applications, a next application in the sequence of applications; determining, based on the sequence of applications, that the predicted next application in the sequence of applications differs from an actual next application in the sequence of applications; and based on determining that the predicted next application in the sequence of applications differs from the actual next application in the sequence of applications, identifying the actual next application in the sequence of applications as malware.

2 . The method of claim 1 , wherein the application install pattern comprises device information indicating a device type for the user device.

3 . The method of claim 2 , wherein the device type specifies that the user device is one of a smartphone, tablet, laptop, or desktop.

4 . The method of claim 1 , wherein the application install pattern further includes an operating system of the user device.

5 . The method of claim 1 , wherein the operations further comprise generating a numerical vector representation for each application in the sequence of applications using a feed-forward neural network model configured to receive each application as feature inputs.

6 . The method of claim 5 , wherein the numerical vector representation generated for each application comprises a cryptographic hash.

7 . The method of claim 5 , wherein the feed-forward neural network model comprises a vector space model configured to determine a dimensional numerical vector representation for each application in the sequence of applications installed on the user device.

8 . The method of claim 7 , wherein the vector space model is configured to cluster each application in the sequence of applications in a free vector space near training applications having similar dimensional numerical vector representations.

9 . The method of claim 1 , wherein the operations further comprise transmitting a warning notification to the user device indicating that the actual next application installed on the user device comprises malware.

10 . The method of claim 1 , wherein the operations further comprise labeling the actual next application as belonging to a potentially harmful application category, the potentially harmful application category comprising at least one of a hostile downloader application, a phishing application, a rooting trojan application, a spyware application, a ransomware application, a malware application, or an escalating privileges application.

11 . A system for identifying malicious software, the system comprising:
data processing hardware; memory hardware in communication with the data processing hardware, the memory hardware storing instructions that when executed by the data processing hardware cause the data processing hardware to perform operations comprising:
receiving an application install pattern from a user device, the application install pattern indicating a sequence of applications installed on the user device;
for each application in the sequence of applications, predicting, based on the sequence of applications, a next application in the sequence of applications;
determining, based on the sequence of applications, that the predicted next application in the sequence of applications differs from an actual next application in the sequence of applications; and
based on determining that the predicted next application in the sequence of applications differs from the actual next application in the sequence of applications, identifying the actual next application in the sequence of applications as malware.

12 . The system of claim 11 , wherein the application install pattern comprises device information indicating a device type for the user device.

13 . The system of claim 12 , wherein the device type specifies that the user device is one of a smartphone, tablet, laptop, or desktop.

14 . The system of claim 11 , wherein the application install pattern further includes an operating system of the user device.

15 . The system of claim 11 , wherein the operations further comprise generating a numerical vector representation for each application in the sequence of applications using a feed-forward neural network model configured to receive each application as feature inputs.

16 . The system of claim 15 , wherein the numerical vector representation generated for each application comprises a cryptographic hash.

17 . The system of claim 15 , wherein the feed-forward neural network model comprises a vector space model configured to determine a dimensional numerical vector representation for each application in the sequence of applications installed on the user device.

18 . The system of claim 17 , wherein the vector space model is configured to cluster each application in the sequence of applications in a free vector space near training applications having similar dimensional numerical vector representations.

19 . The system of claim 11 , wherein the operations further comprise transmitting a warning notification to the user device indicating that the actual next application installed on the user device comprises malware.

20 . The system of claim 11 , wherein the operations further comprise labeling the actual next application as belonging to a potentially harmful application category, the potentially harmful application category comprising at least one of a hostile downloader application, a phishing application, a rooting trojan application, a spyware application, a ransomware application, a malware application, or an escalating privileges application.

Assignees

• Google Llc

Inventors

• Cannings Richard
• Tetali Sai Deep
• Yu Mo
• Mandujano Salvador

Classifications

• G06N3/09

  Supervised learning · CPC title

• G06N3/0499

  Feedforward networks · CPC title

• G06N3/08

  Learning methods · CPC title

• G06N3/04

  Architecture, e.g. interconnection topology · CPC title

• G06F2221/033

  Test or assess software · CPC title