Malware detection based on training using automatic feature pruning with anomaly detection of execution graphs
US10708296B2 · kind B2 · utility
Assignee
Inventors
Key dates
| Filing date | Mar 16, 2015 |
| Grant date | Jul 7, 2020 |
| Priority date | — |
| Expiry date | Sep 24, 2035 |
Classification
- Technology area (CPC H)Electricity
- CPC primaryH04L63/1425
- WIPO fieldComputer technology
- WIPO sectorElectrical engineering
Abstract
A threat detection system for detecting malware can automatically decide, without manual expert-level interaction, the best set of features on which to train a classifier, which can result in the automatic creation of a signature-less malware detection engine. The system can use a combination of execution graphs, anomaly detection and automatic feature pruning. Execution graphs can provide a much richer structure of runtime execution behavior than conventional flat execution trace files, allowing the capture of interdependencies while preserving attribution (e.g., D happened because of A followed by B followed by C). Performing anomaly detection on this runtime execution behavior can provide higher order knowledge as to what behaviors are anomalous or not among the sample files. During training the system can automatically prune the features on which a classifier is trained based on this higher order knowledge without any manual intervention until a desired level of accuracy is achieved.
Source: USPTO / EPO open patent data. Objective bibliographic and citation counts.