Patent ID: 11941491
Assignee: SOPHOS LIMITED
Field: Computer technology (Electrical engineering)
Classification: CPC G | IPC G

Claim 7:
8. A non-transitory processor-readable medium storing code representing instructions to be executed by a processor, the code comprising code to cause the processor to:
receive a structured file;
extract a set of features from the structured file;
provide an indication of the set of features extracted from the structured file as a first input to a machine learning model to produce a first malicious content classification;
remove a portion of the structured file to define a modified structured file, the modified structured file following a format associated with a type of the structured file;
extract a set of features from the modified structured file;
provide an indication of the set of features extracted from the modified structured file as a second input to the machine learning model to produce a second malicious content classification, the second malicious content classification being made by the same machine learning model as the first malicious content classification and for the modified structured file defined by the removal of the portion of the structured file;
determine a difference between the first malicious content classification and the second malicious content classification based on a distance measure; and
identify an impact of the portion of the structured file on the first malicious content classification based on the difference between the first malicious content classification and the second malicious content classification.