Patent ID: 11960597
Assignee: F.A.C.C.T. NETWORK SECURITY LLC
Field: Computer technology (Electrical engineering)
Classification: CPC G | IPC G

Claim 1:
2. The method of claim 1, wherein the respective predetermined data type of features associated with the training executable file is indicative of one of: (i) dense features including at least numerical attributes, further including at least one of: section sizes of the training executable file, sizes of the training executable file in a memory, a number of libraries of the training executable file, a number of imported symbols in of the training executable file; and indicators of compromise having been identified by human specialists in analysis of malicious code; (ii) strings; (iii) uniform resource locators (URLs); (iv) manifests including metadata of the training executable file; (v) imports including features extracted from an import table associated with the training executable file; (vi) exports including features extracted from an export table associated with the training executable file; (vii) resources including features extracted from a resource catalogue associated with the training executable file; (viii) blacklisted strings including strings having been identified as being suspicious; (ix) local variables thread local storage (tls) associated with the training executable file; and (x) relocations including features extracted from an address settings table associated with the training executable file.