Patent ID: 11947668
Assignee: SOPHOS LIMITED
Field: Computer technology (Electrical engineering)
Classification: CPC G | IPC G

Claim 0:
1. An apparatus, comprising:
a memory; and
a processor operatively coupled to the memory, the processor configured to extract a set of features from a potentially malicious file, the processor configured to provide the set of features as an input to a normalization layer of a neural network used to classify the potentially malicious file, the normalization layer including one or more normalization nodes and one or more parameter nodes different than the one or more normalization nodes, the one or more parameter nodes configured to provide a set of parameters used during normalization as an additional input,
the processor configured to implement the normalization layer by calculating the set of parameters associated with the set of features and providing the set of parameters as an output from the normalization layer via the one or more parameter nodes, the processor configured to normalize the set of features based on the set of parameters to define a set of normalized features,
the processor configured to provide the set of normalized features, via the one or more normalization nodes, and the set of parameters, via the one or more parameter nodes, as inputs to an activation layer of the neural network such that the activation layer produces an output (1) based on the set of normalized features and the set of parameters and (2) used to produce a maliciousness classification of the potentially malicious file.