Patent ID: 11928213
Assignee: CYLANCE INC.
Field: Computer technology (Electrical engineering)
Classification: CPC G | IPC G

Claim 7:
8. A computer-implemented method, comprising:
receiving a disassembled binary file that includes a plurality of instructions;
processing the disassembled binary file with a trained convolutional neural network configured to (i) apply a first plurality of kernels to detect a presence of one or more sequences of instructions amongst the plurality of instructions, the first plurality of kernels being adapted to detect different sequences of instructions (ii) apply a second plurality of kernels to the disassembled binary file, the second plurality of kernels being adapted to detect specific sequences of two or more sequences of instructions detected by the first plurality of kernels, and (iii) determine a classification for the disassembled binary file based at least in part on the presence of the one or more sequences of instructions; and
providing, as an output, the classification of the disassembled binary file to determine whether to execute, open, or access a binary file corresponding to the disassembled binary file;
wherein the convolutional network is trained using a plurality of training files having fixed length representations of instructions, the fixed length representations of instructions are applied to a plurality of kernels adapted to generate increasingly abstract representations of such instructions, some of the kernels are configured to detect specific sequences of instructions while subsequent application of other kernels are configured to detect instances where certain sequences of instructions that appear in a specific order.