Patent ID: 11941491
Assignee: SOPHOS LIMITED
Field: Computer technology (Electrical engineering)
Classification: CPC G | IPC G

Claim 17:
18. A method, comprising:
identifying, using a processor of a malicious content detection device, a set of structured portions within a structured file;
extracting, using the processor, a set of features from the structured file;
providing, using the processor, an indication of the set of features extracted from the structured file as an input to a machine learning model to produce a first malicious content classification, the set of structured portions being such that a removal, from the structured file, of each structured portion from the set of structured portions is configured to generate a modified structured file that is valid and interpretable;
for each structured portion from the set of structured portions:
removing, using the processor, that structured portion from the structured file to define a modified structured file;
extracting, using the processor, a set of features from the modified structured file;
providing, using the processor, an indication of the set of features extracted from the modified structured file as an input to the machine learning model to produce a second malicious content classification, the second malicious content classification being made by the same machine learning model as the first malicious content classification and for the modified structured fil defined by the removal of that structured portion from the structured file;
determining, using the processor, a difference between the first malicious content classification and the second malicious content classification based on a distance measure;
identifying, using the processor, an impact of that structured portion on the first malicious content classification of the structured file based on the difference between the first malicious content classification and the second malicious content classification; and
storing, using the processor, an indication of the impact.