Patent ID: 11928213
Assignee: CYLANCE INC.
Field: Computer technology (Electrical engineering)
Classification: CPC G | IPC G

Claim 15:
16. A computer-implemented method, comprising:
receiving a disassembled binary file that includes a plurality of instructions;
generating fixed length representations of the plurality of instructions by processing each of the plurality of instructions having lengths other than a first length by either truncating the instructions so that they are the first length or by padding the instructions so that they are the first length, the truncating maintaining instruction mnemonics and operands in the corresponding instructions;
processing the generated fixed length representation of the plurality of instructions with a trained convolutional neural network configured to apply two different pluralities of kernels to first detect a presence of one or more sequences of instructions amongst the plurality of instructions, subsequently detect specific sequences of two or more sequences of instructions, and determine a classification for the disassembled binary file based at least in part on the presence of the one or more sequences of instructions; and
providing, as an output, the classification of the disassembled binary file to determine whether to execute, open, or access a binary file corresponding to the disassembled binary file.