Patent ID: 11868473
Assignee: ORANGE
Field: Computer technology (Electrical engineering)
Classification: CPC G | IPC G

Claim 5:
6. A server for constructing behavioral signatures of software packages, said server comprising:
a processor; and
a non-transitory computer-readable medium comprising instructions stored thereon which when executed by the processor configure the server to:
embed execution traces of a set of software packages in a vector space, an execution trace of a software package comprising at least one event and being representative of the execution of the software package, said embedding representing an event of the execution trace with a vector encoding a context of occurrence of the event,
cluster vectors associated with the software packages of the set, said clustering generating at least one data group, the data group being representative of a behavior, a behavioral label being associated with said data group,
associate a behavioral label with a vector, the behavioral label associated with the vector being representative of the data group to which the vector belongs, and association of a behavioral-label trace with a vector trace, said label trace being representative of the execution of the software package, and
extract from the label trace at least two behavioral signatures associated with the software package, a first of said at least two behavioral signatures being a signature of a first order corresponding to a k-gram present in the behavioral-label trace and a second of said at least two behavioral signatures being a signature of an order equal to at least two obtained by a combination of at least two signatures of the first order by using Boolean operators, the combination of the signatures of the first order being present in the execution trace of the software package.