Patent ID: 11941491
Assignee: SOPHOS LIMITED
Field: Computer technology (Electrical engineering)
Classification: CPC G | IPC G

Claim 16:
17. The non-transitory processor-readable medium of claim 8, wherein the portion s a first portion from a set of portions of the structured file, the code comprising code to cause the processor to:
identify an impact of a second portion of the structured file on the first malicious content classification based on a difference between the first malicious content classification and a third malicious content classification, the third malicious content classification generated by the machine learning model in response to providing as a third input an indication of a set of features extracted from a second modified structured file, the second modified structured file defined by removing the second portion from the structured file;
generate a first indicator of maliciousness of the structured file based on the impact of the first portion of the structured file on the first malicious content classification;
generate a second indicator of maliciousness of the structured file based on the impact of the second portion of the structured file on the first malicious content classification;
initiate an action based on a determination of multiple indicators of maliciousness, based on the first indicator of maliciousness of the structured file and the second indicator of maliciousness of the structured file.