Patent Document ID: 20170053119
Application ID: 15346694
Patent Flag: 0

Claim One:
1. A method of determining whether an executable file is malware by using network behavioral artifacts, the method comprising: identifying a training corpus comprising plurality of benign executable files and a plurality of malware executable files; assigning, by an electronic hardware processor, each executable file from the training corpus a respective string of character sets; obtaining, by an electronic hardware processor, for each of the plurality of strings of character sets, a respective set of contiguous substrings, ordering, by an electronic hardware processor, a union of the respective sets of contiguous substrings, forming, for each executable file from the training corpus and by an electronic hardware processor, a respective feature vector to generate a plurality of feature vectors; classifying, by an electronic hardware processor, each respective feature vector of the plurality of feature vectors as associated with either a benign executable file or a malware executable file; training a machine learning system with a set of classified feature vectors, wherein the machine learning system comprises an electronic hardware processor; identifying an unknown executable file; generating, by an electronic hardware processor, a feature vector for the unknown executable file; submitting the feature vector for the unknown executable file to the machine learning system; and obtaining, by an electronic hardware processor, a classification of the unknown executable file as one of likely benign and likely malware.