Patent Document ID: 10157279
Application ID: 15210761
Patent Flag: 1

Claim One:
1. A system, comprising: at least one processor; and at least one memory including program code which when executed by the at least one memory provides operations comprising: receiving a disassembled binary file that includes a plurality of instructions; generating fixed length representations of the plurality of instructions by truncating each of the plurality of instructions to a same length and to remove portions of the instructions not relevant to malware detection; encoding the fixed length representations of the instructions; processing the encoded fixed length representations of the instructions with a convolutional neural network configured to detect a presence of one or more sequences of instructions amongst the plurality of instructions and determine a classification for the disassembled binary file based at least in part on the presence of the one or more sequences of instructions; and providing, as an output, the classification of the disassembled binary file, the classification being used to determine whether to execute, open, or download the disassembled binary file; wherein the convolutional network is trained using a plurality of training files having fixed length representations of instructions, the fixed length representations of instructions are applied to a plurality of kernels adapted to generate increasingly abstract representations of such instructions, some of the kernels are configured to detect specific sequences of instructions while subsequent application of other kernels are configured to detect instances where certain sequences of instructions that appear in a specific order.