Patent Document ID: 9779238
Application ID: 15346694
Patent Flag: 1

Claim One:
1. A computer-implemented method of determining whether an executable file is malware by using network behavioral artifacts, the method comprising: generating network behavioral artifacts for each executable file included in a training corpus comprising one or more executable files classified as benign and one or more executable files classified as malware; assigning, by an electronic hardware processor, for each executable file included in the training corpus, a respective string of character sets to represent the network behavioral artifacts generated for the executable file; forming, for each executable file included in the training corpus, a respective feature vector based on the respective string of character sets, wherein the respective feature vector indicates, for each contiguous character substring included in a plurality of contiguous character substrings, how many instances of the contiguous character substring appear in the respective string of character sets; training a machine learning system based on the respective feature vectors; generating a feature vector for an unknown executable file; classifying, by the machine learning system, the unknown executable file as one of likely benign and likely malware based on the feature vector for the unknown executable file; and outputting the classification of the unknown executable file.