Patent Document ID: 10146740
Application ID: 15452883
Patent Flag: 1

Claim One:
1. A computer implemented method for processing sparse data, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising the steps of: receiving an input matrix, the input matrix comprising a sparse data set, all columns of the input matrix being treated as elements of a root node of a tree; calculating a modified sparse data set by replacing all nonzero values in the input matrix with a common positive integer; transposing the modified sparse data set to create a transposed data set; calculating a covariance matrix by multiplying the transposed data set by the modified sparse data set; starting from a level of the root node and continuing iteratively until a level of a predefined depth of the tree has been reached, creating and populating child nodes of each node at a current level of the tree, by performing the following steps: determining a maximum value of a section of the covariance matrix corresponding to elements of a node for which child nodes are currently being created and populated, the maximum value being associated with a row and a column in the covariance matrix; determining a first anchor column in the node for which child nodes are currently being created and populated based on the row corresponding to the maximum value in the section of the covariance matrix; determining a second anchor column in the node for which child nodes are currently being created and populated based on the column in the node for which child nodes are currently being created and populated corresponding to the maximum value in the covariance matrix, the second anchor column being determined by selecting a column of the node for which child nodes are currently being created and populated that co-occurs least with the first anchor column and has a frequency greater than a column value of the column corresponding to the maximum value of the covariance matrix; assigning to a left child node of the node for which child nodes are currently being created and populated, columns of the node for which child nodes are currently being created and populated that co-occur more with the first anchor column than the second anchor column; assigning to a right child node of the node for which child nodes are currently being created and populated, columns of the node for which child nodes are currently being created and populated that co-occur more with the second anchor column than the first anchor column; and using the tree as part of a machine learning classifier to detect malware.