Patent Document ID: 9864956
Application ID: 15583565

Base Claim:
1. A computing device comprising: a memory configured to store instructions to execute a trained file classifier; and a processor configured to execute the instructions from the memory to perform operations comprising: receiving, via a network from a remote computing device, a feature vector representing a file stored in a memory of the remote computing device, the feature vector including: a zero-skip n-gram indicating occurrences of adjacent characters in printable characters representing the file, a skip n-gram indicating occurrences of non-adjacent characters in the printable characters representing the file; and an n-gram indicating occurrences of groups of entropy indicators in a set of entropy indicators derived from file entropy data for the file, each entropy indicator of the set of entropy indicators having a value representing entropy of a corresponding chunk of the file; generating, by the trained file classifier, classification data associated with the file based on the feature vector, the classification data indicating whether the file includes malware; and transmitting the classification data to the remote computing device via the network, wherein access to the file or execution of the file at the remote computing device is restricted responsive to the classification data indicating that the file includes malware.

---

Claim 3:
3. The computing device of claim 1 , wherein the zero-skip n-gram indicates a count of the occurrences of the adjacent characters in the printable characters.