Patent Document ID: 8516584
Application ID: 12019060
Patent Status: 1

Claim One:
1. A method for detecting malicious behavioral patterns which are related to malicious software in computerized systems that include data exchange channels with other systems over a data network, the method comprising: (a) performing an Artificial Neural Network (ANN) machine learning process on known malicious code samples, wherein the ANN comprises a set of input neurons, a set of output neurons, and a set of hidden neurons arranged between the set of input neurons and the set of output neurons; (b) analyzing the results of the machine learning process in respect to hardware and/or software parameters of the computerized system; and (c) identifying known and unknown malicious code samples according to behavioral patterns, which behavioral patterns are the results of said machine learning process, wherein the behavioral patterns use the hardware and/or software parameters to represent the behavior of the computerized system; wherein the ANN machine learning process comprises: (a1) determining at least one hardware parameter and at least one software parameter in a respective computerized system, wherein the at least one hardware parameter and the at least one software parameter are capable of characterizing known behavioral patterns of the computerized system; (a2) labeling input data samples with labels that correspond to said known behavioral patterns; (a3) performing supervised training of one or more ANNs according to data sets, for which the corresponding behavioral pattern is known; (a4) feeding, into the trained ANNs, input data sets extracted from signals that correspond to said parameters; (a5) analyzing the clusters formed from the binary patterns of a set of hidden neurons of each trained ANN; (a6) whenever a formed cluster does not correspond to the binary pattern of a known behavioral pattern, alerting an expert system of that binary pattern; and (a7) classifying said unknown binary patterns as an intrusion or as a new non-malicious state, according the analysis of said unknown binary pattern by said expert system; wherein the step of identifying known and unknown malicious code samples is based on the binary patterns of the hidden neurons, which binary patterns form the said clusters.