PATENT CLAIM ANALYSIS

Application Number: 16252421
Application Type: Utility
Filing Date: 2019-01
Publication Date: 2019-05
Patent Classification: ["726", "023000"]

Abstract:
Techniques for automatically grouping malware based on artifacts are disclosed. In some embodiments, a system, process, and/or computer program product for automatically grouping malware based on artifacts includes receiving a plurality of samples for performing automated malware analysis to generate log files based on the automated malware analysis; processing the log files to extract features associated with malware; clustering the plurality of samples based on the extracted features; and performing an action based on the clustering output.

Claim (Index 1):
A system, comprising:\n a processor configured to:\n cluster a plurality of samples based on a plurality of features associated with malware, wherein each of the features corresponds to a line or a sub-line in one or more log files determined to be an artifact associated with malware based on an automated malware analysis, wherein clustering the plurality of samples based on the plurality of features further comprises:\n select one or more of the plurality of features and assigning values to each indicator, wherein selecting one or more of the plurality of features includes performing a pre-filtering operation to select the plurality of features for clustering based on a threshold association between the line or the sub-line in the one or more of the log files and known malware; \n collect the assigned values in an array for each of the plurality of samples; \n compare the assigned values of the array between two of the plurality of samples; and \n calculate a distance between the two samples, wherein the samples within a defined threshold of distance are clustered; and \n \n perform an action based on an output of clustering the plurality of samples based on the plurality of features, wherein the action based on the output of clustering the plurality of samples based on the plurality of features further comprises validate the output of clustering the plurality of samples based on the plurality of features based on tags to identify previously identified malware groups; and \n a memory coupled to the processor and configured to provide the processor with instructions.

Metadata:
- Claim Count in Document: 50.0
- Percentile: 99.0
- Lexical Diversity: 1.80851
- Patent Class: 726.0
- Transitional Phrase Type: open
- Component Type: 1
- Foreign Priority: False
- Related Applications: ['15056976', '15056974', '15056981', '15056980', '15688649']

Analysis Scores:
- 35 USC 101 Eligibility (BERT): 0.3328952822498403
- 35 USC 102 Novelty (BERT): 0.5666688581726379
- Combined Prediction Score: 0.35627263984212
- Mean Citation Score: 368.91555
- Max Citation Score: 450.5221
- Similarity Product: 381.85650927915583

Labels:
- Claim Label 101: 1
- Claim Label 102: 1
- Claim Label 103: 1
- Claim Label 112: 1
- Combined Label: 1
- Label 101 Adjusted: 1

Dataset: test