Patent application EP18204711A (EP), filed 2018-11-06
Publication number: EP3522080A1
Title: SYSTEM AND METHOD OF TRAINING A MACHINE LEARNING MODEL FOR DETECTION OF MALICIOUS CONTAINERS
Abstract: Disclosed are systems and methods for training and retraining a model for detection of malicious activity from container files, which contain at least two or more objects constituting logically separate data regions. Parameters of each object chosen from at least one safe container and one malicious container are determined which uniquely characterize the functional relation of the mentioned object to at least one selected object. Convolutions are formed separately for each container on the basis of the determined parameters of the objects, which are used to train a machine learning model for detecting malicious container files.
IPC codes: G06F  21/    56            A I
G06N  20/    00            A I
G06N   3/    02            A I
G06F  21/    53            A I
G06N   3/    04            A I
G06N   3/    08            A I
Claims: number: 1
text: A computer-implemented method for training a machine learning model for detecting malicious container files, comprising:
number: 2
text: The method according to claim 1, further comprising:
number: 3
text: The method according to claim 2, further comprising:
number: 4
text: The method according to claim 2, further comprising:
number: 5
text: The method according to any of claims 1 to 4, wherein the malicious container file is one of a PDF (Portable Document Format) document, a software distro, and a file archive.
number: 6
text: The method according to any of claims 1 to 5, wherein the object selected from the container file is at least one of an executable file, a script, media data, and another container file.
number: 7
text: The method according to any of claims 1 to 6, wherein the determined parameters of at least one selected object comprise at least one of a type of the selected object, a size of the selected object, and an index of the selected object among all the objects contained in the container file.
number: 8
text: The method according to any of claims 1 to 7, wherein the determining at least one parameter for each object selected from the malicious container file is performed using a second machine learning model, wherein the second machine learning model comprises a set of rules for determining the parameters of the objects such that each determined parameter increases a probability of classifying a target container file as malicious.
number: 9
text: A system for training a machine learning model for detecting malicious container files, the system comprising:
number: 10
text: The system according to claim 9, wherein the processor is configured to:
number: 11
text: The system according to claim 10, wherein the processor is configured to:
number: 12
text: The system according to claim 10, wherein the processor is configured to:
number: 13
text: The system according to any of claims 9 to 12, wherein the malicious container file is one of a PDF (Portable Document Format) document, a software distro, and a file archive.
number: 14
text: The system according to any of claims 9 to 13, wherein the object selected from the container file is at least one of an executable file, a script, media data, and another container file.
number: 15
text: The system according to any of claims 9 to 14, wherein the determined parameters of at least one selected object comprise at least one of a type of the selected object, a size of the selected object, and an index of the selected object among all the objects contained in the container file.
number: 16
text: The system according to any of claims 9 to 15, wherein the determination of at least one parameter for each object selected from the malicious container file is performed using a second machine learning model, wherein the second machine learning model comprises a set of rules for determining the parameters of the objects such that each determined parameter increases a probability of classifying a target container file as malicious
Office action: search_report, dated 2019-08-07
Prior art cited: ref_id: WO2018045165A1
ref_type: patent
severity: background
ref_id: US2017017793A1
ref_type: patent
severity: background
ref_id: US2017372071A1
ref_type: patent
severity: background
ref_id: US2017017793
ref_type: patent
severity: background
ref_id: US2017372071
ref_type: patent
severity: background
ref_id: WO2018045165
ref_type: patent
severity: background
Final disposition: pending (2019-08-07)