Patent application EP21176485A (EP), filed 2021-05-28
Publication number: EP3916597A1
Title: DETECTING MALWARE WITH DEEP GENERATIVE MODELS
Abstract: Features are extracted from an artifact so that a vector can be populated. The vector is then inputted into an anomaly detection model comprising a deep generative model to generate a first score. The first score can characterize the artifact as being malicious or benign to access, execute, or continue to execute. In addition, the vector is inputted into a machine learning-based classification model to generate a second score. The second score can also characterize the artifact as being malicious or benign to access, execute, or continue to execute. The second score is then modified based on the first score to result in a final score. The final score can then be provided to a consuming application or process. Related apparatus, systems, techniques and articles are also described.
IPC codes: H04L  29/    06            A I
G06F  21/    55            A I
G06N  20/    00            A I
H04L   9/    40            A I
Claims: number: 1
text: A computer-implemented method comprising:
number: 2
text: The method of claim 1, wherein the deep generative model is a likelihood-based model.
number: 3
text: The method of claim 2, wherein the likelihood-based model comprises a variational autoencoder.
number: 4
text: The method of claim 2, wherein the likelihood-based model comprises a normalizing flow.
number: 5
text: The method of claim 1, wherein the anomaly detection model forms part of an ensemble of models including at least one machine learning model selected from a group consisting of: a logistic regression model, a neural network, a convolutional neural network, a recurrent neural network, a generative adversarial network, a support vector machine, a random forest, or a Bayesian model.
number: 6
text: The method of claim 1 further comprising:
reducing (140; 230) features in the vector prior to the vector being input into the anomaly detection model using a feature reduction operation.
number: 7
text: The method of claim 6, wherein the feature reduction operation comprises random projection or feature hashing.
number: 8
text: The method of claim 6, wherein the feature reduction operation comprises deterministic or stochastic principal component analysis.
number: 9
text: The method of claim 1, wherein the modifying comprises either:
number: 10
text: The method of claim 1, wherein there are a plurality of vectors and there are a plurality of classification models and wherein the model comprises applying a varying weight to each of the classification models based on the first score.
number: 11
text: The method of claim 1, wherein the modifying comprises:
transmitting the vector to a second classification model for classification when the first score is above a threshold, wherein an output of the second classification model is used to generate the final score.
number: 12
text: The method of claim 11, wherein the more second classification model is more computationally intensive than the classification model.
number: 13
text: The method of claim 11, wherein the second classification model is executed by either: a computing device also executing the classification model; or a computing device remote from a computing device executing the classification model.
number: 14
text: A system (300) comprising:
number: 15
text: A non-transitory computer program product comprising instructions which, when executed by at least one computing device, result in operations comprising the methods of any one of claims 1 to 13.
Office action: search_report, dated 2021-12-01
Rejection reasons: novelty_epc_54
Prior art cited: ref_id: US2020074238A1
ref_type: patent
severity: background
ref_id: US2015128263A1
ref_type: patent
severity: background
ref_id: US2017149813A1
ref_type: patent
severity: background
ref_id: US2015128263
ref_type: patent
severity: novelty_destroying
ref_id: US2017149813
ref_type: patent
severity: novelty_destroying
ref_id: US2020074238
ref_type: patent
severity: novelty_destroying
Final disposition: pending (2021-12-01)