Uab 360 It

Aleksandr Ševčenko

Mantas Briliauskas

Mohamed Adly Amer Elgaafary

Ernestas Kulik

Justas Rafanavičius

A method and apparatus for generating a content detection dataset using file creation dates. The method accesses a database comprising data files. The files are analyzed by a machine learning model to determine file creation dates. The creation dates are used to identify relevant content files. The most relevant files are included into a content detection dataset as content samples. The dataset may be used for training machine learning based content detectors.

Method and apparatus for creating a dataset using file creation dates

Methods, apparatuses and systems for automatic binary file segmentation include receiving binary content, applying a first machine learning process to the binary content to determine data segments in the binary content by identifying at least one of a respective starting point or end point of different data types in the binary content, examining the determined data segments of the binary content to identify data segments that are resistant to analysis, and applying respective techniques to the identified, analysis-resistant data segments to render the content of the identified, analysis-resistant data segments. In some embodiments, the rendering of the content of the identified, analysis-resistant data segments enables the identified, analysis-resistant segments to be analyzed, for example, to determine if the identified, analysis-resistant segments contain malicious content.

System and method for automatic binary segmentation

A method and apparatus for generating a malware detection dataset. The method accesses a database comprising malware files and metadata related to the files. The metadata is ranked and the rankings combined into a relevancy score. The most relevant files in the database are identified as malware samples. The malware samples and their related scores are stored in a malware detection dataset.

Method and apparatus for creating a malware detection dataset

A method, apparatus and system for data augmentation include receiving a first plurality of binary files each having a first binary structure and including one or more known files containing malicious content and one or more known files not containing malicious content, altering a source code of each of the first plurality of binary files to produce a second plurality of binary files each having a second binary structure that is different from the first binary structure, wherein each altered binary file is functionality similar to the corresponding file in the first plurality of binary files from which it was produced, using the first and second plurality of binary files to train the AM machine learning model to distinguish between binary files containing malicious content and binary files not containing malicious content, and applying the trained AM machine learning model to identify unknown binary files containing malicious content.

System and method for computer security augmented data set algorithm training

A method and apparatus for testing a malware detection machine learning model. The method trains a malware detection model using a first dataset containing malware samples from a particular time period. The trained model is then tested using a second dataset that is a time shifted version of the first dataset.

Method and apparatus for testing a malware detection machine learning model

Systems and methods for malware filtering are provided herein. In some embodiments, a system having one or more processors is configured to: retrieve a file downloaded to a user device; break the downloaded file into a plurality of chunks; scan the plurality of chunks to identify potentially malicious chunks; predict whether the downloaded file is malicious based on the scan of the plurality of chunks; and determine whether the downloaded file is malicious based on the prediction.

System and method for differential malware scanner

Systems and methods for using a kernel module to provide computer security are provided herein. In some embodiments, a method for providing computer security may include launching a kernel module at the kernel-level of a computing device, redirecting, using the kernel module, communications traffic away from a browser executing on the computing device, decoding, using the kernel module, the received traffic to create decoded traffic, analyzing the decoded traffic, using the kernel module, for content having particular characteristics and create analyzed traffic, encoding, using the kernel module, at least a portion of the analyzed traffic to create encrypted traffic, and directing the encrypted traffic to the browser.

Method and apparatus for using a kernel module to provide computer security

Systems and methods for decompiling binary code or executables are provided herein. In some embodiments, a method of training a machine learning algorithm for decompiling binary code into readable source code includes collecting a data set of source code and at least one element associated with the source code; providing binary code using the data set; training a model configured to decompile the binary code into source code using the data set by: decompiling the collected binary code into intermediate source code; comparing the source code in the data set with the intermediate source code; and updating the model and repeating the training if the source code in the data set differs from the intermediate source code by more than a threshold amount.

Growing community of inventors

Vilnius, Lithuania

Aleksandr Ševčenko