Emc IP Holding Company LLC

Arie Agranonik

Zohar Duchin

Erik M Heuser

A method includes generating a tokenized representation of a given software script, the tokenized representation comprising two or more tokens representing two or more commands in the given software script. The method also includes mapping the tokens of the tokenized representation to a vector space providing contextual representation of the tokens utilizing an embedding layer of a deep learning network, detecting sequences of the mapped tokens representing sequences of commands associated with designated types of script behavior utilizing at least one hidden layer of the deep learning network, and classifying the given software script based on the detected sequences of the mapped tokens utilizing one or more classification layers of the deep learning network. The method further includes modifying access by a given client device to the given software script responsive to classifying the given software script as a given software script type.

Classifying software scripts utilizing deep learning networks

A method includes generating an index representation of characters of code of a given file and mapping the index representation to a vector space providing contextual representation of the characters utilizing an embedding layer of a recurrent neural network (RNN). The method also includes identifying one or more code features in the mapped index representation utilizing at least one hidden layer of the RNN, detecting sequences of the identified code features in the mapped index representation utilizing a plurality of memory units of a recurrent layer of the RNN, and generating a classification result for the given file based on the detected sequences of code features utilizing one or more classification layers of the RNN. The method further comprises utilizing the classification result to determine if the given file contains code of a designated code type, and modifying access by a given client device to the given file responsive to the determination.

Detecting code obfuscation using recurrent neural networks

A method includes obtaining session data related to a plurality of network sessions, analyzing the session data to identify one or more features of the network sessions, and utilizing the one or more features to aggregate the plurality of network sessions into a plurality of meta-sessions. A meta-session comprises a set of network sessions having similar features. The method also includes selecting a classifier for ranking the meta-sessions based on a scoring function that characterizes performance in ranking meta-sessions having a designated characteristic, ranking the meta-sessions utilizing the selected classifier, providing a designated number of the ranked meta-sessions for additional processing to determine potential maliciousness, and modifying access by client devices to an additional network session responsive to the additional network session comprising session data with features similar to those of one of the designated number of the ranked meta-sessions determined to be potentially malicious.

Growing community of inventors

Herzelia, Israel

Arie Agranonik