Assured Information Security, Inc.

Daniel Scofield

Craig Miles

A method includes, as part of establishing a feature merging threshold (α) for determining equivalence between two features, selecting a set of candidate α values, partitioning training data into a plurality of groups, establishing a model Wfor each α value of the set of candidate α values, iteratively performing: selecting a next group of training data of the plurality of groups of training data; adding the selected next group of training data to a training set; and for each α value in the set of candidate α values: training the Wfor the α value using the training set, and evaluating a size of W, the size comprising a number of features included in the model, and choosing the feature merging threshold α based on the iteratively performing.

Feature equivalence and document abnormality threshold determination

A method includes monitoring system call invocations made to an operating system of a computer system by an application as the application renders a digital file. The method automatically featurizes the system call invocations into a set of features corresponding to the digital file, and compares each feature set against benign features of a set of known benign features. The comparing includes, for each feature of the set of features, applying entity resolution between the feature and benign feature(s) of the set of known benign features to find a correlation between the feature and a benign feature representing a common semantic interaction between the application and the operating system. The method identifies a number of features that do not correlate to the benign features, and determines maliciousness of the digital file based on the identified number of features that do not correlate to the benign features.

Growing community of inventors

Portland, OR, United States of America

Daniel Scofield