International Business Machines Corporation

Gal Steimberg

Eitan Menahem

A system for training a file classification model for classifying malicious software comprising at least one hardware processor adapted to: computing a plurality of datasets, each for one of a plurality of executable files, each file having a label, each dataset is computed by: receiving a respective file; detecting a plurality of binary functions in the respective file; translating each of the respective plurality of binary functions to produce a plurality of disassembled functions; clustering a plurality of operation-codes identified in the plurality of disassembled functions into a plurality of clusters according to respective operation-code; computing a plurality of statistical values of the plurality of disassembled functions and the plurality of clusters; and associating the plurality of statistical values with the file's label to produce a dataset; and training a file classification model using the plurality of datasets to compute at least one classification score of an input file.

Growing community of inventors

Yavne, Israel

Gal Steimberg