Facebook, Inc.

Zscaler, Inc.

Hao Xu

Javier Olivan Lopez

Jian L Zhen

Huihsin Tseng

Kiranjit Singh Sidhu

James M Leszczenski

Christopher Marshall Turitzin

Hisham Rabih Harik

Michael Hudack

Edward Baker

The methods described herein include receiving a plurality of packets associated with a file, each of the plurality of packets comprising content, and a source domain; extracting one or more features from content of a first packet of the plurality of packets; applying a trained machine learning model to the extracted one or more features to determine a probability of maliciousness associated with the first packet; responsive to determining that the probability maliciousness of the first packet is between a first threshold value and a second threshold value, labeling the first packet as having an uncertain maliciousness; extracting one or more features from content of a second packet of the plurality of packets; and applying the trained machine learning model to the extracted one or more features of the first packet and the second packet to determine a probability of maliciousness associated with the second packet.

Systems and methods for intelligent machine learning-based malware detection

Disclosed is a computer implemented method for malware detection that analyses a file on a per packet basis. The method receives a packet of one or more packets associated a file, and converting a binary content associated with the packet into a digital representation and tokenizing plain text content associated with the packet. The method extracts one or more n-gram features, an entropy feature, and a domain feature from the converted content of the packet and applies a trained machine learning model to the one or more features extracted from the packet. The output of the machine learning method is a probability of maliciousness associated with the received packet. If the probability of maliciousness is above a threshold value, the method determines that the file associated with the received packet is malicious.

Machine learning-based malware detection system and method

System and method for malware detection on a per packet basis

Particular embodiments may receive one or more data items associated with a first user of a social-networking system. The one or more data items being related to an entity. One or more data stores may store a social graph of the social-networking system. The social graph may comprise a plurality of nodes and plurality of edges between nodes. The nodes may comprise user nodes corresponding to users of the social-networking system and concept nodes corresponding to concepts. Particular embodiments may identify one or more nodes of the social graph that likely match the entity and associate at least one of the data items to at least one of the identified nodes.

Soft matching user identifiers

Translations for items of user-generated content are received from one or more users associated with a social networking system and/or one or more machine-generated translations. Each translation may translate a content item from a source or original language to a target language. Votes regarding the suitability of the translations are received from one or more users. In one aspect, the option to provide translations and/or vote on translations is provided to those users that are determined to be competent in the source language of the item of user-generated content. Determination of whether a user is competent in the source language can be based on the user profile of the user, the user-generated content of the user, the language competencies of the user's connections, and/or other social signals.

Community translation of user-generated content

A social networking system receives contact information from a social networking system user. The received contact information is stored and associated with a user profile in the social networking system including information matching at least a portion of the stored content information. This increases the information associated with the user profile. Subsequently received content information is compared to user profiles and stored contact information associated with one or more user profiles. User profiles including information matching at least a portion of the subsequently received content information or associated with stored contact information matching at least a portion of the subsequently received content information are identified as potential connections for the user providing the subsequently received contact information.

Growing community of inventors

Palo Alto, CA, United States of America

Hao Xu