Crowdstrike, Inc.

Marian Radu

Daniel Radu

Radu Cazan

Joel Robert Spurlock

Horea Coroiu

Mihaela-Petruta Gaman

Stefan-Bogdan Cocea

Cristian Viorel Popa

Felix Schwyzer

Calin-Bogdan Miron

Diana Bolocan

Sandra Servia Rodriguez

Florian Stortz

Mihaela Petruta Garan

Mihaela Gaman

A command line anomaly detection system can generate anomaly scores associated with command line entries, such that command line entries associated with the highest anomaly scores can be identified. The command line anomaly detection system can include a transformer model trained, via unsupervised machine learning, to determine meanings of components of individual command line entries. The command line anomaly detection system can also include an anomaly detection model trained, via unsupervised machine learning, to determine anomaly scores based on the meanings of components of individual command line entries determined by the transformer model.

Anomalous command line entry detection

A feature vector is created that comprises a plurality of values, each representing a corresponding portion of a filename extension for a digital file. During an inference workflow of a neural network model, an embedding vector is created that represents, in a meaningful way, the feature vector for the filename extension. A class label prediction value is then computed, based on an evaluation of the embedding vector, a first plurality of embedding vectors representing a plurality of feature vectors for a plurality of benign filename extensions, and a second plurality of embedding vectors representing a plurality of feature vectors for a plurality of malicious filename extensions. A prediction as to whether the digital file has been renamed by a malicious computer program is made, based on the class label prediction value.

Method and apparatus for malicious file extension detection

Malware is detected using an embedding-based machine learning model. The model generates embeddings using byte n-grams. A feature importance operation reveals that only a subset of the embeddings is required to detect malware. In some cases, even a single embedding is adequate and retains 99% detection capabilities. An aggressive embedding dropout operation is implemented that ignores lesser-important embeddings. Because perhaps only one, or a few, embeddings need be determined, malware detection is greatly simplified. Malware detection is greatly simplified and need not calculate full-sized embeddings. A malware detection service runs quicker, and just as capably, while consuming less resources.

Aggressive embedding dropout in embedding-based malware detection

A method for detecting a private set intersection includes receiving a first plurality of transformed data elements from a first computing device, the first plurality of transformed data elements representing a transform by a pseudorandom function of a first plurality of data elements; receiving a second plurality of transformed data elements from a second computing device, the second plurality of transformed data elements representing a transform by the pseudorandom function of a second plurality of data elements; and transmitting, by a processing device to the first computing device and the second computing device, an indication of a subset of transformed data elements that are present in both the first plurality of transformed data elements and the second plurality of transformed data elements.

Techniques for delegated inter-party private set intersection

Methods and systems for injected byte buffer data classification are disclosed. According to an implementation, a security agent can detect process injection events, gather byte buffer data associated with the process injection events, and send the byte buffer data to a security service comprising a byte buffer classification function. The byte buffer classification function can be implemented as a trained transformer type neural network machine learning model, which can analyze the byte buffer data and generate a classification output comprising a probability that the byte buffer data is associated with a malicious process injection.

Injected byte buffer data classification

Training and use of a byte n-gram embedding model is described herein. A neural network is trained to determine a probability of occurrence associated with a byte n-gram. The neural network includes one or more embedding model layers, at least one of which is configured to output an embedding array of values. The byte n-gram embedding model may be used to generate a hash of received data, to classify the received data with no knowledge of a data structure associated with the received data, to compare the received data to files having a known classification, and/or to generate a signature for the received data.

Byte n-gram embedding model

Techniques for searching an inverted index associating byte sequences of a fixed length and files that contain those byte sequences are described herein. Byte sequences comprising a search query are determined and searched in the inverted index. In some examples, training data for training machine learning model(s) may be created using pre-featured data from the inverted index. In various examples, training data may be used to retrain a ML model until the ML model meets a criterion. In some examples, the trained ML model may be used to perform searches on the inverted index and classify files.

Growing community of inventors

Bucharest, Romania

Marian Radu