Trend Micro Inc.

Peter Andriukaitis

Leslie Zsohar

Josiah Dede Hagen

Jonathan Edward Andersson

Craig Botkin

Brandon Niemczyk

Shoufu Luo

In one embodiment, local begin and end tags are detected by a network security device to determine a local context of a network traffic flow, and a local feature vector is obtained for that local context. At least one triggering machine learning model is applied by the network security device to the local feature vector, and the result determines whether or not deeper analysis is warranted. In most cases, very substantial resources are not required because deeper analysis is not indicated. If deeper analysis is indicated, one or more deeper machine learning model may then be applied to global and local feature vectors, and regular expressions may be applied to packet data, which may include the triggering data packet and one or more subsequent data packets. Other embodiments, aspects and features are also disclosed.

Growing community of inventors

Austin, TX, United States of America

Peter Andriukaitis