Endgame, Inc.

Endgame Systems, Inc.

William Finlayson

Hyrum S Anderson

Hyrum Anderson

A system and a method for analyzing files using visual cues in the presentation of the file is provided. These visual aids may be extracted using a convolutional neural network, classified, and used in conjunction with file metadata to determine if a provided document is likely to be malicious. This methodology may be extended to detect a variety of social engineering-related attacks including phishing sites or malicious emails. A method for analyzing a received file to determine if the received file comprises malicious code begins with generating an image that would be displayed if the received file is opened by the native software program. Then the image is analyzed, and output is generated. Metadata is also extracted from the received file. Then, a maliciousness score is generated based on the output, the metadata, and a reference dataset.

System and method for detecting a malicious file

A system and a method for analyzing files using visual cues in the presentation of the file is provided. These visual aids may be extracted using a convolutional neural network, classified, and used in conjunction with file metadata to determine if a provided document is likely to be malicious. This methodology may be extended to detect a variety of social engineering-related attacks including phishing sites or malicious emails. A method for analyzing a received file to determine if the received file comprises malicious code begins with generating an image that would be displayed if the received file is opened by the native software program. Then the image is analyzed, and object boundaries data is generated. Metadata is also extracted from the received file. Then, a maliciousness score is generated based on the object boundaries data, the metadata, and a reference dataset.

Growing community of inventors

Philadelphia, PA, United States of America

William Finlayson