Microsoft Technology Licensing, LLC

Xun Wang

Adrian Emil Stepan

Timothy David Ebringer

Tomasz Lukasz Religa

Zhang Li

Max Wang

Huitian Jiao

Hong Jia

Jesse Alexander Freitas

Si-Qing Chen

Warren Anthony Aldred

Tao Ge

A data processing system obtains source textual content associated with a first writing style and target textual content associated with a second writing style and provides the source textual content as an input to a first machine learning model which analyzes the source content to determine the first writing style of the first textual content. The system provides an indication of the first writing style and the target textual content as an input to a second machine learning model which analyzes the target textual content and rewrites the target textual content according to the first writing style to output updated target textual content rewritten according to the first writing style. Some implementations utilize a single model trained to receive the source textual content, the target textual content, to determine the writing style of the source textual content and rewrite the target textual content according to the first writing style.

Automatic writing style detection and rewriting

The subject disclosure is directed towards a technology for efficiently emulating program code that is protected by one or more various code virtualization techniques to detect the presence of malware. An emulation engine emulates a program containing a mix of native code, custom (e.g., virtualized obfuscated) code, and at least one emulator and/or interpreter that understands the custom code, by building a custom emulation component that is built by detecting and analyzing the internal emulator or interpreter. The custom emulation component may access a translation table built from the analysis, and also may simplify a plurality of instructions in the program into a lesser number of instructions in an intermediate language used for emulation.

Emulating mixed-code programs using a virtual machine instance

A region of HTML or PDF file bytecode run on a virtual machine is identified as possible malware, allowing a detection signature to be generated. A determination is made, based on code behavior, that malware may be present. Variables visible in this identification start state can be found by mapping the start state to scopes in an abstract syntax data structure. Searching previously executed states of the virtual machine for any assignment of a variable that belongs to the set of variables of interest provides a set of assignments of interest, even in obfuscated code. Nonterminated assignments of interest will lead in turn to other variables of interest and assignments of interest, until all assignments of interest are terminated. At that point, a region of code defined by the assignments of interest is identified as a malware detection signature generation candidate, and submitted to a human or automated analyst.

Identification of malware detection signature candidate code

Growing community of inventors

Sammamish, WA, United States of America

Xun Wang