The patent badge is an abbreviated version of the USPTO patent document. The patent badge does contain a link to the full patent document.

The patent badge is an abbreviated version of the USPTO patent document. The patent badge covers the following: Patent number, Date patent was issued, Date patent was filed, Title of the patent, Applicant, Inventor, Assignee, Attorney firm, Primary examiner, Assistant examiner, CPCs, and Abstract. The patent badge does contain a link to the full patent document (in Adobe Acrobat format, aka pdf). To download or print any patent click here.

Date of Patent:
Feb. 09, 2021

Filed:

Mar. 15, 2018
Applicant:

Intel Corporation, Santa Clara, CA (US);

Inventors:

Li Chen, Hillsboro, OR (US);

Salmin Sultana, Hillsboro, OR (US);

Assignee:

Intel Corporation, Santa Clara, CA (US);

Attorney:
Primary Examiner:
Int. Cl.
CPC ...
G06F 21/56 (2013.01); G06N 3/08 (2006.01); G06K 9/62 (2006.01); G06F 21/54 (2013.01); G06F 21/55 (2013.01); G06K 9/32 (2006.01); G06K 9/46 (2006.01); G06N 3/04 (2006.01); G06N 20/10 (2019.01);
U.S. Cl.
CPC ...
G06F 21/566 (2013.01); G06F 21/54 (2013.01); G06F 21/552 (2013.01); G06K 9/325 (2013.01); G06K 9/4628 (2013.01); G06K 9/6256 (2013.01); G06K 9/6262 (2013.01); G06N 3/0454 (2013.01); G06N 3/08 (2013.01); G06F 2221/034 (2013.01); G06N 3/0445 (2013.01); G06N 3/0472 (2013.01); G06N 20/10 (2019.01);
Abstract

Technologies disclosed herein provide for converting a first data of a first control flow packet to a first pixel, where the first data indicates one or more branches taken during a known execution of an application, generating an array of pixels using the first pixel and one or more other pixels associated with one or more other control flow packets generated from the known execution, transforming the array of pixels into a series of images, and using a machine learning algorithm with inputs to train a behavior model to identify a malicious behavior in an unknown execution of the application. The inputs include one or more images of the series of images and respective image labels assigned to the one or more images. More specific embodiments include extracting the first control flow packet from an execution trace representing at least part of the known execution.


Find Patent Forward Citations

Loading…