The patent badge is an abbreviated version of the USPTO patent document. The patent badge does contain a link to the full patent document.

The patent badge is an abbreviated version of the USPTO patent document. The patent badge covers the following: Patent number, Date patent was issued, Date patent was filed, Title of the patent, Applicant, Inventor, Assignee, Attorney firm, Primary examiner, Assistant examiner, CPCs, and Abstract. The patent badge does contain a link to the full patent document (in Adobe Acrobat format, aka pdf). To download or print any patent click here.

Date of Patent:
Sep. 07, 2021

Filed:

May. 16, 2019
Applicant:

Cisco Technology, Inc., San Jose, CA (US);

Inventors:

Tomas Pevny, Prague, CZ;

Jan Franco̊, Turnov, CZ;

Petr Somol, Marianske Lazne, CZ;

Assignee:

Cisco Technology, Inc., San Jose, CA (US);

Attorneys:
Primary Examiner:
Int. Cl.
CPC ...
G06F 21/00 (2013.01); G06F 21/56 (2013.01); G06N 3/08 (2006.01);
U.S. Cl.
CPC ...
G06F 21/562 (2013.01); G06F 21/567 (2013.01); G06F 21/568 (2013.01); G06N 3/08 (2013.01); G06F 2221/033 (2013.01);
Abstract

In one embodiment, a device disassembles an executable file into assembly instructions. The device maps each of the assembly instructions to a fixed length instruction vector using one-hot encoding and an instruction vocabulary and forms vector representations of blocks of a control flow graph for corresponding functions of the executable file by embedding and aggregating bags of the instruction vectors. The device generates, based on the vector representations of the blocks of the control flow graph, a call graph model of the functions in the executable file. The device forms a vector representation of the executable file based in part on the call graph model. The device determines, based on the vector representation of the executable file, whether the executable file is malware.


Find Patent Forward Citations

Loading…