IP Library Granted Patent US 11,714,908
Granted Patent B2
US 11,714,908 · App. 17/068,280 · Granted Aug 1, 2023

Bit-level data generation and artificial intelligence techniques and architectures for data protection

Inventor: Garrett Thomas Oetken (Post Falls, ID)
Assignee: Quantum Star Technologies Inc.
G06F21/567G06F16/212G06F21/565G06N3/08H04L63/1425G06F2221/034
View Patent ↗
Loading inventors, assignments & file history…
Monitor This Case
Get email alerts when status or documents change.
Order Certified Copies
Most orders are placed with the USPTO same day — all within 24 business hours.
Order via The Patent Place →
Pre-filled with this patent's details
Quick Facts
Patent No.
US 11,714,908
App. No.
17/068,280
Granted
Aug 1, 2023
Kind
B2
Abstract

Techniques and architectures for representing data with one or more n-dimensional representations and/or using one or more models to identify malware are described herein. For example, the techniques and architectures may determine one or more coordinates for one or more points based on one or more sets of bits in the data and generate an n-dimensional representation for the data based on the one or more points. The techniques and architectures may evaluate the n-dimensional representation with one or more machine-trained models to detect malware.

Claims (57)

1. A system comprising:

control circuitry; and

memory communicatively coupled to the control circuitry and storing executable instructions that, when executed by the control circuitry, cause the control circuitry to perform operations comprising:

obtaining data;

determining a first coordinate for a first point based at least in part on a first set of bits in the data and determining a second coordinate for the first point based at least in part on a second set of bits in the data that is adjacent to the first set of bits;

determining a first coordinate for a second point based at least in part on a third set of bits in the data and determining a second coordinate for the second point based at least in part on a fourth set of bits in the data that is adjacent to the third set of bits;

generating an n-dimensional representation for the data based at least in part on the first point and the second point;

processing the n-dimensional representation using a machine-trained model;

based at least in part on the processing, determining that the data is associated with a malware threat; and

performing a threat operation to address the malware threat.

2. The system of claim 1 , wherein the first set of bits comprises a first byte and the second set of bits comprises a second byte that is directly adjacent to the first byte.

3. The system of claim 1 , wherein obtaining the data comprises retrieving data from a data store, the data comprising file system data.

4. The system of claim 1 , wherein the operations further comprise:

extracting a first portion of the data and refraining from extracting a second portion of the data, the first portion of the data including the first set of bits and the second set of bits.

5. The system of claim 1 , wherein the operations further comprise:

determining a type of the data; and

determining to represent the data with a first portion of the data based at least in part on the type of the data, the first portion of the data including the first set of bits and the second set of bits.

6. The system of claim 5 , wherein the first portion of the data includes at least one of a header, a body, or a footer.

7. The system of claim 1 , wherein the operations further comprise:

determining a type of the data; and

determining to represent the data with a first portion of the data and a second portion of the data based at least in part on the type of the data, the first portion of the data including the first set of bits and the second set of bits.

8. The system of claim 1 , wherein the operations further comprise:

training a model to create the machine-trained model, the training being based at least in part on one or more n-dimensional representations that are tagged as being associated with malware and one or more n-dimensional representations that are tagged as being malware free.

9. One or more non-transitory computer-readable media storing computer-executable instructions that, when executed by control circuitry, cause the control circuitry to perform operations comprising:

receiving data;

determining a first coordinate for a first point based at least in part on a first set of bits in the data;

determining a second coordinate for the first point based at least in part on a second set of bits in the data that is adjacent to the first set of bits;

determining a first coordinate fora second point based at least in part on a third set of bits in the data;

determining a second coordinate for the second point based at least in part on a fourth set of bits in the data that is adjacent to the third set of bits;

based at least in part on the first point and the second point, representing the data with an n-dimensional representation;

processing the n-dimensional representation using a machine-trained model;

based at least in part on the processing, determining that the data is associated with a malware threat; and

performing a threat operation to address the malware threat.

10. The one or more non-transitory computer-readable media of claim 9 , wherein the data is metadata.

11. The one or more non-transitory computer-readable media of claim 9 , wherein the data is network traffic data.

12. The one or more non-transitory computer-readable media of claim 9 , wherein the data is non-image-based data.

13. The one or more non-transitory computer-readable media of claim 9 , wherein the control circuitry is first control circuitry, and the operations further comprise sending additional data regarding the n-dimensional representation to second control circuitry to cause the second control circuitry to process the n-dimensional representation.

14. The one or more non-transitory computer-readable media of claim 9 , wherein the one or more non-transitory computer-readable media are implemented on a first component of a service provider, and the operations further comprise sending additional data regarding the n-dimensional representation to a second component of the service provider to cause the second component to process the n-dimensional representation.

15. A method comprising:

receiving, by one or more processors, data;

determining, by the one or more processors, a first coordinate for a first point based at least in part on a first set of bits in the data;

determining, by the one or more processors, a second coordinate for the first point based at least in part on a second set of bits in the data that is adjacent to the first set of bits;

determining, by the one or more processors, a first coordinate for a second point based at least in part on a third set of bits in the data;

determining, by the one or more processors, a second coordinate for the second point based at least in part on a fourth set of bits in the data that is adjacent to the third set of bits;

generating, by the one or more processors, an n-dimensional representation for the data based at least in part on the first point and the second point;

processing the n-dimensional representation with a machine-trained model that is configured to detect malware;

based at least in part on the processing, determining that the data is associated with a malware threat; and

performing a threat operation to address the malware threat.

16. The method of claim 15 , wherein the n-dimensional representation includes at least three dimensions.

17. The method of claim 15 , further comprising:

based at least in part on the processing, determining a malware rating indicating a likelihood that the data is associated with the malware threat;

wherein the determining that the data is associated with the malware threat is based at least in part on the malware rating.

18. The method of claim 15 , wherein the first set of bits is part of a first byte and the second set of bits is part of a second byte that is directly adjacent to the first byte, the method further comprising:

determining, by the one or more processors, a third coordinate for the first point based at least in part on a fifth set of bits in the data, the fifth set of bits being part of the first byte.

19. The method of claim 15 , further comprising:

training a model to create the machine-trained model, the training being based at least in part on one or more n-dimensional representations that are tagged as being associated with malware and one or more n-dimensional representations that are tagged as being malware free.

20. The one or more non-transitory computer-readable media of claim 9 , wherein the first set of bits comprises a first byte and the second set of bits comprises a second byte that is directly adjacent to the first byte.

Assignments (2)
ASSIGNMENT OF ASSIGNOR'S INTEREST Recorded Feb 24, 2021
From: OETKEN, GARRETT THOMAS
To: QUANTUM STAR TECHNOLOGIES LLC
Reel/Frame 055397/0314 →
CHANGE OF NAME Recorded Feb 24, 2021
From: QUANTUM STAR TECHNOLOGIES LLC
To: QUANTUM STAR TECHNOLOGIES INC.
Reel/Frame 055403/0308 →
Continuity (3)
Division 16569978 · Sep 13, 2019
Provisional Application 62731825 · Sep 15, 2018
Related Publication 20210042413A1 · Feb 11, 2021
Cited By (2)
US 12,367,282 US 12,443,714