Granted Patent B2

US 12,147,534 · App. 17/223,249 · Granted Nov 19, 2024

Inventors: Assaf Ben-David (Tel Aviv, IL); Yonatan Perry (Neve Yarak, IL)

G06F21/554G06F16/9024G06N3/04

Abstract

Claims (80)

1. A method of determining a maliciousness level of an element using a hypergraph of neighbors comprising:

scanning a computing device to identify an element with a maliciousness level that is at least partly undetermined;

generating, for the identified element, a hypergraph of neighbor target elements found in a data source, the hypergraph comprising a set of nodes and a set of edges, wherein the set of nodes represents the neighbor target elements, and the set of edges represents connections between the neighbor target elements;

providing the hypergraph as an input to a classifier;

classifying, using the classifier, nodes and edges in the hypergraph;

generating a maliciousness level profile for the element based on aggregation of nodes and edges in the hypergraph; and

performing an action based on the maliciousness level profile.

2. The method of claim 1 , wherein the data source comprises an endpoint.

3. The method of claim 1 , wherein the hypergraph comprises a single source node for each of the set of edges.

4. The method of claim 1 , wherein the hypergraph comprises at least one node with one or more edges.

5. The method of claim 1 , wherein the hypergraph is a hybrid hypergraph comprising combined data collected from the data source and data from one or more external databases.

6. The method of claim 1 , wherein sets of neighborhoods of target nodes are generated iteratively based on nodes satisfying particular features.

7. The method of claim 1 , wherein generating the hypergraph comprises acquiring the neighbor target elements using a crawling procedure.

8. The method of claim 1 , wherein an element is classified based on its connections to neighbors without a classification of at least one of the neighbors.

9. The method of claim 1 , wherein the classifier comprises a graph neural network.

10. The method of claim 1 , wherein the action comprises at least one of:

if the element comprises a file:

isolating a machine that received the file;

killing at least one process started by the file;

removing persistence of the file on at least one of a network or affected computer;

cleaning at least one infected sample;

modifying a risk assessment for at least of the network or affected computer;

generating a report;

collecting additional artifacts;

triggering a search for related elements;

blocking a user from taking actions; or

sending information to at least one other security system; or

blocking an IP address or a web domain from network access;

restricting at least one user authorization;

blocking access to an external device;

shutting down at least one computer;

erasing at least one memory device; or

filtering at least one electronic mail message.

11. A method of classifying an element comprising:

generating a hypergraph of nodes, edges, and neighboring elements by crawling;

iteratively generating sets of neighborhoods of the element from the hypergraph;

determining a maliciousness level for the element by analyzing the sets of neighborhoods with a trained neural network, wherein each layer of the neural network includes processing steps:

aggregating information from immediate neighbors of each node and using the information to calculate additional features for said node;

feeding a plurality of features into a neural layer, one for each node kind; and

generating a maliciousness level profile for the element;

linking information relating to the element and the maliciousness level profile for the element; and

performing an action based on a type of the element.

12. The method of claim 11 , wherein the nodes are typed, and nodes of different types comprise different features.

13. The method of claim 11 , wherein the hypergraph comprises a single source node for each edge.

14. The method of claim 11 , wherein each edge is mapped to a set of target nodes.

15. The method of claim 11 , further comprising utilizing an aggregation function, wherein the aggregation function is configured to determine most extreme evidence from features of the neighbors.

16. The method of claim 11 , wherein the additional features are fed into a fully connected neural layer, and then a maximum over all the neighbors is selected.

17. The method of claim 11 , wherein the neural network is trained by:

providing a set of seed nodes;

crawling for a set of the seed nodes' neighborhoods;

building a subgraph from the set of the seed nodes' neighborhoods; and

training the neural network by feeding the subgraph to the neural network.

18. The method of claim 11 , wherein the action comprises at least one of:

if the element comprises a file:

isolating a machine that received the file;

killing at least one process started by the file;

removing persistence of the file on at least one of a network or affected computer;

cleaning at least one infected sample;

modifying a risk assessment for at least of the network or affected computer;

generating a report;

collecting additional artifacts;

triggering a search for related elements;

blocking a user from taking actions; or

sending information to at least one other security system; or

blocking an IP address or a web domain from network access;

restricting at least one user authorization;

blocking access to an external device;

shutting down at least one computer;

erasing at least one memory device; or

filtering at least one electronic mail message.

19. A computing system for determining a maliciousness level of an element comprising one or more processors and one or more non-transitory computer-readable media, the media storing:

a neural network trained to:

receive a hypergraph as an input; and

classify a node of the hypergraph; and

instructions that, when executed by the one or more processors, cause the computing system to perform operations, the operations comprising:

scanning an external computing device to identify elements of an unknown maliciousness level;

generating an element hypergraph associated with the unknown element;

processing the element hypergraph with the neural network to generate a maliciousness classification; and

performing an action based on the maliciousness classification.

20. The computing system of claim 19 , wherein the neural network is a graph convolutional neural network and comprises one or more layers, each layer comprising an aggregation layer and a fully-connected layer, wherein the fully-connected layer processes the element hypergraph and an output from the aggregation layer.

Assignments (8)