Granted Patent B2

US 12,437,068 · App. 17/724,419 · Granted Oct 7, 2025

Inventors: Mauritius Schmidtler (Escondido, CA); Gaurav Dalal (San Jose, CA); Reza Yoosoofmiya (San Diego, CA)

Assignee: OPEN TEXT INC.

G06F21/565G06F21/562G06N20/00G06N20/10G06F8/53G06F2221/033

Abstract

Claims (48)

1. A computer-implemented method comprising:

identifying, by a knowledge module, static data points that may be indicative of either a harmful or benign executable file;

associating, by the knowledge module, the identified static data points with one of a plurality of categories of files, the plurality of categories of files including harmful files and benign files; identifying an executable file to be evaluated;

extracting, by the knowledge module, a plurality of static data points from the identified executable file;

generating a feature vector from the plurality of static data points using a classifier trained to classify the static data points based on training data, the training data comprising files known to fit into one of the plurality of categories of files, wherein one or more features of the feature vector generated using the classifier are selectively turned on or off, wherein the one or more features are selectively turned on or off based one or more values of the static data points being within a predetermined range; and

providing the generated feature vector to a support vector machine to build a probabilistic model that indicates whether the executable file fits into one of the categories of files, the generated feature vector comprising at least one feature that has been selectively turned off.

2. The computer-implemented method according to claim 1 , wherein the support vector machine builds the probabilistic model by performing data analysis and pattern recognition on the feature vector.

3. The computer-implemented method according to claim 1 , wherein the probabilistic model indicates whether the executable file is harmful.

4. The computer-implemented method according to claim 1 , wherein the executable file is identified in response to a detected condition.

5. The computer-implemented method according to claim 4 , wherein the condition is user request for a file download.

6. The computer-implemented method according to claim 4 , wherein the condition is the detection of a new file attempting to execute.

7. The computer-implemented method according to claim 1 , wherein the plurality of static data points represent predefined character strings in the executable file.

8. The computer-implemented method according to claim 1 , wherein a determination of whether the executable file is harmful is used to retrain the classifier.

9. The computer-implemented method according to claim 1 , wherein the plurality of categories of files includes at least one additional category of files.

10. The computer-implemented method according to claim 1 , wherein:

identifying the executable file to be evaluated comprises identifying an encrypted executable file to be evaluated,

extracting, by the knowledge module, the plurality of static data points from the identified executable file comprises extracting, by the knowledge module, a plurality of static data points from the identified encrypted executable file without decrypting and without unpacking the encrypted executable file, and

providing the generated feature vector to the support vector machine to build the probabilistic model that indicates whether the executable file fits into one of the categories of files comprises providing the generated feature vector to the support vector machine to build the probabilistic model that indicates whether the encrypted executable file fits into one of the categories of files.

11. A system comprising:

at least one memory; and

at least one processor operatively connected with the memory and configured to perform operation of:

identifying static data points that may be indicative of either a harmful or benign executable file;

associating the identified static data points with one of a plurality of categories of files, the plurality of categories of files including harmful files and benign files;

identifying an executable file to be evaluated;

extracting a plurality of static data points from the identified executable file;

generating a feature vector from the plurality of static data points using a classifier trained to classify the static data points based on training data, the training data comprising files known to fit into one of the plurality of categories of files, wherein one or more features of the feature vector generated using the classifier are selectively turned on or off, wherein the one or more features are selectively turned on or off based one or more values of the static data points being within a predetermined range; and

providing the generated feature vector to a support vector machine to build a probabilistic model that indicates whether the executable file fits into one of the categories of files, the generated feature vector comprising at least one feature that has been selectively turned off.

12. The system according to claim 11 , wherein the support vector machine builds the probabilistic model by performing data analysis and pattern recognition on the feature vector.

13. The system according to claim 11 , wherein the probabilistic model indicates whether the executable file is harmful.

14. The system according to claim 11 , wherein the plurality of static data points represent predefined character strings in the executable file.

15. The system of claim 11 , wherein the plurality of categories of files includes at least one additional category of files.

16. The system of claim 11 , wherein:

identifying the executable file to be evaluated comprises identifying an encrypted executable file to be evaluated,

extracting the plurality of static data points from the identified executable file comprises extracting the plurality of static data points from the identified encrypted executable file without decrypting and without unpacking the encrypted executable file, and

providing the generated feature vector to the support vector machine to build the probabilistic model that indicates whether the executable file fits into one of the categories of files comprises providing the generated feature vector to the support vector machine to build the probabilistic model that indicates whether the encrypted executable file fits into one of the categories of files.

17. A computer-readable storage device containing instructions, that when executed on at least one processor, causing the processor to execute a process comprising:

identifying static data points that may be indicative of either a harmful or benign executable file;

associating the identified static data points with one of a plurality of categories of files, the plurality of categories of files including harmful files and benign files;

identifying an executable file to be evaluated;

extracting a plurality of static data points from the identified executable file;

generating a feature vector from the plurality of static data points using a classifier trained to classify the static data points based on training data, the training data comprising files known to fit into one of the plurality of categories of files, wherein one or more features of the feature vector generated using the classifier are selectively turned on or off, wherein the one or more features are selectively turned on or off based one or more values of the static data points being within a predetermined range; and

providing the generated feature vector to a support vector machine to build a probabilistic model that indicates whether the executable file fits into one of the categories of files, the generated feature vector comprising at least one feature that has been selectively turned off.

18. The computer-readable storage device according to claim 17 , wherein the plurality of static data points represent predefined character strings in the executable file.

19. The computer-readable storage device of claim 17 , wherein the plurality of categories of files includes at least one additional category of files.

20. The computer-readable storage device of claim 17 , wherein:

identifying the executable file to be evaluated comprises identifying an encrypted executable file to be evaluated,

extracting the plurality of static data points from the identified executable file comprises extracting the plurality of static data points from the identified encrypted executable file without decrypting and without unpacking the encrypted executable file, and

providing the generated feature vector to the support vector machine to build the probabilistic model that indicates whether the executable file fits into one of the categories of files comprises providing the generated feature vector to the support vector machine to build the probabilistic model that indicates whether the encrypted executable file fits into one of the categories of files.

Assignments (4)

Continuity (3)

References Cited (400)