Granted Patent B2

US 12,724,895 · App. 19/370,931 · Granted Sep 1, 2026

Inventors: Henrik Plate (Valbonne, FR); Dimitrios Styliadis (San Jose, CA)

Assignee: Endor Labs Inc

G06F21/566G06F40/20

Abstract

Claims (118)

1 . A method comprising:

injecting, by one or more processors, malicious code into a legitimate software package to create an injected package;

extracting, by an artificial intelligence executed by the one or more processors, a plurality of parts of the injected package;

mutating, by the artificial intelligence executed by the one or more processors, individual parts of the plurality of parts to create multiple mutated parts;

assembling, by the one or more processors, at least a portion of the multiple mutated parts to create a mutated malware;

performing a malware test on the mutated malware to determine if it shows the similar behavior as the malware code;

repeating the mutating step when the mutated malware fails the malware test;

determining, by a malware scanner, a risk score associated with the mutated malware;

based at least in part on determining, by the one or more processors, that the risk score satisfies a predetermined threshold, storing the mutated malware in a set of mutated malware;

after determining, by the one or more processors, that a number of mutated malware in the set of mutated malware satisfies a requested number, adding the set of mutated malware to a set of training data;

training, using the set of training data, a particular malware scanner from a set of malware scanners that includes an artificial intelligence component; and

deploying the particular malware scanner to detect malware.

2 . The method of claim 1 , wherein mutating individual parts of the plurality of parts to create the multiple mutated parts comprises:

changing one or more variable identifiers;

changing one or more function identifiers based on a context vocabulary;

changing an application programming interface (API) from a first API to a second API;

insertion of one or more comments;

spreading one or more blocks of code across a plurality of functions;

inserting dead code that is never executed;

inserting of dummy functionality;

obfuscation of string literals using character encodings, encryption, string sampling, or minification;

modifying how a target component is accessed including replacing calls made to a component with calls made to a different component; or

any combination thereof.

3 . The method of claim 1 , further comprising:

retrieving the malicious code from a set of code-test pairs, each code-test pair of the set of code-test pairs including a particular malware code and one or more malware tests, wherein the one or more malware tests are used to detect a behavior of the particular malware code to determine whether the mutated malware performs a malicious action of the particular malware code.

4 . The method of claim 1 , wherein:

the artificial intelligence is trained using one or more programming languages to enable the artificial intelligence to extract and mutate both malicious code and source code.

5 . The method of claim 1 , wherein extracting, by the artificial intelligence, the plurality of parts of the injected package comprises:

extracting context information, a natural language description of the injected package, features of the injected package, one or more use-cases of the injected package, an internal architecture of the injected package, one or more source code files, or any combination thereof.

6 . The method of claim 1 , wherein based at least in part on determining, by the one or more processors, that the risk score fails to satisfy the predetermined threshold, the method further comprises:

creating a new injected package by injecting newly selected malicious code into a newly selected legitimate software package.

7 . The method of claim 1 , further comprising:

training an artificial intelligence of the particular malware scanner using the set of mutated malware as training data to improve a malware detection capability of the particular malware scanner.

8 . A server comprising:

one or more processors; and one or more non-transitory computer readable media storing instructions executable by the one or more processors to perform operations comprising:

injecting malicious code into a legitimate software package to create an injected package;

extracting, by an artificial intelligence, a plurality of parts of the injected package;

mutating, by the artificial intelligence, individual parts of the plurality of parts to create multiple mutated parts;

assembling at least a portion of the multiple mutated parts to create a mutated malware;

performing a malware test on the mutated malware to determine if it shows the similar behavior as the malware code;

repeating the mutating step when the mutated malware fails the malware test;

determining, by a malware scanner, a risk score associated with the mutated malware;

based at least in part on determining that the risk score satisfies a predetermined threshold, storing the mutated malware in a set of mutated malware;

after determining, by the one or more processors, that a number of mutated malware in the set of mutated malware satisfies a requested number, adding the set of mutated malware to a set of training data;

training, using the set of training data, a particular malware scanner that includes an artificial intelligence component; and

deploying the particular malware scanner to detect malware.

9 . The server of claim 8 , wherein the plurality of parts of the injected package comprise:

a natural language description of the legitimate software package;

one or more features of the legitimate software package;

one or more use-cases of the legitimate software package;

an internal architecture of the legitimate software package;

one or more source code files of the legitimate software package; or any combination thereof.

10 . The server of claim 8 , wherein mutating individual parts of the plurality of parts to create the multiple mutated parts comprises:

changing one or more variable identifiers;

changing one or more function identifiers based on a context vocabulary;

changing an application programming interface (API) from a first API to a second API;

insertion of one or more comments;

spreading one or more blocks of code across a plurality of functions;

inserting dead code that is never executed;

inserting of dummy functionality;

obfuscation of string literals using character encodings, encryption, string sampling, or minification;

modifying how a target component is accessed including replacing calls made to a component with calls made to a different component; or

any combination thereof.

11 . The server of claim 8 , further comprising:

retrieving the malicious code from a set of code-test pairs, each code-test pair of the set of code-test pairs including a particular malware code and one or more malware tests, wherein the one or more malware tests are used to detect a behavior of the particular malware code to determine whether the mutated malware performs a malicious action of the particular malware code.

12 . The server of claim 8 , wherein:

the artificial intelligence comprises a transformer that tracks connections between code across sub-functions, functions, blocks of code, and larger software components; and

the operations further comprise:

training the artificial intelligence without labeling at least a portion of the training data prior to training the artificial intelligence.

13 . The server of claim 8 , wherein mutating, by the artificial intelligence, the individual parts of the plurality of parts to create multiple mutated parts comprises:

modifying source code by modifying variable identifiers;

modifying function identifiers based on a context vocabulary;

inserting comments based on the context vocabulary;

spreading one or more statements across new or existing functions;

inserting dead code;

inserting dummy functionality;

obfuscating string literals using character encodings, encryption, string sampling, or minification;

adjusting a code style used to access a target component;

replacing an application programming interface (API) call to a call made in a target component; or

any combination thereof.

14 . The server of claim 8 , wherein:

the artificial intelligence comprises a transformer-based deep neural network that accepts natural language prompts as input.

15 . One or more non-transitory computer readable media capable of storing instructions executable by one or more processors to perform operations comprising:

injecting malicious code into a legitimate software package to create an injected package;

extracting, by an artificial intelligence, a plurality of parts of the injected package;

mutating, by the artificial intelligence, individual parts of the plurality of parts to create multiple mutated parts;

assembling at least a portion of the multiple mutated parts to create a mutated malware;

performing a malware test on the mutated malware to determine if it shows the similar behavior as the malware code;

repeating the mutating step when the mutated malware fails the malware test;

determining, by a malware scanner, a risk score associated with the mutated malware;

based at least in part on determining that the risk score satisfies a predetermined threshold, storing the mutated malware in a set of mutated malware;

after determining, by the one or more processors, that a number of mutated malware in the set of mutated malware satisfies a requested number, adding the set of mutated malware to a set of training data;

training, using the set of training data, a particular malware scanner that includes an artificial intelligence component; and

deploying the particular malware scanner to detect malware.

16 . The one or more non-transitory computer readable media of claim 15 , wherein mutating individual parts of the plurality of parts to create the multiple mutated parts comprises:

changing one or more variable identifiers;

changing one or more function identifiers based on a context vocabulary;

changing an application programming interface (API) from a first API to a second API;

insertion of one or more comments;

spreading one or more blocks of code across a plurality of functions;

inserting dead code that is never executed;

inserting of dummy functionality;

obfuscation of string literals using character encodings, encryption, string sampling, or minification;

modifying how a target component is accessed including replacing calls made to a component with calls made to a different component; or

any combination thereof.

17 . The one or more non-transitory computer readable media of claim 15 , the operations further comprising:

downloading the malicious code from a malware repository; and

downloading the legitimate software package from a package registry.

18 . The one or more non-transitory computer readable media of claim 15 , wherein based at least in part on determining that the risk score fails to satisfy the predetermined threshold, the operations further comprise:

creating a new injected package by injecting newly selected malicious code into a newly selected legitimate software package.

19 . The one or more non-transitory computer readable media of claim 15 , wherein:

the injected package performs at least one legitimate function of the legitimate software package while, under certain circumstances, the malicious code surreptitiously performs one or more unwanted actions.

20 . The one or more non-transitory computer readable media of claim 15 , the operations further comprising:

performing a functional test of the mutated malware;

determining, based on a result of the functional test, that the mutated malware is not semantically equivalent to the malicious code;

extracting, by the artificial intelligence, a second plurality of parts of the mutated malware;

mutating, by the artificial intelligence, the second plurality of parts to create second mutated parts; and

assembling the second mutated parts to create a second mutated malware.

Assignments (1)

Continuity (4)

References Cited (52)