CPC G06F 21/565 (2013.01) [G06F 21/562 (2013.01); G06N 3/08 (2013.01); G06F 2221/034 (2013.01)] | 17 Claims |
1. A system comprising:
at least one processor; and
at least one memory including program code which when executed by the at least one memory provides operations comprising:
receiving a disassembled binary file that includes a plurality of instructions;
generating fixed length representations of the plurality of instructions by processing each of the plurality of instructions having lengths other than a first length by either truncating the instructions so that they are the first length or by padding the instructions so that they are the first length;
processing the disassembled binary file with a trained convolutional neural network configured to (i) apply a first plurality of kernels to detect a presence of one or more sequences of instructions amongst the plurality of instructions, the plurality of kernels being adapted to detect different sequences of instructions (ii) apply a second plurality of kernels to the disassembled binary file, the second plurality of kernels being adapted to detect specific sequences of two or more instructions detected by the first plurality of kernels, and (iii) determine a classification for the disassembled binary file based at least in part on the presence of the one or more sequences of instructions; and
providing, as an output, the classification of the disassembled binary file to determine whether to execute, open, or access a binary file corresponding to the disassembled binary file.
|