US 12,271,474 B2
Augmented security recognition tasks
Richard Edward Harang, Alexandria, VA (US); Ethan McAvoy Rudd, Fort Collins, CO (US); Konstantin Berlin, Potomac, MD (US); Cody Marie Wild, Berkeley, CA (US); and Felipe Nicolás Ducau, Neuquen (AR)
Assigned to Sophos Limited, Abingdon (GB)
Filed by Sophos Limited, Abingdon (GB)
Filed on May 25, 2023, as Appl. No. 18/323,607.
Application 18/323,607 is a continuation of application No. 17/401,959, filed on Aug. 13, 2021, granted, now 11,681,800.
Application 17/401,959 is a continuation of application No. PCT/GB2020/050370, filed on Feb. 17, 2020.
Claims priority of provisional application 62/806,423, filed on Feb. 15, 2019.
Prior Publication US 2024/0126876 A1, Apr. 18, 2024
This patent is subject to a terminal disclaimer.
Int. Cl. H04L 9/40 (2022.01); G06F 21/55 (2013.01); G06F 21/56 (2013.01); G06N 3/045 (2023.01); G06N 3/08 (2023.01); G06N 20/00 (2019.01)
CPC G06F 21/56 (2013.01) [G06F 21/552 (2013.01); G06F 21/562 (2013.01); G06F 21/566 (2013.01); G06N 3/045 (2023.01); G06N 3/08 (2013.01); G06N 20/00 (2019.01)] 20 Claims
OG exemplary drawing
 
1. A system for conducting a security recognition task, the system comprising:
a memory configured to store a model and training data, each sample of the training data including a security recognition task label for training the model to perform the security recognition task, the security recognition task label indicative of whether or not each said sample is a security threat, wherein each said sample includes auxiliary information and wherein each said sample is associated with a portable executable file; and
one or more processors communicably linked to the memory and comprising a training unit and a prediction unit,
wherein the training unit is configured to:
receive the training data and the model from the memory and subsequently provide the training data to the model,
receive the auxiliary information, the auxiliary information including detection data for each sample of the training data from one or more trusted authorities, and
train the model, as a multi-target neural network, using the training data to predict the detection data in the auxiliary information as well as the security recognition task label for the security recognition task, thereby improving performance of the security recognition task, and
wherein the prediction unit is configured to:
use an output of the model to perform the security recognition task on a new sample by predicting the security recognition task label for the new sample.