US 12,411,995 B2
Apparatus and method for identifying abnormal processor and computer-readable storage medium
Hwaseong Lee, Daejeon (KR); Jeongchan Park, Daejeon (KR); Changon Yoo, Daejeon (KR); Jingoog Kim, Daejeon (KR); Yeojeong Yoon, Daejeon (KR); Ilhoon Jung, Daejeon (KR); and Sung Jin Park, Daejeon (KR)
Assigned to AGENCY FOR DEFENSE DEVELOPMENT, Daejeon (KR)
Filed by AGENCY FOR DEFENSE DEVELOPMENT, Daejeon (KR)
Filed on Nov. 24, 2021, as Appl. No. 17/456,529.
Claims priority of application No. 10-2021-0108113 (KR), filed on Aug. 17, 2021.
Prior Publication US 2023/0057138 A1, Feb. 23, 2023
Int. Cl. G06F 21/71 (2013.01); G06N 20/20 (2019.01)
CPC G06F 21/71 (2013.01) [G06N 20/20 (2019.01)] 6 Claims
OG exemplary drawing
 
1. An apparatus for identifying an abnormal processor, the apparatus comprising:
a memory information collection processor configured to collect memory region information and dynamic library information of a memory;
a first identification processor configured to identify a processor as an abnormal processor by using a first machine learning model pre-trained based on the memory region information of both a normal processor and an abnormal processor;
a second identification processor configured to identify the processor as an abnormal processor by using a second machine learning model pre-trained based on the dynamic library information of both a normal processor and an abnormal processor; and
a determination processor configured to determine a final abnormal processor based on either the abnormal processor identified using the first machine learning model or the abnormal processor identified using the second machine learning model by assigning a weighted value to either the abnormal processor identified by the first identification processor or the abnormal processor identified by the second identification processor,
wherein the memory region information includes at least one of i) information obtained by transforming an authority of a memory region into term frequency-inverse document frequency (TF-IDF) or ii) a level of similarity to a binary in a processor memory region,
wherein the dynamic library information includes information on whether a dynamic library contains an electronic signature or not and information on a history of previous uses of dynamic libraries, and
wherein the determination processor is configured to determine the final abnormal processor by using abnormal processor information identified by the first identification processor and abnormal processor information identified by the second identification processor as input into a weighted third pre-trained machine learning model different from the first machine learning model and the second machine learning model.