US 12,443,710 B2
System and method for automated machine-learning, zero-day malware detection
Scott Miserendino, Baltimore, MD (US); Ryan Peters, Fairfax, VA (US); Donald Steiner, McLean, VA (US); Bhargav R. Avasarala, Arlington, VA (US); Brock D. Bose, Alexandria, VA (US); and John C. Day, Palm Bay, FL (US)
Assigned to BluVector, Inc., Philadelphia, PA (US)
Filed by BluVector, Inc., Philadelphia, PA (US)
Filed on Apr. 16, 2021, as Appl. No. 17/301,868.
Application 17/301,868 is a continuation of application No. 15/607,122, filed on May 26, 2017, granted, now 11,126,720.
Application 15/607,122 is a continuation in part of application No. 15/076,073, filed on Mar. 21, 2016, granted, now 9,665,713, issued on May 30, 2017.
Application 15/076,073 is a continuation of application No. 14/038,682, filed on Sep. 26, 2013, granted, now 9,292,688, issued on Mar. 22, 2016.
Claims priority of provisional application 61/705,938, filed on Sep. 26, 2012.
Prior Publication US 2021/0256127 A1, Aug. 19, 2021
This patent is subject to a terminal disclaimer.
Int. Cl. G06F 21/56 (2013.01); G06F 18/21 (2023.01); G06F 18/214 (2023.01); G06N 5/025 (2023.01)
CPC G06F 21/564 (2013.01) [G06F 18/214 (2023.01); G06F 18/217 (2023.01); G06F 21/56 (2013.01); G06F 21/566 (2013.01); G06N 5/025 (2013.01); G06F 2221/034 (2013.01)] 19 Claims
OG exemplary drawing
 
1. A method comprising:
determining, based at least on a file structure associated with each of a plurality of training files known to be malign or benign, a subset of the plurality of training files that are associated with a first file-type of a plurality of file-types;
training, based on the subset of the plurality of training files, a first classifier to determine whether files of the first file-type are at least malign or benign;
training, based on the plurality of training files, a second classifier to determine whether files of the plurality of file-types are at least malign or benign;
selecting, based on determining that a first file is associated with the first file-type, the first classifier to determine whether the first file is malign or benign;
causing, based on the determining whether the first file is malign or benign, access to the first file to be blocked or permitted;
selecting, based on a failure to determine if a second file is associated with the first file-type, the second classifier to determine whether the second file is malign or benign; and
causing, based on the determining whether the second file is malign or benign, access to the second file to be blocked or permitted.