Patent Grant
12141282
This disclosure relates generally to malware classification and, more particularly, to methods and apparatus to augment classification coverage for low prevalence samples through neighborhood labels proximity vectors.
The introduction of malware into regular software has grown rapidly over the recent years. The ability to classify and categorize malware and benign software is an important function of security programs. When training a machine learning model to be able to distinguish between malicious and clean software, a differentiation between noise and low prevalence samples in the training data is important for ensuring ensure accuracy of sample classification by the machine learning model in deployment.
The figures are not to scale. Instead, the thickness of the layers or regions may be enlarged in the drawings. In general, the same reference numbers will be used throughout the drawing(s) and accompanying written description to refer to the same or like parts.
As used herein, unless otherwise stated, the term “above” describes the relationship of two parts relative to Earth. A first part is above a second part, if the second part has at least one part between Earth and the first part. Likewise, as used herein, a first part is “below” a second part when the first part is closer to the Earth than the second part. As noted above, a first part can be above or below a second part with one or more of: other parts therebetween, without other parts therebetween, with the first and second parts touching, or without the first and second parts being in direct contact with one another.
As used herein, connection references (e.g., attached, coupled, connected, and joined) may include intermediate members between the elements referenced by the connection reference and/or relative movement between those elements unless otherwise indicated. As such, connection references do not necessarily infer that two elements are directly connected and/or in fixed relation to each other. As used herein, stating that any part is in “contact” with another part is defined to mean that there is no intermediate part between the two parts.
Unless specifically stated otherwise, descriptors such as “first,” “second,” “third,” etc., are used herein without imputing or otherwise indicating any meaning of priority, physical order, arrangement in a list, and/or ordering in any way, but are merely used as labels and/or arbitrary names to distinguish elements for ease of understanding the disclosed examples. In some examples, the descriptor “first” may be used to refer to an element in the detailed description, while the same element may be referred to in a claim with a different descriptor such as “second” or “third.” In such instances, it should be understood that such descriptors are used merely for identifying those elements distinctly that might, for example, otherwise share a same name.
As used herein, “approximately” and “about” refer to dimensions that may not be exact due to manufacturing tolerances and/or other real world imperfections. As used herein “substantially real time” refers to occurrence in a near instantaneous manner recognizing there may be real world delays for computing time, transmission, etc. Thus, unless otherwise specified, “substantially real time” refers to real time+/−1 second.
As used herein, the phrase “in communication,” including variations thereof, encompasses direct communication and/or indirect communication through one or more intermediary components, and does not require direct physical (e.g., wired) communication and/or constant communication, but rather additionally includes selective communication at periodic intervals, scheduled intervals, aperiodic intervals, and/or one-time events.
As used herein, “processor circuitry” is defined to include (i) one or more special purpose electrical circuits structured to perform specific operation(s) and including one or more semiconductor-based logic devices (e.g., electrical hardware implemented by one or more transistors), and/or (ii) one or more general purpose semiconductor-based electrical circuits programmed with instructions to perform specific operations and including one or more semiconductor-based logic devices (e.g., electrical hardware implemented by one or more transistors). Examples of processor circuitry include programmed microprocessors, Field Programmable Gate Arrays (FPGAs) that may instantiate instructions, Central Processor Units (CPUs), Graphics Processor Units (GPUs), Digital Signal Processors (DSPs), XPUs, or microcontrollers and integrated circuits such as Application Specific Integrated Circuits (ASICs). For example, an XPU may be implemented by a heterogeneous computing system including multiple types of processor circuitry (e.g., one or more FPGAs, one or more CPUs, one or more GPUs, one or more DSPs, etc., and/or a combination thereof) and application programming interface(s) (API(s)) that may assign computing task(s) to whichever one(s) of the multiple types of the processing circuitry is/are best suited to execute the computing task(s).
Artificial intelligence (AI), including machine learning (ML), deep learning (DL), and/or other artificial machine-driven logic, enables machines (e.g., computers, logic circuits, etc.) to use a model to process input data to generate an output based on patterns and/or associations previously learned by the model via a training process. For instance, the model may be trained with data to recognize patterns and/or associations when processing input data such that other input(s) result in output(s) consistent with the recognized patterns and/or associations.
Many different types of machine learning models and/or machine learning architectures exist. In some examples disclosed herein, a decision tree model is used. Using a decision tree model enables the interpretation of data that is simple and explainable. In general, machine learning models/architectures that are suitable to use in the example approaches disclosed herein will be Convolutional Neural Network (CNN) and/or Deep Neural Network (DNN), wherein interconnections are not visible outside of the model. However, other types of machine learning models could additionally or alternatively be used such as Recurrent Neural Network (RNN), Support Vector Machine (SVM), Gated Recurrent Unit (GRU), Long Short Term Memory (LSTM), etc.
In general, implementing a ML/AI system involves two phases, a learning/training phase and an inference phase. In the learning/training phase, a training algorithm is used to train a model to operate in accordance with patterns and/or associations based on, for example, training data. In general, the model includes internal parameters that guide how input data is transformed into output data, such as through a series of nodes and connections within the model to transform input data into output data. Additionally, hyperparameters are used as part of the training process to control how the learning is performed (e.g., a learning rate, a number of layers to be used in the machine learning model, etc.). Hyperparameters are defined to be training parameters that are determined prior to initiating the training process.
Different types of training may be performed based on the type of ML/AI model and/or the expected output. For example, supervised training uses inputs and corresponding expected (e.g., labeled) outputs to select parameters (e.g., by iterating over combinations of select parameters) for the ML/AI model that reduce model error. As used herein, labelling refers to an expected output of the machine learning model (e.g., a classification, an expected output value, etc.) Alternatively, unsupervised training (e.g., used in deep learning, a subset of machine learning, etc.) involves inferring patterns from inputs to select parameters for the ML/AI model (e.g., without the benefit of expected (e.g., labeled) outputs).
In examples disclosed herein, ML/AI models are trained using known software samples (e.g., malicious and/or clean). However, any other training algorithm may additionally or alternatively be used. In examples disclosed herein, training is performed on the feature-based classification model and appendix classification model.
Training is performed using hyperparameters that control how the learning is performed (e.g., a learning rate, a number of layers to be used in the machine learning model, etc.).
Training is performed using training data. In examples disclosed herein, the training data may be any type of dataset of malicious and/or clean software samples.
Once training is complete, the model is deployed for use as an executable construct that processes an input and provides an output based on the network of nodes and connections defined in the model. The model is stored in a memory. The model may then be executed by the malware classifier circuitry 104 of
Once trained, the deployed model may be operated in an inference phase to process data. In the inference phase, data to be analyzed (e.g., live data) is input to the model, and the model executes to create an output. This inference phase can be thought of as the AI “thinking” to generate the output based on what it learned from the training (e.g., by executing the model to apply the learned patterns and/or associations to the live data). In some examples, input data undergoes pre-processing before being used as an input to the machine learning model. Moreover, in some examples, the output data may undergo post-processing after it is generated by the AI model to transform the output into a useful result (e.g., a display of data, an instruction to be executed by a machine, etc.).
In some examples, output of the deployed model may be captured and provided as feedback. By analyzing the feedback, an accuracy of the deployed model can be determined. If the feedback indicates that the accuracy of the deployed model is less than a threshold or other criterion, training of an updated model can be triggered using the feedback and an updated training data set, hyperparameters, etc., to generate an updated, deployed model.
One example algorithm for machine learning classification is decision tree-based classification. Decision trees are created in such a way, using decision tree-based classifiers (e.g., feature-based machine learning classifiers), such that a minimum number of similar observations is required to influence the nodes and leaves of the tree. When the minimum number of similar observations is not satisfied, the feature-based ML classifier will disregard any training data that is deemed to be too far from the sample average (i.e., noise), as a control mechanism to prevent overfitting and/or underfitting of data by the resulting machine learning model in deployment.
However, an inability to distinguish between noise and low prevalence samples in the training data often results in the omission of important low prevalence data samples when building a machine learning model with which software classification will be performed. As a result, the model will not generalize well in deployment when given unknown data samples similar to the disregarded low prevalence samples to be classified as malicious or clean. For example, in a corpus of nine million malware samples, a set of 50 unique observations may not be a sufficiently large sample to be included in the training set, which introduces an everlasting gap in detectability that cannot be mitigated unless more samples of the same kind are added to the training set, which is not often possible.
Essentially, malware samples that have low representation or variations in the wild will be able to evade decision-tree based classifiers by flying “under the radar.” This can create a ‘gap’ in detectability, wherein the quantity of samples may be large enough that they are not easily detected with signature methods but still small enough to evade ML based methods.
Example methods and apparatus disclosed herein receive unknown data samples for classification, classify the data sample using a feature-based classifier, classify the data sample again using a second appendix classifier, and output a final classification based on a confidence threshold. Having the ability to compute a second appendix classifier without a control mechanism against low prevalence samples allows for the more accurate building of a machine learning model for future classification of software samples. Examples disclosed herein utilize distance metrics such as Euclidean distance, Hamming distance, Levenshtein and/or string token distance, etc., as well as data manipulation methods such as MinHash, Locality Sensitive Hashing (LSH), etc. and feature-based machine learning classifiers such as decision tree-based classifiers, etc.
In the example malware classification system 100 of
The example malware classifier circuitry 104 accepts the unclassified samples 102 and produces the classified samples 112. In examples disclosed herein, the classified samples 112 are PE files that have been classified as clean or malicious. In some examples, the classified samples 112 may represent any type of file that has been classified as clean or malicious. The example malware classifier circuitry 104 includes example feature-based classifier circuitry 106, example appendix classifier circuitry 108, and example sample classification circuitry 110.
The example feature-based classifier circuitry 106 accepts the unclassified samples 102 and produces first intermediate classified samples 107A to be processed further in the example sample classification circuitry 110. In examples disclosed herein, the feature-based classifier circuitry 106 is a decision-tree based classifier that has a set of diverse features defined as a “feature vector” containing categorical and/or numerical values.
In some examples, the malware classifier circuitry 104 of
The example appendix classifier circuitry 108 employs a two-stage refinement and classification process based on the labels of similar samples, to produce a feature-agnostic classification based on the reputation of the Jaccard-neighborhood as second intermediate classified samples 107B. This translates into a different perspective of analysis, complementing the feature-based classifier. Because the mechanism is based on similarity discovery through a MinHash LSH Forest, it is agnostic and insensitive to dataset sample prevalence, thus allowing for the production of non-overlapping results with only a few neighbor samples. The example appendix classifier circuitry 108 is described further in conjunction with
In some examples, the malware classifier circuitry 104 of
The example sample classification circuitry 110 of
Because an LSH Forest queries similar samples based on Jaccard-distance, it can retrieve a similar sample independent of its prevalence. For example, if only 5 out of 10 million samples present the same characteristics, the LSH Forest is still capable of retrieving these 5 low-prevalence samples if the MinHash result of the unknown sample proves to be similar. This then gives the low prevalence samples the same chance of influencing the second-stage appendix classifier as high-prevalence samples. Therefore, while the feature-based classifier 305 is capable of classifying 90% of the unclassified samples, the example appendix classifier 310 can identify the remaining 10% of low-prevalence samples, effectively closing the aforementioned gap in detectability.
The example appendix classifier circuitry 108 implements two stages. The first stage re-uses a part of the unknown feature vector 402 defined by the traditional classifier. Only the features that are of categorical nature or features that can be transformed from numerical to categorical values are used by the first stage of the example appendix classifier circuitry 108. This first stage includes obtaining a MinHash (that is, a hash that maximizes collision) from the selected/hashable features of a given unclassified sample 102. This MinHashed vector 404 is then used to query two LSH (Locality Sensitive Hashing) Forests. One of these forests (e.g., malware LSH forest 406) includes samples of one class (e.g., malware) while the other forest (e.g., clean LSH forest 420) includes samples of the other class (e.g., clean). If the problem is multi-class, more forests would be needed to hold all the possible classes.
By querying these two forests with the test sample MinHash, a top-k list of similar malware items 408 and similar clean items 422 is obtained from each forest. ‘k’ is an adjustable value used to obtain more or less similar samples. In the example appendix classifier circuitry 108 of
A Custom Distance Metric (CDM) is used to order the top 100 similar sorted malware items 410 and the top 100 similar sorted clean items 424. The CDM is used to compute several sub-distances (the number of sub-distances depends on how many different datatypes the original feature vector has). For example, if the feature vector includes three types of data (categorical features, numerical features, and string features) then the CDM would need to compute three sub-distances (e.g., malware hamming distances 414, clean hamming distances 428, malware Euclidean distances 416, clean Euclidean distances 430, malware token set ratio distances 418, and clean token set ratio distances 432). The computation of these sub-distances needs to be performed between the test sample and the k similar samples obtained from each forest. In this example, that would be 3 sub-distances×200 similar samples (100 from each forest). Computing the CDM ensures that new results can be sorted. That means, the 100 similar malware items 408 and similar clean items 422 returned by each forest can be sorted from closest to farthest. This order is important as it conveys additional signal that can be exploited by the example appendix classifier circuitry 108.
The example binary classifier 434 accepts a basic proximity vector 500A and/or an advanced proximity vector 500B from the first malware distance 412 and a second proximity vector 500A, 500B from the first clean distance 426 as input and produces a sample that is classified as either clean or malicious. The contents of a proximity vector 500A, 500B are further explored in conjunction with
The example binary classifier 434 has been trained to learn the exact sub-distances values required to predict a sample as being malicious or clean based on the proximity with 100 similar malware items 408 and 100 similar clean items 422. In some examples, the 100 similar malware items 408 and 100 similar clean items 422 are referred to as “the neighborhood reputation”. By comparison with known “clustering” methods, the example appendix classifier circuitry 108 does not require manual intervention to set and tune either number of clusters or operational parameters of the clusters (i.e., cluster centroid threshold adjustment to consider something as belonging or not). Even though the example appendix classifier circuitry 108 is based on distances to labels, it still behaves like any other decision-based or linear-based classifier, which does not require unsupervised learning maintenance and tweaks for the classification task. This is an advantage of the example appendix classifier circuitry 108.
When the example appendix classifier circuitry 108 of
In some examples, the malware classifier circuitry 104 of
While an example manner of implementing the malware classifier circuitry 104 is illustrated in
A flowchart representative of example hardware logic circuitry, machine readable instructions, hardware implemented state machines, and/or any combination thereof for implementing the malware classifier circuitry 104 of
A flowchart representative of example hardware logic circuitry, machine readable instructions, hardware implemented state machines, and/or any combination thereof for implementing the malware classifier circuitry 104 of
The machine readable instructions described herein may be stored in one or more of a compressed format, an encrypted format, a fragmented format, a compiled format, an executable format, a packaged format, etc. Machine readable instructions as described herein may be stored as data or a data structure (e.g., as portions of instructions, code, representations of code, etc.) that may be utilized to create, manufacture, and/or produce machine executable instructions. For example, the machine readable instructions may be fragmented and stored on one or more storage devices and/or computing devices (e.g., servers) located at the same or different locations of a network or collection of networks (e.g., in the cloud, in edge devices, etc.). The machine readable instructions may require one or more of installation, modification, adaptation, updating, combining, supplementing, configuring, decryption, decompression, unpacking, distribution, reassignment, compilation, etc., in order to make them directly readable, interpretable, and/or executable by a computing device and/or other machine. For example, the machine readable instructions may be stored in multiple parts, which are individually compressed, encrypted, and/or stored on separate computing devices, wherein the parts when decrypted, decompressed, and/or combined form a set of machine executable instructions that implement one or more operations that may together form a program such as that described herein.
In another example, the machine readable instructions may be stored in a state in which they may be read by processor circuitry, but require addition of a library (e.g., a dynamic link library (DLL)), a software development kit (SDK), an application programming interface (API), etc., in order to execute the machine readable instructions on a particular computing device or other device. In another example, the machine readable instructions may need to be configured (e.g., settings stored, data input, network addresses recorded, etc.) before the machine readable instructions and/or the corresponding program(s) can be executed in whole or in part. Thus, machine readable media, as used herein, may include machine readable instructions and/or program(s) regardless of the particular format or state of the machine readable instructions and/or program(s) when stored or otherwise at rest or in transit.
The machine readable instructions described herein can be represented by any past, present, or future instruction language, scripting language, programming language, etc. For example, the machine readable instructions may be represented using any of the following languages: C, C++, Java, C#, Perl, Python, JavaScript, HyperText Markup Language (HTML), Structured Query Language (SQL), Swift, etc.
As mentioned above, the example operations of
“Including” and “comprising” (and all forms and tenses thereof) are used herein to be open ended terms. Thus, whenever a claim employs any form of “include” or “comprise” (e.g., comprises, includes, comprising, including, having, etc.) as a preamble or within a claim recitation of any kind, it is to be understood that additional elements, terms, etc., may be present without falling outside the scope of the corresponding claim or recitation. As used herein, when the phrase “at least” is used as the transition term in, for example, a preamble of a claim, it is open-ended in the same manner as the term “comprising” and “including” are open ended. The term “and/or” when used, for example, in a form such as A, B, and/or C refers to any combination or subset of A, B, C such as (1) A alone, (2) B alone, (3) C alone, (4) A with B, (5) A with C, (6) B with C, or (7) A with B and with C. As used herein in the context of describing structures, components, items, objects and/or things, the phrase “at least one of A and B” is intended to refer to implementations including any of (1) at least one A, (2) at least one B, or (3) at least one A and at least one B. Similarly, as used herein in the context of describing structures, components, items, objects and/or things, the phrase “at least one of A or B” is intended to refer to implementations including any of (1) at least one A, (2) at least one B, or (3) at least one A and at least one B. As used herein in the context of describing the performance or execution of processes, instructions, actions, activities and/or steps, the phrase “at least one of A and B” is intended to refer to implementations including any of (1) at least one A, (2) at least one B, or (3) at least one A and at least one B. Similarly, as used herein in the context of describing the performance or execution of processes, instructions, actions, activities and/or steps, the phrase “at least one of A or B” is intended to refer to implementations including any of (1) at least one A, (2) at least one B, or (3) at least one A and at least one B.
As used herein, singular references (e.g., “a”, “an”, “first”, “second”, etc.) do not exclude a plurality. The term “a” or “an” object, as used herein, refers to one or more of that object. The terms “a” (or “an”), “one or more”, and “at least one” are used interchangeably herein. Furthermore, although individually listed, a plurality of means, elements or method actions may be implemented by, e.g., the same entity or object. Additionally, although individual features may be included in different examples or claims, these may possibly be combined, and the inclusion in different examples or claims does not imply that a combination of features is not feasible and/or advantageous.
At block 604, the feature-based classifier circuitry 106 of
At block 606, the appendix classifier circuitry 108 of
At block 608, the sample classification circuitry 110 of
At block 610, if the sample classification circuitry 110 of
At block 612, if the sample classification circuitry 110 of
As illustrated in
At block 704, the resulting MinHash table is used by the appendix classifier circuitry 108 to query both the clean LSH forest 420 and malicious LSH forest 406 of
At block 706, the results of the query are stored (e.g., in an array) by the appendix classifier circuitry 108 as top 100 similar malware items and top 100 similar clean items (e.g., malware LSH forest 406, clean LSH forest 420 of
At block 708, the custom distance metric (CDM) is calculated by the appendix classifier circuitry 108 for the similar neighbor samples results stored from the query run in block 706. In examples disclosed herein, the CDM is used to compute several sub-distances (the number of sub-distances depends on how many different datatypes the original feature vector has). For example, if the feature vector includes three types of data (categorical features, numerical features, and string features) then the appendix classifier circuitry 108 would need to compute three sub-distances (e.g., malware hamming distances 414, clean hamming distances 428, malware Euclidean distances 416, clean Euclidean distances 430, malware token set ratio distances 418, and clean token set ratio distances 432 of
At block 710, the top 100 similar malware items and top 100 similar clean items (e.g., malware LSH forest 406, clean LSH forest 420 of
At block 712, a classification algorithm is run by the appendix classifier circuitry 108 on the sorted similar neighbor samples to classify the unknown data sample as either malicious or clean. In examples disclosed herein, the classification algorithm utilized include at least one of a linear regression algorithm or logistic regression algorithm, however, any other type of classification algorithm may be performed on the sorted similar neighbor samples.
At block 714, the appendix classification result for the unknown data sample (e.g., malicious sample or clean sample), as determined in block 712, is output by the appendix classifier circuitry 108.
The processor platform 800 of the illustrated example includes processor circuitry 812. The processor circuitry 812 of the illustrated example is hardware. For example, the processor circuitry 812 can be implemented by one or more integrated circuits, logic circuits, FPGAs microprocessors, CPUs, GPUs, DSPs, and/or microcontrollers from any desired family or manufacturer. The processor circuitry 812 may be implemented by one or more semiconductor based (e.g., silicon based) devices. In this example, the processor circuitry 812 implements the example feature-based classifier circuitry 106, appendix classifier circuitry 108, and sample classification circuitry 110.
The processor circuitry 812 of the illustrated example includes a local memory 813 (e.g., a cache, registers, etc.). The processor circuitry 812 of the illustrated example is in communication with a main memory including a volatile memory 814 and a non-volatile memory 816 by a bus 818. The volatile memory 814 may be implemented by Synchronous Dynamic Random Access Memory (SDRAM), Dynamic Random Access Memory (DRAM), RAIVIBUS® Dynamic Random Access Memory (RDRAM®), and/or any other type of RAM device. The non-volatile memory 816 may be implemented by flash memory and/or any other desired type of memory device. Access to the main memory 814, 816 of the illustrated example is controlled by a memory controller 817.
The processor platform 800 of the illustrated example also includes interface circuitry 820. The interface circuitry 820 may be implemented by hardware in accordance with any type of interface standard, such as an Ethernet interface, a universal serial bus (USB) interface, a Bluetooth® interface, a near field communication (NFC) interface, a PCI interface, and/or a PCIe interface.
In the illustrated example, one or more input devices 840 are connected to the interface circuitry 820. The input device(s) 822 permit(s) a user to enter data and/or commands into the processor circuitry 8812. The input device(s) 822 can be implemented by, for example, an audio sensor, a microphone, a camera (still or video), a keyboard, a button, a mouse, a touchscreen, a track-pad, a trackball, an isopoint device, and/or a voice recognition system.
One or more output devices 824 are also connected to the interface circuitry 820 of the illustrated example. The output devices 824 can be implemented, for example, by display devices (e.g., a light emitting diode (LED), an organic light emitting diode (OLED), a liquid crystal display (LCD), a cathode ray tube (CRT) display, an in-place switching (IPS) display, a touchscreen, etc.), a tactile output device, a printer, and/or speaker. The interface circuitry 820 of the illustrated example, thus, typically includes a graphics driver card, a graphics driver chip, and/or graphics processor circuitry such as a GPU.
The interface circuitry 820 of the illustrated example also includes a communication device such as a transmitter, a receiver, a transceiver, a modem, a residential gateway, a wireless access point, and/or a network interface to facilitate exchange of data with external machines (e.g., computing devices of any kind) by a network 826. The communication can be by, for example, an Ethernet connection, a digital subscriber line (DSL) connection, a telephone line connection, a coaxial cable system, a satellite system, a line-of-site wireless system, a cellular telephone system, an optical connection, etc.
The processor platform 800 of the illustrated example also includes one or more mass storage devices 828 to store software and/or data. Examples of such mass storage devices 828 include magnetic storage devices, optical storage devices, floppy disk drives, HDDs, CDs, Blu-ray disk drives, redundant array of independent disks (RAID) systems, solid state storage devices such as flash memory devices, and DVD drives.
The machine executable instructions 832, which may be implemented by the machine readable instructions of
The cores 902 may communicate by an example first bus 904. In some examples, the first bus 904 may implement a communication bus to effectuate communication associated with one(s) of the cores 902. For example, the first bus 904 may implement at least one of an Inter-Integrated Circuit (I2C) bus, a Serial Peripheral Interface (SPI) bus, a PCI bus, or a PCIe bus. Additionally or alternatively, the first bus 904 may implement any other type of computing or electrical bus. The cores 902 may obtain data, instructions, and/or signals from one or more external devices by example interface circuitry 906. The cores 902 may output data, instructions, and/or signals to the one or more external devices by the interface circuitry 906. Although the cores 902 of this example include example local memory 920 (e.g., Level 1 (L1) cache that may be split into an L1 data cache and an L1 instruction cache), the microprocessor 900 also includes example shared memory 910 that may be shared by the cores (e.g., Level 2 (L2_cache)) for high-speed access to data and/or instructions. Data and/or instructions may be transferred (e.g., shared) by writing to and/or reading from the shared memory 910. The local memory 920 of each of the cores 902 and the shared memory 910 may be part of a hierarchy of storage devices including multiple levels of cache memory and the main memory (e.g., the main memory 815, 820 of
Each core 902 may be referred to as a CPU, DSP, GPU, etc., or any other type of hardware circuitry. Each core 902 includes control unit circuitry 914, arithmetic and logic (AL) circuitry (sometimes referred to as an ALU) 916, a plurality of registers 918, the L1 cache 920, and an example bus 922. Other structures may be present. For example, each core 902 may include vector unit circuitry, single instruction multiple data (SIMD) unit circuitry, load/store unit (LSU) circuitry, branch/jump unit circuitry, floating-point unit (FPU) circuitry, etc. The control unit circuitry 914 includes semiconductor-based circuits structured to control (e.g., coordinate) data movement within the corresponding core 902. The AL circuitry 916 includes semiconductor-based circuits structured to perform one or more mathematic and/or logic operations on the data within the corresponding core 902. The AL circuitry 916 of some examples performs integer based operations. In other examples, the AL circuitry 916 also performs floating point operations. In yet other examples, the AL circuitry 916 may include first AL circuitry that performs integer based operations and second AL circuitry that performs floating point operations. In some examples, the AL circuitry 916 may be referred to as an Arithmetic Logic Unit (ALU). The registers 918 are semiconductor-based structures to store data and/or instructions such as results of one or more of the operations performed by the AL circuitry 916 of the corresponding core 902. For example, the registers 918 may include vector register(s), SIMD register(s), general purpose register(s), flag register(s), segment register(s), machine specific register(s), instruction pointer register(s), control register(s), debug register(s), memory management register(s), machine check register(s), etc. The registers 918 may be arranged in a bank as shown in
Each core 902 and/or, more generally, the microprocessor 900 may include additional and/or alternate structures to those shown and described above. For example, one or more clock circuits, one or more power supplies, one or more power gates, one or more cache home agents (CHAs), one or more converged/common mesh stops (CMSs), one or more shifters (e.g., barrel shifter(s)) and/or other circuitry may be present. The microprocessor 900 is a semiconductor device fabricated to include many transistors interconnected to implement the structures described above in one or more integrated circuits (ICs) contained in one or more packages. The processor circuitry may include and/or cooperate with one or more accelerators. In some examples, accelerators are implemented by logic circuitry to perform certain tasks more quickly and/or efficiently than can be done by a general purpose processor. Examples of accelerators include ASICs and FPGAs such as those discussed herein. A GPU or other programmable device can also be an accelerator. Accelerators may be on-board the processor circuitry, in the same chip package as the processor circuitry and/or in one or more separate packages from the processor circuitry.
More specifically, in contrast to the microprocessor 900 of
In the example of
The interconnections 1010 of the illustrated example are conductive pathways, traces, vias, or the like that may include electrically controllable switches (e.g., transistors) whose state can be changed by programming (e.g., using an HDL instruction language) to activate or deactivate one or more connections between one or more of the logic gate circuitry 1008 to program desired logic circuits.
The storage circuitry 1012 of the illustrated example is structured to store result(s) of the one or more of the operations performed by corresponding logic gates. The storage circuitry 1012 may be implemented by registers or the like. In the illustrated example, the storage circuitry 1012 is distributed amongst the logic gate circuitry 1008 to facilitate access and increase execution speed.
The example FPGA circuitry 1000 of
Although
In some examples, the processor circuitry 825 of
A block diagram illustrating an example software distribution platform 1105 to distribute software such as the example machine readable instructions 1132 of
Example methods, apparatus, systems, and articles of manufacture to augment classification coverage for low prevalence samples through neighborhood labels proximity vectors are disclosed herein. Further examples and combinations thereof include the following:
Example 1 includes an apparatus to augment classification coverage for low prevalence malware samples comprising interface circuitry, processor circuitry including one or more of at least one of a central processing unit, a graphic processing unit or a digital signal processor, the at least one of the central processing unit, the graphic processing unit or the digital signal processor having control circuitry to control data movement within the processor circuitry, arithmetic and logic circuitry to perform one or more first operations according to instructions, and one or more registers to store a result of the one or more first operations, the instructions in the apparatus, a Field Programmable Gate Array (FPGA), the FPGA including logic gate circuitry, a plurality of configurable interconnections, and storage circuitry, the logic gate circuitry and interconnections to perform one or more second operations, the storage circuitry to store a result of the one or more second operations, or Application Specific Integrated Circuitry (ASIC) including logic gate circuitry to perform one or more third operations, the processor circuitry to perform at least one of the first operations, the second operations or the third operations to instantiate feature-based classifier circuitry to calculate a first classification result using a first classifier for a data sample, appendix classifier circuitry to calculate a second classification result using a second classifier for a data sample, the second classifier using a plurality of sensitive hashing (LSH) forests to analyze a sorted plurality of neighbor samples, and sample classification circuitry to determine whether a first classification result of the first classifier passes a confidence threshold, wherein the appendix classifier circuitry is to output the first classification result when the first classification result of the first classifier is determined to have passed the confidence threshold, and the appendix classifier circuitry is to output the second classification result when the first classification result of the first classifier is determined to have not passed the confidence threshold.
Example 2 includes the apparatus of example 1, wherein the first classifier is a feature-based classifier.
Example 3 includes the apparatus of example 1, wherein the appendix classifier circuitry is to perform a hashing algorithm on the data sample, query a clean locality sensitive hashing (LSH) forest and a malicious LSH forest for a plurality of similar neighbor samples, calculate a custom distance metric (CDM) for a first stored similar neighbor sample of the plurality of similar neighbor samples, sort the plurality of similar neighbor samples based on the calculated CDM for first stored similar neighbor sample, execute a classification algorithm on the sorted plurality of neighbor samples to produce an appendix classification result, and output the appendix classification result.
Example 4 includes the apparatus of example 3, wherein the hashing algorithm is a MinHash algorithm.
Example 5 includes the apparatus of example 3, wherein the custom distance metric (CDM) is used to compute a plurality of sub-distances including at least two of a Hamming distance, a Euclidean distance, and a Token Set Ratio distance.
Example 6 includes the apparatus of example 3, wherein the classification algorithm is executed on the sorted plurality of neighbor samples to produce the appendix classification result is at least one of a linear regression algorithm or a logistic regression algorithm.
Example 7 includes a non-transitory computer readable medium comprising a plurality of instructions that, when executed, cause a machine to at least classify a data sample using a first classifier, classify the data sample using a second classifier different from the first classifier, the second classifier using a plurality of sensitive hashing (LSH) forests to analyze a sorted plurality of neighbor samples, determine whether a first classification result of the first classifier meets or exceeds a confidence threshold, in response to the first classification result of the first classifier meeting or exceeding the confidence threshold, output the first classification result, and in response to the first classification result of the first classifier not meeting or exceeding the confidence threshold, output a second classification result of the second classifier.
Example 8 includes the non-transitory computer readable medium of example 7, wherein the first classifier is a feature-based classifier.
Example 9 includes the non-transitory computer readable medium of example 7, wherein the first classifier is a decision tree-based classifier.
Example 10 includes the non-transitory computer readable medium of example 7, wherein to calculate the second classification result, the plurality of instructions further cause the machine to at least perform a hashing algorithm on the data sample, query a clean locality sensitive hashing (LSH) forest and a malicious LSH forest for a plurality of similar neighbor samples, calculate a custom distance metric (CDM) for a first stored similar neighbor sample of the plurality of similar neighbor samples, sort the plurality of similar neighbor samples based on the calculated CDM for first stored similar neighbor sample, execute a classification algorithm on the sorted plurality of neighbor samples to produce an appendix classification result, and output the appendix classification result.
Example 11 includes the non-transitory computer readable medium of example 10, wherein the hashing algorithm is a MinHash algorithm.
Example 12 includes the non-transitory computer readable medium of example 10, wherein the custom distance metric (CDM) is used to compute a plurality of sub-distances such as a Hamming distance, a Euclidean distance, and a Token Set Ratio distance.
Example 13 includes the non-transitory computer readable medium of example 10, wherein the classification algorithm run on the sorted plurality of neighbor samples to produce the appendix classification result is a linear regression algorithm or a logistic regression algorithm.
Example 14 includes the non-transitory computer readable medium of example 7, wherein the confidence threshold is a pre-determined confidence threshold.
Example 15 includes a method to augment classification coverage for low prevalence malware samples comprising classifying an unknown data sample using a first classifier, classifying the unknown data sample using a second classifier, the second classifier using a plurality of sensitive hashing (LSH) forests to analyze a sorted plurality of neighbor samples, determining whether a first classification result of the first classifier passes a confidence threshold, outputting, when the first classification result of the first classifier is determined to have passed the confidence threshold, the first classification result, and outputting, when the first classification result of the first classifier is determined to have not passed the confidence threshold, a second classification result of the second classifier.
Example 16 includes the method of example 15, wherein the first classifier is a feature-based classifier.
Example 17 includes the method of example 16, wherein the first classifier is a decision tree-based classifier.
Example 18 includes the method of example 15, where the second classification result is calculated by performing a hashing algorithm on the data sample, querying a clean locality sensitive hashing (LSH) forest and a malicious LSH forest for a plurality of similar neighbor samples, calculating a custom distance metric (CDM) for a first stored similar neighbor sample of the plurality of similar neighbor samples, sorting the plurality of similar neighbor samples based on the calculated CDM for first stored similar neighbor sample, executing a classification algorithm on the sorted plurality of neighbor samples to produce an appendix classification result, and outputting the appendix classification result.
Example 19 includes the method of example 18, wherein the hashing algorithm is a MinHash algorithm.
Example 20 includes the method of example 18, wherein the custom distance metric (CDM) is used to compute a plurality of sub-distances including at least two of a Hamming distance, a Euclidean distance, and a Token Set Ratio distance.
Example 21 includes the method of example 18, wherein the classification algorithm run on the sorted plurality of neighbor samples to produce the appendix classification result is at least one of a linear regression algorithm or a logistic regression algorithm.
Example 22 includes the method of example 15, wherein the confidence threshold is a pre-determined confidence threshold.
Example 23 includes an apparatus for augmentation of classification coverage for low prevalence samples comprising means for classifying to classify an unknown data sample using a first classifier, the means for classifying to classify the unknown data sample using a second classifier, the second classifier using a plurality of sensitive hashing (LSH) forests to analyze a sorted plurality of neighbor samples, means for determining whether a first classification result of the first classifier passes a confidence threshold, and means for outputting the first classification result when the first classification result of the first classifier is determined to have passed the confidence threshold, the means for outputting to output a second classification result of the second classifier when the first classification result of the first classifier is determined to have not passed the confidence threshold.
Example 24 includes the apparatus of example 23, wherein the first classifier is a feature-based classifier.
Example 25 includes the apparatus of example 24, wherein the first classifier is a decision tree-based classifier.
Example 26 includes the apparatus of example 23, wherein the means for classifying is further to perform a hashing algorithm on the data sample, query a clean locality sensitive hashing (LSH) forest and a malicious LSH forest for a plurality of similar neighbor samples, calculate a custom distance metric (CDM) for a first stored similar neighbor sample of the plurality of similar neighbor samples, sort the plurality of similar neighbor samples based on the calculated CDM for first stored similar neighbor sample, execute a classification algorithm on the sorted plurality of neighbor samples to produce an appendix classification result, and output the appendix classification result.
Example 27 includes the apparatus of example 26, wherein the hashing algorithm is a MinHash algorithm.
Example 28 includes the apparatus of example 26, wherein the means for classifying is further to compute a plurality of sub-distances including at least two of a Hamming distance, a Euclidean distance, and a Token Set Ratio distance.
Example 29 includes the apparatus of example 26, wherein the means for classifying is to produce the appendix classification result based on at least one of a linear regression algorithm or a logistic regression algorithm.
Example 30 includes the apparatus of example 23, wherein the confidence threshold is a pre-determined confidence threshold.
It is noted that this patent claims priority from U.S. Provisional Patent Application No. 63/227,305, which was filed on Jul. 29, 2021, and is hereby incorporated by reference in its entirety.
Although certain example systems, methods, apparatus, and articles of manufacture have been disclosed herein, the scope of coverage of this patent is not limited thereto. On the contrary, this patent covers all systems, methods, apparatus, and articles of manufacture fairly falling within the scope of the claims of this patent.
The following claims are hereby incorporated into this Detailed Description by this reference, with each claim standing on its own as a separate embodiment of the present disclosure.
This patent arises from a continuation of U.S. Patent Application Ser. No. 63/227,305, which was filed on Jul. 29, 2021. U.S. Provisional Patent Application No. 63/227,305 is hereby incorporated herein by reference in its entirety. Priority to U.S. Provisional Patent Application No. 63/227,305 is hereby claimed.
| Number | Name | Date | Kind |
|---|---|---|---|
| 8621626 | Alme | Dec 2013 | B2 |
| 10924503 | Pereira | Feb 2021 | B1 |
| 20130326625 | Anderson et al. | Dec 2013 | A1 |
| 20160098561 | Keller | Apr 2016 | A1 |
| 20160132521 | Reininger et al. | May 2016 | A1 |
| 20190026466 | Krasser | Jan 2019 | A1 |
| 20190199736 | Howard | Jun 2019 | A1 |
| 20230029679 | Lancioni et al. | Feb 2023 | A1 |
| 20230030136 | Lancioni et al. | Feb 2023 | A1 |
| 20230171277 | Giaconi et al. | Jun 2023 | A1 |
| Number | Date | Country |
|---|---|---|
| 110991538 | Apr 2020 | CN |
| Entry |
|---|
| United States Patent and Trademark Office, “Non-Final Office Action,” issued in connection with U.S. Appl. No. 17/645,921, dated Mar. 12, 2024, 22 pages. |
| United States Patent and Trademark Office, “Non-Final Office Action,” issued in connection with U.S. Patent Application No. 17/,561,475 dated Mar. 14, 2024, 11 pages. |
| Number | Date | Country | |
|---|---|---|---|
| 20230029679 A1 | Feb 2023 | US |
| Number | Date | Country | |
|---|---|---|---|
| 63227305 | Jul 2021 | US |
