Patents by Inventor Matthew Wolff
Matthew Wolff has filed for patents to protect the following inventions. This listing includes patent applications that are pending as well as patents that have already been granted by the United States Patent and Trademark Office (USPTO).
-
Publication number: 20190286952Abstract: In one respect, there is provided a system for training a neural network adapted for classifying one or more scripts. The system may include at least one processor and at least one memory. The memory may include program code that provides operations when executed by the at least one memory. The operations may include: extracting, from an icon associated with a file, one or more features; assigning, based at least on the one or more features, the icon to one of a plurality of clusters; and generating, based at least on the cluster to which the icon is assigned, a classification for the file associated with the icon. Related methods and articles of manufacture, including computer program products, are also provided.Type: ApplicationFiled: May 31, 2019Publication date: September 19, 2019Inventors: Matthew Wolff, Pedro Silva do Nascimento Neto, Xuan Zhao, John Brock, Jian Luan
-
Publication number: 20190286819Abstract: In one respect, there is provided a system for classifying malware. The system may include a data processor and a memory. The memory may include program code that provides operations when executed by the processor. The operations may include: providing, to a display, contextual information associated with a file to at least enable a classification of the file, when a malware classifier is unable to classify the file; receiving, in response to the providing of the contextual information, the classification of the file; and updating, based at least on the received classification of the file, the malware classifier to enable the malware classifier to classify the file. Methods and articles of manufacture, including computer program products, are also provided.Type: ApplicationFiled: May 31, 2019Publication date: September 19, 2019Inventors: Matthew Maisel, Ryan Permeh, Matthew Wolff, Gabriel Acevedo, Andrew Davis, John Brock, Homer Valentine Strong, Michael Wojnowicz, Kevin Beets
-
Patent number: 10417530Abstract: Centroids are used for improving machine learning classification and information retrieval. A plurality of files are classified as malicious or not malicious based on a function dividing a coordinate space into at least a first portion and a second portion such that the first portion includes a first subset of the plurality of files classified as malicious. One or more first geometric regions are defined in the first portion that classify files from the first subset as not malicious. A file is determined to be malicious based on whether the file is located within the one or more first geometric regions.Type: GrantFiled: September 29, 2017Date of Patent: September 17, 2019Assignee: Cylance Inc.Inventors: Jian Luan, Matthew Wolff, Brian Wallace
-
Publication number: 20190278690Abstract: Data is received or accessed that includes a structured file encapsulating data required by an execution environment to manage executable code wrapped within the structured file. Thereafter, code and data regions are iteratively identified in the structured file. Such identification is analyzed so that at least one feature can be extracted from the structured file. Related apparatus, systems, techniques and articles are also described.Type: ApplicationFiled: May 28, 2019Publication date: September 12, 2019Inventors: Derek A. Soeder, Ryan Permeh, Gary Golomb, Matthew Wolff
-
Patent number: 10394686Abstract: Data is received or accessed that includes a structured file encapsulating data required by an execution environment to manage executable code wrapped within the structured file. Thereafter, code and data regions are iteratively identified in the structured file. Such identification is analyzed so that at least one feature can be extracted from the structured file. Related apparatus, systems, techniques and articles are also described.Type: GrantFiled: February 6, 2018Date of Patent: August 27, 2019Assignee: Cylance Inc.Inventors: Derek A. Soeder, Ryan Permeh, Gary Golomb, Matthew Wolff
-
Patent number: 10360380Abstract: In one respect, there is provided a system for classifying malware. The system may include a data processor and a memory. The memory may include program code that provides operations when executed by the processor. The operations may include: providing, to a display, contextual information associated with a file to at least enable a classification of the file, when a malware classifier is unable to classify the file; receiving, in response to the providing of the contextual information, the classification of the file; and updating, based at least on the received classification of the file, the malware classifier to enable the malware classifier to classify the file. Methods and articles of manufacture, including computer program products, are also provided.Type: GrantFiled: January 19, 2017Date of Patent: July 23, 2019Assignee: Cylance Inc.Inventors: Matthew Maisel, Ryan Permeh, Matthew Wolff, Gabriel Acevedo, Andrew Davis, John Brock, Homer Strong, Michael Wojnowicz, Kevin Beets
-
Patent number: 10354067Abstract: An endpoint computer system can harvest data relating to a plurality of events occurring within an operating environment of the endpoint computer system and can add the harvested data to a local data store maintained on the endpoint computer system. In some examples, the local data store can be an audit log and/or can include one or more tamper resistant features. Systems, methods, and computer program products are described.Type: GrantFiled: November 18, 2016Date of Patent: July 16, 2019Assignee: Cylance Inc.Inventors: Ryan Permeh, Matthew Wolff, Samuel John Oswald, Xuan Zhao, Mark Culley, Steve Polson
-
Patent number: 10354066Abstract: An endpoint computer system can harvest data relating to a plurality of events occurring within an operating environment of the endpoint computer system and can add the harvested data to a local data store maintained on the endpoint computer system. A query response can be generated, for example by identifying and retrieving responsive data from the local data store. The responsive data are related to an artifact on the endpoint computer system and/or to an event of the plurality of events. In some examples, the local data store can be an audit log and/or can include one or more tamper resistant features. Systems, methods, and computer program products are described.Type: GrantFiled: November 17, 2016Date of Patent: July 16, 2019Assignee: Cylance Inc.Inventors: Ryan Permeh, Matthew Wolff, Samuel John Oswald, Xuan Zhao, Mark Culley, Steve Polson
-
Patent number: 10354173Abstract: In one respect, there is provided a system for training a neural network adapted for classifying one or more scripts. The system may include at least one processor and at least one memory. The memory may include program code that provides operations when executed by the at least one memory. The operations may include: extracting, from an icon associated with a file, one or more features; assigning, based at least on the one or more features, the icon to one of a plurality of clusters; and generating, based at least on the cluster to which the icon is assigned, a classification for the file associated with the icon. Related methods and articles of manufacture, including computer program products, are also provided.Type: GrantFiled: November 21, 2016Date of Patent: July 16, 2019Assignee: Cylance Inc.Inventors: Matthew Wolff, Pedro Silva do Nascimento Neto, Xuan Zhao, John Brock, Jian Luan
-
Patent number: 10339305Abstract: In one aspect there is provided a method. The method may include: determining that an executable implements a sub-execution environment, the sub-execution environment being configured to receive an input, and the input triggering at least one event at the sub-execution environment; intercepting the event at the sub-execution environment; and applying a security policy to the intercepted event, the applying of the policy comprises blocking the event, when the event is determined to be a prohibited event. Systems and articles of manufacture, including computer program products, are also provided.Type: GrantFiled: February 24, 2017Date of Patent: July 2, 2019Assignee: Cylance Inc.Inventors: Ryan Permeh, Derek Soeder, Matthew Wolff, Ming Jin, Xuan Zhao
-
Publication number: 20190188381Abstract: In some implementations there may be provided a system. The system may include a processor and a memory. The memory may include program code which causes operations when executed by the processor. The operations may include analyzing a series of events contained in received data. The series of events may include events that occur during the execution of a data object. The series of events may be analyzed to at least extract, from the series of events, subsequences of events. A machine learning model may determine a classification for the received data. The machine learning model may classify the received data based at least on whether the subsequences of events are malicious. The classification indicative of whether the received data is malicious may be provided. Related methods and articles of manufacture, including computer program products, are also disclosed.Type: ApplicationFiled: May 5, 2017Publication date: June 20, 2019Inventors: Xuan Zhao, Aditya Kapoor, Matthew Wolff, Andrew Davis, Derek Soeder, Ryan Permeh
-
Publication number: 20190188375Abstract: Described are techniques to enable computers to efficiently determine if they should run a program based on an immediate (i.e., real-time, etc.) analysis of the program. Such an approach leverages highly trained ensemble machine learning algorithms to create a real-time discernment on a combination of static and dynamic features collected from the program, the computer's current environment, and external factors. Related apparatus, systems, techniques and articles are also described.Type: ApplicationFiled: January 24, 2019Publication date: June 20, 2019Inventors: Ryan Permeh, Derek A. Soeder, Glenn Chisholm, Braden Russell, Gary Golomb, Matthew Wolff, Stuart McClure
-
Publication number: 20190156033Abstract: In one respect, there is provided a system for training a neural network adapted for classifying one or more scripts. The system may include at least one processor and at least one memory. The memory may include program code which when executed by the at least one memory provides operations including: receiving a disassembled binary file that includes a plurality of instructions; processing the disassembled binary file with a convolutional neural network configured to detect a presence of one or more sequences of instructions amongst the plurality of instructions and determine a classification for the disassembled binary file based at least in part on the presence of the one or more sequences of instructions; and providing, as an output, the classification of the disassembled binary file. Related computer-implemented methods are also disclosed.Type: ApplicationFiled: November 7, 2018Publication date: May 23, 2019Inventors: Andrew Davis, Matthew Wolff, Derek A. Soeder, Glenn Chisholm, Ryan Permeh
-
Publication number: 20190138721Abstract: In one aspect, a computer-implemented method is disclosed. The computer-implemented method may include determining a sketch matrix that approximates a matrix representative of a reference dataset. The reference dataset may include at least one computer program having a predetermined classification. A reduced dimension representation of the reference dataset may be generated based at least on the sketch matrix. The reduced dimension representation may have a fewer quantity of features than the reference dataset. A target computer program may be classified based on the reduced dimension representation. The target computer program may be classified to determine whether the target computer program is malicious. Related systems and articles of manufacture, including computer program products, are also disclosed.Type: ApplicationFiled: April 21, 2017Publication date: May 9, 2019Inventors: Michael Wojnowicz, Dinh Huu Nguyen, Andrew Davis, Glenn Chisholm, Matthew Wolff
-
Patent number: 10235518Abstract: Described are techniques to enable computers to efficiently determine if they should run a program based on an immediate (i.e., real-time, etc.) analysis of the program. Such an approach leverages highly trained ensemble machine learning algorithms to create a real-time discernment on a combination of static and dynamic features collected from the program, the computer's current environment, and external factors. Related apparatus, systems, techniques and articles are also described.Type: GrantFiled: February 6, 2015Date of Patent: March 19, 2019Assignee: Cylance Inc.Inventors: Ryan Permeh, Derek A. Soeder, Glenn Chisholm, Braden Russell, Gary Golomb, Matthew Wolff, Stuart McClure
-
Patent number: 10157279Abstract: In one respect, there is provided a system for training a neural network adapted for classifying one or more scripts. The system may include at least one processor and at least one memory. The memory may include program code which when executed by the at least one memory provides operations including: receiving a disassembled binary file that includes a plurality of instructions; processing the disassembled binary file with a convolutional neural network configured to detect a presence of one or more sequences of instructions amongst the plurality of instructions and determine a classification for the disassembled binary file based at least in part on the presence of the one or more sequences of instructions; and providing, as an output, the classification of the disassembled binary file. Related computer-implemented methods are also disclosed.Type: GrantFiled: July 14, 2016Date of Patent: December 18, 2018Assignee: Cylance Inc.Inventors: Andrew Davis, Matthew Wolff, Derek A. Soeder, Glenn Chisholm, Ryan Permeh
-
Publication number: 20180322287Abstract: In some implementations there may be provided a system. The system may include a processor and a memory. The memory may include program code which causes operations when executed by the processor. The operations may include analyzing a series of events contained in received data. The series of events may include events that occur during the execution of a data object. The series of events may be analyzed to at least extract, from the series of events, subsequences of events. A machine learning model may determine a classification for the received data. The machine learning model may classify the received data based at least on whether the subsequences of events are malicious. The classification indicative of whether the received data is malicious may be provided. Related methods and articles of manufacture, including computer program products, are also disclosed.Type: ApplicationFiled: May 5, 2017Publication date: November 8, 2018Inventors: Xuan Zhao, Aditya Kapoor, Matthew Wolff, Andrew Davis, Derek Soeder, Ryan Permeh
-
Publication number: 20180300482Abstract: Under one aspect, a method is provided for protecting a device from a malicious file. The method can be implemented by one or more data processors forming part of at least one computing device and can include extracting from the file, by at least one data processor, sequential data comprising discrete tokens. The method also can include generating, by at least one data processor, n-grams of the discrete tokens. The method also can include generating, by at least one data processor, a vector of weights based on respective frequencies of the n-grams. The method also can include determining, by at least one data processor and based on a statistical analysis of the vector of weights, that the file is likely to be malicious. The method also can include initiating, by at least one data processor and responsive to determining that the file is likely to be malicious, a corrective action.Type: ApplicationFiled: April 18, 2017Publication date: October 18, 2018Inventors: Li Ll, Xuan Zhao, Sepehr Akhavan-Masouleh, John Hendershott Brock, Yaroslav Oliinyk, Matthew Wolff
-
Publication number: 20180203998Abstract: In one respect, there is provided a system for classifying malware. The system may include a data processor and a memory. The memory may include program code that provides operations when executed by the processor. The operations may include: providing, to a display, contextual information associated with a file to at least enable a classification of the file, when a malware classifier is unable to classify the file; receiving, in response to the providing of the contextual information, the classification of the file; and updating, based at least on the received classification of the file, the malware classifier to enable the malware classifier to classify the file. Methods and articles of manufacture, including computer program products, are also provided.Type: ApplicationFiled: January 19, 2017Publication date: July 19, 2018Inventors: Matthew Maisel, Ryan Permeh, Matthew Wolff, Gabriel Acevedo, Andrew Davis, John Brock, Homer Strong, Michael Wojnowicz, Kevin Beets
-
Publication number: 20180157826Abstract: Determining, by a machine learning model in an isolated operating environment, whether a file is safe for processing by a primary operating environment. The file is provided, when the determining indicates the file is safe for processing, to the primary operating environment for processing by the primary operating environment. When the determining indicates the file is unsafe for processing, the file is prevented from being processed by the primary operating environment. The isolated operating environment can be maintained on an isolated computing system remote from a primary computing system maintaining the primary operating system. The isolating computing system and the primary operating system can communicate over a cloud network.Type: ApplicationFiled: February 1, 2018Publication date: June 7, 2018Inventors: Ryan Permeh, Derek A. Soeder, Matthew Wolff, Ming Jin, Xuan Zhao