Patents by Inventor Glenn Chisholm
Glenn Chisholm has filed for patents to protect the following inventions. This listing includes patent applications that are pending as well as patents that have already been granted by the United States Patent and Trademark Office (USPTO).
-
Patent number: 11928213Abstract: In one respect, there is provided a system for training a neural network adapted for classifying one or more scripts. The system may include at least one processor and at least one memory. The memory may include program code which when executed by the at least one memory provides operations including: receiving a disassembled binary file that includes a plurality of instructions; processing the disassembled binary file with a convolutional neural network configured to detect a presence of one or more sequences of instructions amongst the plurality of instructions and determine a classification for the disassembled binary file based at least in part on the presence of the one or more sequences of instructions; and providing, as an output, the classification of the disassembled binary file. Related computer-implemented methods are also disclosed.Type: GrantFiled: March 20, 2020Date of Patent: March 12, 2024Assignee: Cylance Inc.Inventors: Andrew Davis, Matthew Wolff, Derek A. Soeder, Glenn Chisholm, Ryan Permeh
-
Patent number: 11657317Abstract: Under one aspect, a computer-implemented method includes receiving a query at a query interface about whether a computer file comprises malicious code. It is determined, using at least one machine learning sub model corresponding to a type of the computer file, whether the computer file comprises malicious code. Data characterizing the determination are provided to the query interface. Generating the sub model includes receiving computer files at a collection interface. Multiple sub populations of the computer files are generated based on respective types of the computer files, and random training and testing sets are generated from each of the sub populations. At least one sub model for each random training set is generated.Type: GrantFiled: October 20, 2017Date of Patent: May 23, 2023Assignee: Cylance Inc.Inventors: Ryan Permeh, Stuart McClure, Matthew Wolff, Gary Golomb, Derek A. Soeder, Seagen Levites, Michael O'Dea, Gabriel Acevedo, Glenn Chisholm
-
Patent number: 11106790Abstract: In one aspect, a computer-implemented method is disclosed. The computer-implemented method may include determining a sketch matrix that approximates a matrix representative of a reference dataset. The reference dataset may include at least one computer program having a predetermined classification. A reduced dimension representation of the reference dataset may be generated based at least on the sketch matrix. The reduced dimension representation may have a fewer quantity of features than the reference dataset. A target computer program may be classified based on the reduced dimension representation. The target computer program may be classified to determine whether the target computer program is malicious. Related systems and articles of manufacture, including computer program products, are also disclosed.Type: GrantFiled: April 21, 2017Date of Patent: August 31, 2021Assignee: Cylance Inc.Inventors: Michael Wojnowicz, Dinh Huu Nguyen, Andrew Davis, Glenn Chisholm, Matthew Wolff
-
Patent number: 10817599Abstract: Described are techniques to enable computers to efficiently determine if they should run a program based on an immediate (i.e., real-time, etc.) analysis of the program. Such an approach leverages highly trained ensemble machine learning algorithms to create a real-time discernment on a combination of static and dynamic features collected from the program, the computer's current environment, and external factors. Related apparatus, systems, techniques and articles are also described.Type: GrantFiled: January 24, 2019Date of Patent: October 27, 2020Assignee: Cylance Inc.Inventors: Ryan Permeh, Derek A. Soeder, Glenn Chisholm, Braden Russell, Gary Golomb, Matthew Wolff, Stuart McClure
-
Publication number: 20200218807Abstract: In one respect, there is provided a system for training a neural network adapted for classifying one or more scripts. The system may include at least one processor and at least one memory. The memory may include program code which when executed by the at least one memory provides operations including: receiving a disassembled binary file that includes a plurality of instructions; processing the disassembled binary file with a convolutional neural network configured to detect a presence of one or more sequences of instructions amongst the plurality of instructions and determine a classification for the disassembled binary file based at least in part on the presence of the one or more sequences of instructions; and providing, as an output, the classification of the disassembled binary file. Related computer-implemented methods are also disclosed.Type: ApplicationFiled: March 20, 2020Publication date: July 9, 2020Inventors: Andrew Davis, Matthew Wolff, Derek A. Soeder, Glenn Chisholm, Ryan Permeh
-
Patent number: 10691799Abstract: Using a recurrent neural network (RNN) that has been trained to a satisfactory level of performance, highly discriminative features can be extracted by running a sample through the RNN, and then extracting a final hidden state hh where i is the number of instructions of the sample. This resulting feature vector may then be concatenated with the other hand-engineered features, and a larger classifier may then be trained on hand-engineered as well as automatically determined features. Related apparatus, systems, techniques and articles are also described.Type: GrantFiled: April 15, 2016Date of Patent: June 23, 2020Assignee: Cylance Inc.Inventors: Andrew Davis, Matthew Wolff, Derek A. Soeder, Glenn Chisholm
-
Patent number: 10635814Abstract: In one respect, there is provided a system for training a neural network adapted for classifying one or more scripts. The system may include at least one processor and at least one memory. The memory may include program code which when executed by the at least one memory provides operations including: receiving a disassembled binary file that includes a plurality of instructions; processing the disassembled binary file with a convolutional neural network configured to detect a presence of one or more sequences of instructions amongst the plurality of instructions and determine a classification for the disassembled binary file based at least in part on the presence of the one or more sequences of instructions; and providing, as an output, the classification of the disassembled binary file. Related computer-implemented methods are also disclosed.Type: GrantFiled: November 7, 2018Date of Patent: April 28, 2020Assignee: Cylance Inc.Inventors: Andrew Davis, Matthew Wolff, Derek A. Soeder, Glenn Chisholm, Ryan Permeh
-
Patent number: 10558804Abstract: Using a recurrent neural network (RNN) that has been trained to a satisfactory level of performance, highly discriminative features can be extracted by running a sample through the RNN, and then extracting a final hidden state hi, where i is the number of instructions of the sample. This resulting feature vector may then be concatenated with the other hand-engineered features, and a larger classifier may then be trained on hand-engineered as well as automatically determined features. Related apparatus, systems, techniques and articles are also described.Type: GrantFiled: August 12, 2016Date of Patent: February 11, 2020Assignee: Cylance Inc.Inventors: Andrew Davis, Matthew Wolff, Derek A. Soeder, Glenn Chisholm, Ryan Permeh
-
Publication number: 20190188375Abstract: Described are techniques to enable computers to efficiently determine if they should run a program based on an immediate (i.e., real-time, etc.) analysis of the program. Such an approach leverages highly trained ensemble machine learning algorithms to create a real-time discernment on a combination of static and dynamic features collected from the program, the computer's current environment, and external factors. Related apparatus, systems, techniques and articles are also described.Type: ApplicationFiled: January 24, 2019Publication date: June 20, 2019Inventors: Ryan Permeh, Derek A. Soeder, Glenn Chisholm, Braden Russell, Gary Golomb, Matthew Wolff, Stuart McClure
-
Publication number: 20190156033Abstract: In one respect, there is provided a system for training a neural network adapted for classifying one or more scripts. The system may include at least one processor and at least one memory. The memory may include program code which when executed by the at least one memory provides operations including: receiving a disassembled binary file that includes a plurality of instructions; processing the disassembled binary file with a convolutional neural network configured to detect a presence of one or more sequences of instructions amongst the plurality of instructions and determine a classification for the disassembled binary file based at least in part on the presence of the one or more sequences of instructions; and providing, as an output, the classification of the disassembled binary file. Related computer-implemented methods are also disclosed.Type: ApplicationFiled: November 7, 2018Publication date: May 23, 2019Inventors: Andrew Davis, Matthew Wolff, Derek A. Soeder, Glenn Chisholm, Ryan Permeh
-
Publication number: 20190138721Abstract: In one aspect, a computer-implemented method is disclosed. The computer-implemented method may include determining a sketch matrix that approximates a matrix representative of a reference dataset. The reference dataset may include at least one computer program having a predetermined classification. A reduced dimension representation of the reference dataset may be generated based at least on the sketch matrix. The reduced dimension representation may have a fewer quantity of features than the reference dataset. A target computer program may be classified based on the reduced dimension representation. The target computer program may be classified to determine whether the target computer program is malicious. Related systems and articles of manufacture, including computer program products, are also disclosed.Type: ApplicationFiled: April 21, 2017Publication date: May 9, 2019Inventors: Michael Wojnowicz, Dinh Huu Nguyen, Andrew Davis, Glenn Chisholm, Matthew Wolff
-
Patent number: 10235518Abstract: Described are techniques to enable computers to efficiently determine if they should run a program based on an immediate (i.e., real-time, etc.) analysis of the program. Such an approach leverages highly trained ensemble machine learning algorithms to create a real-time discernment on a combination of static and dynamic features collected from the program, the computer's current environment, and external factors. Related apparatus, systems, techniques and articles are also described.Type: GrantFiled: February 6, 2015Date of Patent: March 19, 2019Assignee: Cylance Inc.Inventors: Ryan Permeh, Derek A. Soeder, Glenn Chisholm, Braden Russell, Gary Golomb, Matthew Wolff, Stuart McClure
-
Patent number: 10157279Abstract: In one respect, there is provided a system for training a neural network adapted for classifying one or more scripts. The system may include at least one processor and at least one memory. The memory may include program code which when executed by the at least one memory provides operations including: receiving a disassembled binary file that includes a plurality of instructions; processing the disassembled binary file with a convolutional neural network configured to detect a presence of one or more sequences of instructions amongst the plurality of instructions and determine a classification for the disassembled binary file based at least in part on the presence of the one or more sequences of instructions; and providing, as an output, the classification of the disassembled binary file. Related computer-implemented methods are also disclosed.Type: GrantFiled: July 14, 2016Date of Patent: December 18, 2018Assignee: Cylance Inc.Inventors: Andrew Davis, Matthew Wolff, Derek A. Soeder, Glenn Chisholm, Ryan Permeh
-
Patent number: 9946876Abstract: A plurality of data files is received. Thereafter, each file is represented as an entropy time series that reflects an amount of entropy across locations in code for such file. A wavelet transform is applied, for each file, to the corresponding entropy time series to generate an energy spectrum characterizing, for the file, an amount of entropic energy at multiple scales of code resolution. It can then be determined, for each file, whether or not the file is likely to be malicious based on the energy spectrum. Related apparatus, systems, techniques and articles are also described.Type: GrantFiled: August 12, 2016Date of Patent: April 17, 2018Assignee: Cylance Inc.Inventors: Michael Wojnowicz, Glenn Chisholm, Matthew Wolff, Derek A. Soeder, Xuan Zhao
-
Publication number: 20180101681Abstract: Using a recurrent neural network (RNN) that has been trained to a satisfactory level of performance, highly discriminative features can be extracted by running a sample through the RNN, and then extracting a final hidden state hh where i is the number of instructions of the sample. This resulting feature vector may then be concatenated with the other hand-engineered features, and a larger classifier may then be trained on hand-engineered as well as automatically determined features. Related apparatus, systems, techniques and articles are also described.Type: ApplicationFiled: April 15, 2016Publication date: April 12, 2018Inventors: Andrew Davis, Matthew Wolff, Derek A. Soeder, Glenn Chisholm
-
Publication number: 20180060760Abstract: Under one aspect, a computer-implemented method includes receiving a query at a query interface about whether a computer file comprises malicious code. It is determined, using at least one machine learning sub model corresponding to a type of the computer file, whether the computer file comprises malicious code. Data characterizing the determination are provided to the query interface. Generating the sub model includes receiving computer files at a collection interface. Multiple sub populations of the computer files are generated based on respective types of the computer files, and random training and testing sets are generated from each of the sub populations. At least one sub model for each random training set is generated.Type: ApplicationFiled: October 20, 2017Publication date: March 1, 2018Inventors: Ryan Permeh, Stuart McClure, Matthew Wolff, Gary Golomb, Derek A. Soeder, Seagen Levites, Michael O'Dea, Gabriel Acevedo, Glenn Chisholm
-
Publication number: 20170017793Abstract: In one respect, there is provided a system for training a neural network adapted for classifying one or more scripts. The system may include at least one processor and at least one memory. The memory may include program code which when executed by the at least one memory provides operations including: receiving a disassembled binary file that includes a plurality of instructions; processing the disassembled binary file with a convolutional neural network configured to detect a presence of one or more sequences of instructions amongst the plurality of instructions and determine a classification for the disassembled binary file based at least in part on the presence of the one or more sequences of instructions; and providing, as an output, the classification of the disassembled binary file. Related computer-implemented methods are also disclosed.Type: ApplicationFiled: July 14, 2016Publication date: January 19, 2017Inventors: Andrew Davis, Matthew Wolff, Derek A. Soeder, Glenn Chisholm, Ryan Permeh
-
Publication number: 20160378984Abstract: A plurality of data files is received. Thereafter, each file is represented as an entropy time series that reflects an amount of entropy across locations in code for such file. A wavelet transform is applied, for each file, to the corresponding entropy time series to generate an energy spectrum characterizing, for the file, an amount of entropic energy at multiple scales of code resolution. It can then be determined, for each file, whether or not the file is likely to be malicious based on the energy spectrum. Related apparatus, systems, techniques and articles are also described.Type: ApplicationFiled: August 12, 2016Publication date: December 29, 2016Inventors: Michael Wojnowicz, Glenn Chisholm, Matthew Wolff, Derek A. Soeder, Xuan Zhao
-
Publication number: 20160350532Abstract: Using a recurrent neural network (RNN) that has been trained to a satisfactory level of performance, highly discriminative features can be extracted by running a sample through the RNN, and then extracting a final hidden state hi, where i is the number of instructions of the sample. This resulting feature vector may then be concatenated with the other hand-engineered features, and a larger classifier may then be trained on hand-engineered as well as automatically determined features. Related apparatus, systems, techniques and articles are also described.Type: ApplicationFiled: August 12, 2016Publication date: December 1, 2016Inventors: Andrew Davis, Matthew Wolff, Derek A. Soeder, Glenn Chisholm, Ryan Permeh
-
Patent number: 9495633Abstract: Using a recurrent neural network (RNN) that has been trained to a satisfactory level of performance, highly discriminative features can be extracted by running a sample through the RNN, and then extracting a final hidden state hi, where i is the number of instructions of the sample. This resulting feature vector may then be concatenated with the other hand-engineered features, and a larger classifier may then be trained on hand-engineered as well as automatically determined features. Related apparatus, systems, techniques and articles are also described.Type: GrantFiled: July 1, 2015Date of Patent: November 15, 2016Assignee: CYLANCE, INC.Inventors: Andrew Davis, Matthew Wolff, Derek A. Soeder, Glenn Chisholm, Ryan Permeh