Abstract: A method at a computing device including fragmenting a malware sample into a plurality of byte strings, each of the plurality of byte strings having a predetermined length; embedding each of the plurality of byte strings in an embedding network to generate a plurality of embeddings; for each embedding in the plurality of embeddings, finding a nearest neighbor; and setting a predicted family for the malware sample based on a fusion of the nearest neighbor for each of the plurality of embeddings.

Abstract: There are provided methods and apparatuses for a control flow execution-guided deep learning framework for binary code vulnerability detection. Reinforcement learning is to enhance the branching decision at every program state transition and create a dynamic environment to learn the dependency between a vulnerability and certain program states. An implicitly defined neural network enables state transition until convergence, which captures the structural information at a higher level.

Abstract: There is provided a method and apparatus for identifying malicious code. The method uses machine learning to compare a new code segment to known code segments of malicious code. Code segments are converted to vectors and the cosine similarity of two vectors is used to identify clones. Techniques to train a neural network for handling very long code sequences and obfuscated malicious code are used.