Abstract: There is provided a method and apparatus for identifying malicious code. The method uses machine learning to compare a new code segment to known code segments of malicious code. Code segments are converted to vectors and the cosine similarity of two vectors is used to identify clones. Techniques to train a neural network for handling very long code sequences and obfuscated malicious code are used.

Abstract: Systems, methods, and software can be used to detect a malware file. In some aspects, a method includes: obtaining features from a binary file to be classified as either a malware file or a non-malware file; inputting the obtained features to a first trained machine learning model; outputting, by the first trained machine learning model, an encoded vector; inputting the encoded vector to a second trained machine learning model, the second trained machine learning model generating text as output; and outputting, by the second trained machine learning model, a human-understandable text explanation of malicious activities that can be performed by the binary file, the human-understandable text explanation being generated without executing the binary file, the text explanation enabling a classification of the binary file.

Abstract: A method at a computing device including fragmenting a malware sample into a plurality of byte strings, each of the plurality of byte strings having a predetermined length; embedding each of the plurality of byte strings in an embedding network to generate a plurality of embeddings; for each embedding in the plurality of embeddings, finding a nearest neighbor; and setting a predicted family for the malware sample based on a fusion of the nearest neighbor for each of the plurality of embeddings.

Abstract: There are provided methods and apparatuses for a control flow execution-guided deep learning framework for binary code vulnerability detection. Reinforcement learning is to enhance the branching decision at every program state transition and create a dynamic environment to learn the dependency between a vulnerability and certain program states. An implicitly defined neural network enables state transition until convergence, which captures the structural information at a higher level.

Abstract: There is provided a method and apparatus for identifying malicious code. The method uses machine learning to compare a new code segment to known code segments of malicious code. Code segments are converted to vectors and the cosine similarity of two vectors is used to identify clones. Techniques to train a neural network for handling very long code sequences and obfuscated malicious code are used.