Abstract: Techniques for using deep learning to identify malicious image files are disclosed. A sample set comprising a plurality of image files is received. A first image file included in the sample set is processed, at least in part by using an image parser to extract a first set of sections of the first image file. The first set of sections includes at least one normal section. A second image file included in the sample is processed, at least in part by using the image parser to extract a second set of sections of the second image file. The second set of sections includes at least one abnormal section. A model is trained using at least a portion of the first set of sections and the second set of sections. The trained model is provided as output and is usable by a security system to determine a likelihood that a target file is malicious.

Abstract: Techniques for identifying vulnerabilities in binary files using a code signature are disclosed. In some embodiments, a system, a process, and/or a computer program product for identifying vulnerabilities in binary files using a code signature includes collecting a plurality of binary files associated with a vulnerability (e.g., a known vulnerability); determining a function in the plurality of binary files that includes the vulnerability; and automatically generating a code signature (e.g., including wildcarding one or more instructions of the function) for detecting the vulnerability in the plurality of binary files.

Abstract: Techniques for providing malicious script detection using transformer-based deep learning are disclosed. In some embodiments, a system/process/computer program product for providing malicious script detection using transformer-based deep learning includes receiving a sample for automated malicious script detection using a computing environment; processing the sample using a transformer model to generate a plurality of embeddings; processing the plurality of embeddings using an attention-based classifier; and generating an output vector to determine that the sample is a malicious script.

Abstract: The present application discloses a method, system, and computer system for identifying function signatures that are used to detect certain types of malware. The method includes: (a) performing disassembly of a plurality of input binaries to generate a set of function signatures, (b) determining a ranking of function signatures for the set of function signatures, and (c) automatically selecting a subset of function signatures for detecting a type of file, wherein the subset of function signatures is selected based at least in part on the ranking of function signatures.

Abstract: Assessments of guardrails of LLMs, whether used by an application or within an AI/LM stack, must be dynamic to protect against the ongoing engineering of jailbreaking prompts. An assessment framework has been created that facilitates assessment of language model guardrails. The assessment framework includes a prompt generator and has access to sensitive data (e.g., source code, trade secret, confidential documents, etc.) that occurs in training data of a model being assessed. The framework provides the prompt generator jailbreaking strategies and categories of the sensitive data (e.g., program code, trade secret, confidential document.). With the data categories and the strategies, the prompt generator generates different prompts and submits them to the AI-powered application or LM stack being assessed. The assessment framework then analyzes the outputs/responses from the AI-powered application or LM stack to determine whether guardrails have been subverted and any of the sensitive data has been exfiltrated.

Abstract: Various embodiments provide a system, method, and device for generating a signature for Windows .NET binaries. The method incudes (i) generate a file signature based on code using a hashing technique, and (ii) classify a sample using the file signature based on the code.

Abstract: Techniques for identifying vulnerabilities in binary files using a code signature are disclosed. In some embodiments, a system, a process, and/or a computer program product for identifying vulnerabilities in binary files using a code signature includes collecting a plurality of binary files associated with a vulnerability (e.g., a known vulnerability); determining a function in the plurality of binary files that includes the vulnerability; and automatically generating a code signature (e.g., including wildcarding one or more instructions of the function) for detecting the vulnerability in the plurality of binary files.

Abstract: Files are classified by file type based on reduced-size representations of the file contents (e.g., truncated versions of files) using a trained convolutional neural network (CNN). The CNN architecture includes a hidden layer comprising a Kolmogorov-Arnold Network (KAN) layer in lieu of a traditional fully connected layer. Training of the CNN employs a cost function that combines cross-entropy loss and contrastive loss for evaluating CNN performance. Training of the CNN is also incremental-when training a CNN for the task of classifying reduced-size files, the CNN is first trained on a training dataset comprising files of their original sizes. Once this initial phase of training is complete, the trained CNN is fine-tuned as a result of one or more additional phases of training, where each additional training phase uses a training dataset comprising reduced-size (e.g., truncated) versions of the files.

Abstract: Content is received for security analysis. At least a portion of the received content is sampled to determine a set of representative tokens. At least the set of representative tokens is embedded to determine a representative embedding. The representative embedding is applied to a machine learning model to classify the received content for the security analysis.

Abstract: The detection of malicious documents using knowledge distillation assisted learning is disclosed. A document is received for maliciousness determination. A likelihood that the received document represents a threat is determined. The determination is made, at least in part, using a raw bytes model that was trained, at least in part, using image model prediction probabilities. A verdict for the document is provided as output based at least in part on the determined likelihood.

Abstract: Provided is a method for preparing isavuconazonium sulfate. Specifically, the preparation method involved comprises: reacting a compound of formula V in the presence of a provided compound having a bisulfate ion so as to obtain isavuconazonium sulfate as shown in formula VI. The preparation method has the advantages of stable intermediate, easy separation and purification, simple operation, high reaction yield, and easy industrial production.

Abstract: Various embodiments provide a system, method, and device for generating a signature for Windows .NET binaries. The method incudes (i) generate a file signature based on code using a hashing technique, and (ii) classify a sample using the file signature based on the code.

Abstract: The detection of malicious documents using knowledge distillation assisted learning is disclosed. A document is received for maliciousness determination. A likelihood that the received document represents a threat is determined. The determination is made, at least in part, using a raw bytes model that was trained, at least in part, using image model prediction probabilities. A verdict for the document is provided as output based at least in part on the determined likelihood.

Abstract: Techniques for using deep learning to identify malicious image files are disclosed. A plurality of sections of a first image are received. The received sections are used to determine a likelihood that the first image is malicious. The determination is made, at least in part, using a model trained using a set of sections extracted from a set of sample images. A verdict is provided for the first image.

Abstract: A system has been created that represents a binary file with a combination of signatures that account for both structure as expressed by control flow and an abstraction of functionality as expressed by import behavior. The system analyses intra-subroutine control flow and calls to import code units. The system generates structure signatures for the subroutines based on the intra-subroutine control flows. The system also generates an import behavior signature based on calls to import code units and caller-callee relationships between the subroutines and the import code units. The system uses the structure signatures to identify the caller subroutines in generating the import behavior signature. The combination of structure signatures and import behavior signature allows for accurate determination of code similarity without the noise of superficial variations in code organization and other mutations or alterations that facilitate avoiding malware detection.

Abstract: The detection of phishing Portable Document Format (PDF) files using an image-based deep learning approach is disclosed. A PDF document is received. A likelihood that the received PDF document represents a threat is determined, at least in part, by using an image based model that was previously trained, at least in part, using a plurality of images that were generated using one or more tools that collectively convert a set of given PDF document files to the respective plurality of images. A verdict for the PDF document is provided as output based at least in part on the determined likelihood.

Abstract: Techniques for identifying vulnerabilities in binary files using a code signature are disclosed. In some embodiments, a system, a process, and/or a computer program product for identifying vulnerabilities in binary files using a code signature includes collecting a plurality of binary files associated with a vulnerability (e.g., a known vulnerability); determining a function in the plurality of binary files that includes the vulnerability; and automatically generating a code signature (e.g., including wildcarding one or more instructions of the function) for detecting the vulnerability in the plurality of binary files.

Abstract: A system has been created that represents a binary file with a combination of signatures that account for both structure as expressed by control flow and an abstraction of functionality as expressed by import behavior. The system analyses intra-subroutine control flow and calls to import code units. The system generates structure signatures for the subroutines based on the intra-subroutine control flows. The system also generates an import behavior signature based on calls to import code units and caller-callee relationships between the subroutines and the import code units. The system uses the structure signatures to identify the caller subroutines in generating the import behavior signature. The combination of structure signatures and import behavior signature allows for accurate determination of code similarity without the noise of superficial variations in code organization and other mutations or alterations that facilitate avoiding malware detection.

Abstract: The detection of phishing Portable Document Format (PDF) files using an image-based deep learning approach is disclosed. A PDF document that includes a Universal Resource Locator is received. A likelihood that the received PDF document represents a phishing threat is determined, at least in part, by using an image based model. A verdict for the PDF document is provided as output based at least in part on the determined likelihood.

Abstract: Various embodiments provide a system, method, and device for generating a signature for Windows .NET binaries. The method incudes (i) generate a file signature based on code using a hashing technique, and (ii) classify a sample using the file signature based on the code.