Determining similarity samples using machine learning operations

Abstract

The invention relates to determining similarity samples using machine learning operations. Systems, methods, and software may be used to determine similarity samples. In some aspects, a method includes obtaining a first feature vector for a sample; the first feature vector is processed through a plurality of dimension reduction processes, each dimension reduction process in the plurality of dimension reduction processes generates a corresponding second feature vector, and each second feature vector in the second feature vectors has a dimension smaller than that of the first feature vector; for each second feature vector in the second feature vectors, determining an intermediate set of similarity samples; and aggregating the intermediate set of similarity samples to generate an output set of similarity samples.

Description

[0001] CROSS-REFERENCE TO RELATED APPLICATIONS

[0002] This application claims the benefit of U.S. Application Serial No. 18 / 482,251, filed on October 6, 2023. The disclosure of the prior application is considered part of (and incorporated by reference into) the disclosure of the present application. Technical Field

[0003] The present disclosure relates to determining similarity samples by using machine learning operations. Background Art

[0004] Similarity analysis refers to the process of searching for samples that are similar to a given input sample. In one example, similarity analysis can be used to determine whether software code is likely to be malicious by comparing it to a sample set. The sample set may include software code with known security risks. In another example, similarity analysis can be used in an imaging process to select an image that is close to an input image. In some cases, machine learning operations such as a k-nearest neighbor (k-NN) algorithm can be used to perform similarity analysis. BRIEF DESCRIPTION OF THE DRAWINGS

[0005] Figure 1 is a schematic diagram illustrating an example system for determining similarity samples according to an implementation.

[0006] Figure 2 is a flow chart illustrating example operations for determining similarity samples according to an implementation.

[0007] Figure 3 is a schematic diagram illustrating an example method of determining similarity samples according to an implementation.

[0008] Figure 4 A high-level architectural block diagram of a computer according to an implementation is illustrated.

[0009] Like reference numbers and designations throughout the various drawings indicate like elements. DETAILED DESCRIPTION

[0010] In some implementations, similarity analysis can be performed by converting the input sample into a feature vector and searching for neighbor vectors in previously stored training samples to determine a set of similar samples. These training samples may also be referred to as base samples or base training samples. However, as the dimensionality of the feature vector increases, this analysis may become very expensive or computationally intractable.

[0011] In some cases, dimensionality reduction techniques can be used to reduce the number of features, thereby reducing the computational complexity of the operation. Examples of dimensionality reduction techniques include deterministic techniques and stochastic techniques. In one example of a stochastic technique, a random projection matrix can be used to reduce the dimension of the feature vector. However, this technique often leads to errors in the prediction results. In particular, when the degree of dimensionality is significantly reduced, the prediction error may also be large. For example, in a similarity analysis performed using a random projection matrix with significant dimensionality reduction, such as a dimensionality reduction of 100 times or more, the prediction accuracy is reduced to about 17%.

[0012] In some operations, similarity analysis can be performed by using multiple dimensionality reduction processes. Each of the multiple dimensionality reduction processes is performed in parallel and produces a corresponding intermediate set of similarity samples. These intermediate sets of similarity samples can be aggregated to generate an output set. This method maintains the benefits of reducing complexity discussed previously while improving prediction accuracy. In some cases, accuracy is improved by multiple foldings. Figures 1 to 4 and associated descriptions provide additional details of these implementations.

[0013] Figure 1 is a diagram illustrating an example system 100 for determining similarity samples according to an implementation. At a high level, the example system 100 includes a server 106 communicatively coupled to a client device 102 via a network 110 .

[0014] The client device 102 represents an electronic device that provides a sample to be analyzed. In some cases, the client device 102 can send the sample to the server 106 for similarity analysis. Alternatively or additionally, the client device 102 can generate a feature vector of the sample and send the feature vector to the server 106 for similarity analysis. In some cases, the server 106 can send the output of the similarity analysis to the client device 102.

[0015] Server 106 represents an application, application set, software, software module, hardware or any combination thereof that determines similarity samples. Server 106 can be an application server, a service provider or any other network entity. Server 106 can be implemented using one or more computers, computer servers or cloud computing platforms. Server 106 can be used to train a machine learning model used in a similarity sample determination operation. Server 106 includes a similarity analyzer 104. Similarity analyzer 104 represents an application, application set, software, software module, hardware or any combination thereof that determines similarity samples. In some implementations, similarity analyzer 104 can receive an input sample, generate a feature vector of the input sample, process the feature vector through a plurality of dimensionality reduction processes, determine an intermediate set of a plurality of similarity samples, and aggregate the intermediate set of a plurality of similarity samples to generate an output set of similarity samples. Figures 2 to 4 and associated descriptions provide additional details of these implementations.

[0016] Similarity analysis can be performed for different purposes. For example, similarity analysis can be performed for software code analysis. In this example, the input sample can be a software code. The software code can be a source code or a binary code. In the software development process, a programmer can create the source code using a text editor or a visual programming tool before compiling. The source code can be developed in a human-readable programming language and can be saved in a text file. The source code can be transformed by an assembler or compiler into a binary software code that can be executed by a computer. In some cases, the source code can be generated by an automated tool, such as an artificial intelligence driven by a large language model.

[0017] Binary software code may include a byte stream generated by compiling source code. Therefore, the binary software code may not be in a human-readable format and may not be easily parsed or analyzed by humans.

[0018] Binary software code can be a configuration of object code, executable code, or bytecode. Object code is the product of compiler output of a series of statements or instructions in a computer language. Source code can be logically divided into multiple source files. Each source file is independently compiled into a corresponding target file including object code. The object code in the target file is binary machine code, but they may not be ready to be executed. The target file may include incomplete references to its own external subroutines and placeholder addresses. During the linking process, these target files can be linked together to form an executable file, which includes executable code that can be executed on a computing device. During the linking process, the linker can read the target files, dissociate the references between them, perform the final code layout in the memory to determine the addresses of the code and data blocks, fix the placeholder addresses with the real addresses, and write out the executable file containing the executable code.

[0019] Bytecode, also known as portable code or p-code, is a form of instruction set designed for efficient implementation of software interpreters. Bytecode includes compact digital code, constants and references (usually digital addresses), which encode the results of compiler parsing and perform semantic analysis on things such as the type, scope and nesting depth of program objects. Bytecode includes an instruction set with a one-byte opcode and optional parameters. Intermediate representations such as bytecodes can be output by programming language implementations to simplify interpretation, or can be used to reduce dependence on hardware and operating systems by allowing the same code to run across platforms on different devices. Bytecode can usually be implemented directly on a virtual machine (p-code machine, i.e., interpreter), or it can be further compiled into machine code to obtain better performance. In some cases, binary software code encoded using a platform-independent language such as JAVA can be stored in bytecode format.

[0020] In this case, the client device 102 may be a device that receives or generates software code for analysis. The server 106 may be a software service platform that performs similarity analysis on the software code to compare it with a pre-stored set of software code samples.

[0021] Applications of software similarity analysis include, but are not limited to, malware (malware) classification, malware family identification, identification of different versions of the same software, identification of software authors, identification of malware as part of a specific attack campaign, identification of whitelisted or blacklisted software samples, and grouping of files based on software complexity. Similarity analysis can be performed for other purposes, such as image analysis, video or audio recognition, natural language processing, etc.

[0022] Turning to a general description, the client device 102 may include, but is not limited to, any of the following: an endpoint, a computing device, a mobile device, a mobile electronic device, a user device, a mobile station, a subscriber station, a portable electronic device, a mobile communication device, a wireless modem, a wireless terminal, or another electronic device. Examples of endpoints may include a mobile device, an IoT (Internet of Things) device, an EoT (Enterprise of Things) device, a cellular phone, a personal data assistant (PDA), a smart phone, a laptop, a tablet computer, a personal computer (PC), a pager, a portable computer, a portable gaming device, a wearable electronic device, a health / medical / fitness device, a camera, a vehicle, or other mobile communication device having a component for transmitting voice or data via a wireless communication connection. Vehicles may include motor vehicles (e.g., automobiles, cars, trucks, buses, motorcycles, etc.), aircraft (e.g., airplanes, drones, unmanned aircraft systems, drones, helicopters, etc.), spacecraft (e.g., space shuttles, spacecraft, space capsules, space stations, satellites, etc.), vessels (e.g., ships, boats, hovercraft, submarines, etc.), rail vehicles (e.g., trains, trams, etc.), and other types of vehicles, including any combination of any of the foregoing, whether currently existing or later appearing. The wireless communication network may include wireless links through at least one of a licensed spectrum and an unlicensed spectrum. The term "mobile device" may also refer to any hardware or software component that can terminate a communication session of a user. In addition, the terms "user equipment", "UE", "user equipment device", "user agent", "UA", "user device" and "mobile device" may be used interchangeably herein.

[0023] Example system 100 includes network 110. Network 110 represents an application, a set of applications, software, a software module, hardware, or a combination thereof that can be configured to send data messages between entities in example system 100. Network 110 may include a wireless network, a wired network, the Internet, or a combination thereof. For example, network 110 may include one or more radio access networks (RANs), a core network (CN), and the Internet. RAN may include one or more radio access technologies. In some implementations, the radio access technology may be a global system for mobile communications (GSM), interim standard 95 (IS-95), a universal mobile telecommunications system (UMTS), CDMA2000 (code division multiple access), an evolved universal mobile telecommunications system (E-UMTS), long term evaluation (LTE), advanced LTE, a fifth generation (5G), or any other radio access technology. In some instances, the core network may be an evolved packet core (EPC).

[0024] The RAN is a part of a wireless telecommunication system that implements radio access technologies such as UMTS, CDMA2000, 3GPP LTE, 3GPP LTE-A and 5G. In many applications, the RAN includes at least one base station. A base station may be a radio base station that can control all or at least some radio-related functions of the fixed part of the system. A base station may provide a radio interface within its coverage area or cell for mobile devices to communicate. Base stations may be distributed throughout a cellular network to provide wide coverage. A base station communicates directly with one or more mobile devices, other base stations, and one or more core network nodes.

[0025] although Figure 1 The elements are shown as including various component parts, portions or modules that implement various features and functionalities, however, these elements may appropriately include multiple sub-modules, third-party services, components, libraries, etc. In addition, the features and functionality of various components may be appropriately combined into fewer components.

[0026] Figure 2 is a flow chart illustrating an example operation 200 for generating a similarity sample according to an implementation. The example operation 200 may be implemented by a server, such as Figure 1 The server 106 implementation is shown. Figure 2 The example operations 200 shown may be implemented using additional, fewer, or different operations, which may be performed in the order shown or in a different order.

[0027] In 210, a vectorization process is performed on the sample 202 to generate a first vector 212. The sample 202 may be a software code, such as a document file, executable code, or a script. In some cases, different vectorization programs may be used for different types of samples 202. The sample 202 may also be other forms of data samples to be evaluated in the similarity analysis. The vectorization process converts the sample 202 into a vector representation. In some cases, a feature extraction algorithm may be used to perform the vectorization process. For example, a vector may be generated based on the features of the sample 202. If the sample 202 is a software code, the features of the software code may be the content or characteristics of the software code. Examples of features include file size, file format, file type (e.g., whether the software code is binary or source code), file content (part or all of the software code), associated operating system or programming environment, the number of specific strings included in the code, the structure of the code (e.g., the order of the instruction set), signature, checksum, etc. The information of the software code may be obtained from metadata associated with the code, from a preprocessing operation that scans the software code and automatically extracts feature information from the code, or from both. If the sample 202 is an image, the characteristics of the image may include image size, resolution, color distribution, and other information.

[0028] In some operations, each feature can be converted to a numerical value in integer or floating point format. The numerical values ​​can be cascaded into one or more feature vectors. Alternatively or additionally, the numerical values ​​can be combined or transformed to generate one or more feature vectors. Examples of transformation or combination techniques include multiplication, addition, through nonlinear transformation functions (e.g., Fourier, rectification, etc.).

[0029] In some cases, first vector 212 has a large dimension to preserve features in sample 202. In some cases, the dimension may be in the millions or even billions.

[0030] At 220, a plurality of dimensionality reduction processes are performed on the first vector 212. Figure 2 As shown, each of the plurality of dimensionality reduction processes (eg, 220a, 220b, and 220c) generates a corresponding second vector, namely, 222a, 222b, and 222c. Figure 2 Only 3 second vectors resulting from the three-dimensional reduction process are shown, but other numbers of dimensionality reduction processes may be configured, such as 10 or more.

[0031] In the random projection process, the original M-dimensional input vector is projected into an N-dimensional subspace by using an MxN matrix called a random matrix P. For example, the output vector can be obtained by multiplying the input vector by P. N is smaller than M. In some cases, N can be several orders of magnitude smaller than M, for example, N can be smaller than M by 100, 1000, 10000, or more. The random matrix P can be generated using a Gaussian distribution. The following is an example process for generating the random matrix P: The first line is from S M-1 A random unit vector uniformly selected from , where S represents the field of the input vector. The second row is a random unit vector from a space orthogonal to the first row, the third row is a random unit vector from a space orthogonal to the first two rows, and the process is repeated until the last row is generated. In some cases, the random projections can be further compressed by quantizing with 1 or more bits. In some cases, the random projections can also be normalized. In one example, the random matrix P can be generated by the following steps: for each row, a single element is randomly selected and set to 1 or -1. In some cases, a random function can be used to determine whether the selected element is set to 1 or -1. The other elements of the row are set to 0. Repeat this process for each row to generate the matrix P.

[0032] In some implementations, multiple random projection matrices (e.g., Pa, Pb, Pc, etc.) can be generated by repeating the previously discussed process. In these cases, each random projection matrix is ​​generated using a different random seed or random function or both, so these different random projection matrices are different. Each of the random projection matrices has the same dimensionality reduction properties, i.e., from M to N, but the values ​​of each element in the matrix are different. In another example, each of the random projection matrices may have different dimensionality reduction properties, for example, the value of N may be different for different matrices.

[0033] Therefore, by multiplying the input vector, ie, the first vector 212, with each of the random projection matrices, different output vectors, ie, second vectors 222a, 222b, and 222c may be generated.

[0034] In 230, an intermediate similarity analysis is performed. As illustrated, similarity analysis 230a, 230b, and 230c is performed on respective second vectors, namely second vectors 222a, 222b, and 222c, to generate respective intermediate sets 232a, 232b, and 232c.

[0035] In some cases, a similarity analysis can be performed on the second vector using a k-nearest neighbor algorithm (k-NN). In an example k-NN algorithm, the distance between the input data point and the training sample index is calculated. Examples of distances used for calculation can be Euclidean distance, Hamming distance, or other metrics, including, for example, cosine similarity. Then, the k nearest neighbors of the input data point are identified. The k-NN algorithm used to perform the similarity analysis can be an exact k-NN algorithm or an approximate k-NN algorithm.

[0036] In this operation, the base training samples are processed using the same random projection process discussed previously (e.g., multiplied by random projection matrices Pa, Pb, Pc, respectively) to generate different index sets for the corresponding k-NN models of the process. In some cases, these index sets can be generated during the training phase and stored on the server before operation 200 begins. The training phase can be performed by the server or another device or platform. For similarity analysis 230a, the second vector 222a is used as an input data point for the corresponding k-NN model. The distance between the second vector 222a and the index of the corresponding k-NN model is calculated, and an intermediate set 232a of similarity samples is determined. In some cases, the samples in the intermediate set of similarity samples are k base training samples whose indexes have the shortest distance to the second vector 222a. The same process is repeated for other second vectors and their corresponding k-NN models to generate intermediate sets 232b and 232c of similarity samples.

[0037] In 240, intermediate sets 232a, 232b, and 232c of similarity samples are aggregated to generate output set 242. Different aggregation techniques can be used. In one example, multiple occurrences can be used as a criterion for selecting samples in output set 242. Similarity samples in intermediate sets 232a, 232b, and 232c are checked. Some basic samples may appear in more than one intermediate set. A preset threshold number can be configured. For example, if the preset threshold number is configured to 2, all basic samples that appear in 2 or more intermediate sets are placed in output set 242.

[0038] In another example, distance can be used as a criterion. For each sample included in the intermediate set 232a, 232b and 232c, the distance between the sample and the corresponding input vector (i.e., the second vector 222a, 222b or 222c) is compared, and the first X number of samples with the shortest distance are selected as the samples in the output set 242, where X is the number of samples in the output set 242. The distance can be a distance in the projection space. For each intermediate set, the samples in the intermediate set are processed with the same random projection process discussed previously (e.g., multiplied by the random projection matrix Pa, Pb or Pc) to generate the projected sample vectors of the corresponding samples in the intermediate set, and the distance between these projected sample vectors and the corresponding input vector (i.e., the second vector 222a, 222b or 222c) is calculated and used as a criterion. For example, the output set 242 can be formed by selecting the X samples with the shortest distance in the samples in the intermediate set 232a, 232b and 232c. X can be configured by a user, an administrator or other operator or an algorithm. Alternatively or in combination, the output set 242 can be formed by selecting samples below a configured threshold in the intermediate sets 232a, 232b, and 232c. In some cases, the distance of each intermediate set can be normalized before the comparison and selection process discussed previously. For example, in each projection space (i.e., processed by the corresponding random projection process), the shortest distance between the projection vector of the sample and the corresponding input vector (i.e., the second vector 222a, 222b, or 222c) is identified and used to divide the distance between the projection vector of the sample and the corresponding input vector to generate the normalized distance of the set. The normalized distance is used for the distance-based aggregation process. Additionally or alternatively, in the case where the dimensions of each projection space are different from each other, a normalization procedure can be performed based on the dimensions of each projection space. For example, the distance in each projection space can be divided by the square root of the number of dimensions in the space. In addition, the normalization process may depend on the mechanism of the random projection, such as whether the rows / columns of the projection matrix themselves are normalized. If the rows and columns of the projection matrix are not themselves normalized, then the distances in the projection space are also normalized. If the rows or columns of the projection matrix are normalized, then no normalization is performed.

[0039] Alternatively, the distance may be a distance in the original space. The distance between the input sample 202 and all samples in the intermediate set is calculated. The output set 242 may be formed based on the distance in the original space, for example by selecting a configured number of samples having the shortest distance among the samples, by selecting samples below a configured threshold, or a combination thereof.

[0040] Alternatively or additionally, multiple criteria can be used in combination to determine output set 242. For example, multiple occurrence factors can be assigned to each basic sample in intermediate set 232a, 232b and 232c based on the number of intermediate sets in which the basic sample occurs. Each basic sample in intermediate set 232a, 232b and 232c can also be assigned a distance factor based on the normalized distance with the corresponding second vector. Each factor can be multiplied by the corresponding weight and summed to calculate the total score of the basic sample. The basic samples can be sorted based on their total score, and the first X basic samples can be selected to form output set 242.

[0041] In some cases, the previously discussed dimensionality reduction operation can be used in combination with other dimensionality reduction techniques. Examples of other dimensionality reduction techniques include principal component analysis, lasso regression, autoencoders, etc. In some cases, different dimensionality reduction techniques can be used for data samples with different types or formats. For example, an autoencoder model can be trained for executable code, and another autoencoder model can be trained for document files. In one example, these other dimensionality reduction techniques can be performed after step 210 and before step 220. In this example, these other dimensionality reduction techniques are performed to the first vector 212 to generate the first dimensionality reduction vector, and the first dimensionality reduction vector is used as the input of step 220 to perform random dimensionality reduction. In another example, these other dimensionality reduction techniques can be performed after step 220. In this example, these other dimensionality reduction techniques are performed to the second vector 222a, 222b and 222c to generate the second dimensionality reduction vector, and the second dimensionality reduction vector is used as the input of step 230 to perform intermediate similarity analysis.

[0042] In some cases, output set 242 can be output at a user interface of a server performing the analysis. Other information, such as multiple occurrence information, distance information, or a combination, can also be provided. Alternatively or additionally, output set 242 can be sent to different devices for output. Other information (such as multiple occurrence information, distance information, or a combination) can also be sent to different devices.

[0043] In a classification operation, the class of an input data point can be determined based on a majority vote of the class labels of the k nearest neighbors. In a regression operation, the average or weighted average of the target values ​​of the K neighbors can be calculated to determine the target value of the input data point.

[0044] In some cases, the classification operation or regression operation of k-NN can be performed after the output set 242 is generated. For example, each base sample in the output set 242 has a classification label, and the classification of the sample 202 can be determined based on a majority vote of these base samples. In one implementation, operation 200 can be used to determine the security status of the software code. In these cases, the input sample can be software code, and the classification label can include "safe" or "potentially malicious". Alternatively or additionally, the classification label can also indicate different risk levels of malicious potential. In these cases, the determined classification label can also be output or sent to another device for output.

[0045] In another implementation, operation 200 may be used for image processing. In these cases, the input sample may be an example image, and the base samples in output set 242 may be used to search for a target image that is close to the example image. In these cases, the retrieved target image may also be output or sent to another device for output.

[0046] Figure 3 is a flow chart showing an example method 300 for generating similarity samples according to an implementation. The example method 300 may be implemented by a server, for example, by Figure 1 The server 106 implementation is shown. Figure 3 The illustrated example method 300 may be implemented using additional, fewer, or different operations, which may be performed in the order illustrated or in a different order.

[0047] In 310, a first feature vector of the sample is obtained. The first feature vector of the sample can be obtained using Figure 2 In some cases, the first feature vector of the sample is generated by a server that performs a similarity analysis after the server receives the sample. Alternatively or additionally, the first feature vector of the sample is generated by another device and sent to the server 106 for similarity analysis.

[0048] In 320, the server processes the first feature vector through a plurality of dimensionality reduction processes. Each of the plurality of dimensionality reduction processes generates a corresponding second feature vector, each of the second feature vectors having a dimension smaller than a dimension of the first feature vector.

[0049] In 330 , for each of the second feature vectors, the server determines an intermediate set of similarity samples.

[0050] At 340 , the server aggregates the intermediate set of similarity samples to generate an output set of similarity samples.

[0051] Figure 4 400 is a block diagram of a high-level architecture of a computer 400 according to an implementation. The computer 400 may be implemented as Figure 1 The computer 400 can also be used to implement Figures 2 to 3 The operations discussed in the description are merely one possible implementation of the subject matter described and are not intended to limit the disclosure to a single described implementation. One of ordinary skill in the art will appreciate the fact that the described components may be connected, combined, and / or used in alternative ways consistent with the disclosure.

[0052] In some cases, the processing algorithms established by the code package can be implemented in executable computing code, such as C / C++ executable code. In some cases, the computer 400 can include a standalone Linux system running a batch application. In some cases, the computer 400 can include a mobile or personal computer.

[0053] Computer 400 may include a computer that includes input devices such as a keypad, keyboard, touch screen, microphone, voice recognition device, other devices that can accept user information and / or output devices that convey information associated with computer operation (including digital data, visual and / or audio information or GUI).

[0054] The computer 400 may function as a client, a network component, a server, a database or other persistence and / or any other component. In some implementations, one or more components of the computer 400 may be configured to operate within a cloud computing-based environment.

[0055] At a high level, the computer 400 is an electronic computing device operable to receive, send, process, store or manage data. According to some implementations, the computer 400 may also include, or be communicatively coupled to, an application server, an email server, a web server, a cache server, a streaming data server, a business intelligence (BI) server and / or other servers.

[0056] Computer 400 may collect data of web events or mobile application usage events from a web browser or client application (e.g., installed plug-in) over network 110. Additionally, computer 400 may collect data from internal users (e.g., from a command console or through another appropriate access method), external or third parties, other automated applications, and any other appropriate entity, person, system, or computer.

[0057] Each of the components of the computer 400 can communicate using the system bus 412. In some implementations, any and / or all components (including hardware and / or software) of the computer 400 can interface with each other and / or interface 402 through the system bus 412 using an application programming interface (API) 408 and / or a service layer 410. The API 408 may include specifications for routines, data structures, and object classes. The API 408 may be an independent or subordinate computer language and refers to a complete interface, a single function, or even a set of APIs. The service layer 410 provides software services to the computer 400. All service consumers using the service layer can access the functionality of the computer 400. Software services (such as those provided by the service layer 410) provide reusable, defined business functionality through a defined interface. For example, the interface may be software written in JAVA, C++, or other suitable languages, providing data in an extensible markup language (XML) format or another suitable format. Although illustrated as an integrated component of the computer 400, alternative implementations may illustrate the API 408 and / or service layer 410 as separate components associated with other components of the computer 400. Moreover, any or all portions of the API 408 and / or service layer 410 may be implemented as a sub-module or sub-module of another software module, enterprise application, or hardware module without departing from the scope of the present disclosure.

[0058] Computer 400 includes interface 402. Although Figure 4 400. A single interface 402 is illustrated in the figure, but two or more interfaces 402 may be used depending on the specific needs, expectations, or specific implementation of the computer 400. The interface 402 is used by the computer 400 to communicate with other systems in a distributed environment connected to a network (whether or not illustrated). Typically, the interface 402 includes logic encoded in software and / or hardware in a suitable combination and operable to communicate with the network. More specifically, the interface 402 may include software supporting one or more communication protocols associated with the communication, so that the hardware of the network or interface is operable to transmit physical signals within and outside the computer 400.

[0059] Computer 400 includes at least one processor 404. Although Figure 4A single processor 404 is shown in the figure, but two or more processors may be used depending on the particular needs, desires, or particular implementation of the computer. Generally, the processor 404 executes instructions and manipulates data to perform the operations of the computer 400. Specifically, the processor 404 executes Figures 1 to 4 The functionality disclosed in .

[0060] The computer 400 also includes a memory 414 for storing data of the computer 400. Figure 4 A single memory 414 is illustrated in FIG. 4 , but two or more memories may be used depending on the particular needs, desires, or particular implementation of the computer 400. Although the memory 414 is illustrated as an integral component of the computer 400, in alternative implementations, the memory 414 may be external to the computer 400.

[0061] Application 406 is an algorithmic software engine that provides functionality according to the specific needs, desires, or specific implementation of computer 400, particularly with respect to the functionality required for anomaly detection. Although illustrated as a single application 406, application 406 may be implemented as multiple applications 406 on computer 400. Additionally, although illustrated as being integrated with computer 400, in alternative implementations, application 406 may be external to computer 400.

[0062] There may be any number of computers 400 associated with the network or located external to the network and communicating over the network. Furthermore, the present disclosure contemplates that many users may use one computer 400, or that one user may use multiple computers 400.

[0063] The described implementations of the present subject matter may include one or more features alone or in combination.

[0064] For example, in a first implementation, a method includes: obtaining a first feature vector of a sample; processing the first feature vector through multiple dimensionality reduction processes, wherein each of the multiple dimensionality reduction processes generates a corresponding second feature vector, and each second feature vector in the second feature vectors has a dimension smaller than that of the first feature vector; for each second feature vector in the second feature vectors, determining an intermediate set of similarity samples; and aggregating the intermediate set of similarity samples to generate an output set of similarity samples.

[0065] The aforementioned and other described implementations may each optionally include one or more of the following features:

[0066] A first feature, which can be combined with any one of the following features, wherein an intermediate set of similarity samples is determined by using a k-nearest neighbor (k-NN) algorithm.

[0067] The second feature, which can be combined with any of the previous features or the following features, wherein the k-NN algorithm is an exact k-NN algorithm or an approximate k-NN algorithm.

[0068] A third feature, which can be combined with the previous feature or any of the following features, is that each of the multiple dimensionality reduction processes is generated by using a random process.

[0069] A fourth feature, which can be combined with any of the previous features or the following features, wherein aggregating the intermediate sets of similarity samples comprises: selecting similarity samples included in the intermediate sets exceeding a preset threshold number.

[0070] A fifth feature, combinable with any of the previous features or the following features, wherein aggregating the intermediate set of similarity samples comprises: selecting the similarity samples based on a normalized distance to the corresponding second feature vector.

[0071] A sixth feature, combinable with any of the previous features, wherein the sample is a software code.

[0072] In a second implementation, a computer-readable medium contains instructions that, when executed, cause an electronic device to perform operations, the operations comprising: obtaining a first feature vector of a sample; processing the first feature vector through multiple dimensionality reduction processes, wherein each of the multiple dimensionality reduction processes generates a corresponding second feature vector, each of the second feature vectors having a dimension smaller than a dimension of the first feature vector; determining an intermediate set of similarity samples for each of the second feature vectors; and aggregating the intermediate set of similarity samples to generate an output set of similarity samples.

[0073] The aforementioned and other described implementations may each optionally include one or more of the following features:

[0074] A first feature, which can be combined with any one of the following features, wherein an intermediate set of similarity samples is determined by using a k-nearest neighbor (k-NN) algorithm.

[0075] The second feature, which can be combined with any of the previous features or the following features, wherein the k-NN algorithm is an exact k-NN algorithm or an approximate k-NN algorithm.

[0076] A third feature, which can be combined with the previous feature or any of the following features, is that each of the multiple dimensionality reduction processes is generated by using a random process.

[0077] A fourth feature, which can be combined with any of the previous features or the following features, wherein aggregating the intermediate sets of similarity samples comprises: selecting similarity samples included in the intermediate sets exceeding a preset threshold number.

[0078] A fifth feature, combinable with any of the previous features or the following features, wherein aggregating the intermediate set of similarity samples comprises: selecting the similarity samples based on a normalized distance to the corresponding second feature vector.

[0079] A sixth feature, combinable with any of the previous features, wherein the sample is a software code.

[0080] In a third implementation, a computer-implemented system includes: one or more computers; and one or more computer memory devices, which are interoperably coupled to the one or more computers and have a tangible, non-transitory machine-readable medium storing one or more instructions, which when executed by the one or more computers perform one or more operations, the one or more operations including: obtaining a first feature vector of a sample; processing the first feature vector through multiple dimensionality reduction processes, wherein each of the multiple dimensionality reduction processes generates a corresponding second feature vector, each of the second feature vectors having a dimension smaller than that of the first feature vector; for each of the second feature vectors, determining an intermediate set of similarity samples; and aggregating the intermediate set of similarity samples to generate an output set of similarity samples.

[0081] The aforementioned and other described implementations may each optionally include one or more of the following features:

[0082] A first feature, which can be combined with any one of the following features, wherein an intermediate set of similarity samples is determined by using a k-nearest neighbor (k-NN) algorithm.

[0083] The second feature, which can be combined with any of the previous features or the following features, wherein the k-NN algorithm is an exact k-NN algorithm or an approximate k-NN algorithm.

[0084] A third feature, which can be combined with the previous feature or any of the following features, is that each of the multiple dimensionality reduction processes is generated by using a random process.

[0085] A fourth feature, which can be combined with any of the previous features or the following features, wherein aggregating the intermediate sets of similarity samples comprises: selecting similarity samples included in the intermediate sets exceeding a preset threshold number.

[0086] A fifth feature, combinable with any of the previous features or the following features, wherein aggregating the intermediate set of similarity samples comprises: selecting the similarity samples based on a normalized distance to the corresponding second feature vector.

[0087] A sixth feature, combinable with any of the previous features, wherein the sample is a software code.

[0088] The implementation of the subject matter and functional operations described in this specification can be implemented in a digital electronic circuit system, a tangibly implemented computer software or firmware, a computer hardware (including the structure disclosed in this specification and its structural equivalents), or a combination of one or more of them. The implementation of the subject matter described in this specification can be implemented as one or more computer programs, that is, one or more modules of computer program instructions encoded on a tangible non-transient computer storage medium to be implemented by a data processing device or to control the operation of the data processing device. Alternatively or in addition, the program instructions can be encoded on an artificially generated propagation signal (e.g., a machine-generated electrical, optical, or electromagnetic signal, which is generated to encode information for transmission to a suitable receiver device for implementation by a data processing device). The computer storage medium can be a machine-readable storage device, a machine-readable storage substrate, a random or serial access memory device, or a combination of one or more of them.

[0089] The term "data processing apparatus", "computer" or "electronic computer equipment" (or equivalents understood by a person of ordinary skill in the art) refers to data processing hardware and covers various apparatuses, devices and machines for processing data, including, by way of example, a programmable processor, a computer or multiple processors or computers. The apparatus may also be or further include a dedicated logic circuit system, such as a central processing unit (CPU), an FPGA (field programmable gate array) or an ASIC (application-specific integrated circuit). In some implementations, the data processing apparatus and / or the dedicated logic circuit system may be hardware-based and / or software-based. The apparatus may optionally include code that creates an execution environment for a computer program, such as code that constitutes processor firmware, a protocol stack, a database management system, an operating system, or a combination of one or more of them. The present disclosure contemplates the use of a data processing apparatus with or without a conventional operating system, such as LINUX, UNIX, WINDOWS, MAC OS, ANDROID, IOS or any other suitable conventional operating system.

[0090] A computer program (which may also be referred to or described as a program, software, software application, module, software module, script or code) may be written in any form of programming language (including compiled or interpreted languages ​​or descriptive or procedural languages), and it may be deployed in any form (including as a standalone program or as a module, component, subroutine or other unit suitable for a computing environment). A computer program may, but need not, correspond to a file in a file system. A program may be stored in a portion of a file that stores other programs or data (e.g., one or more scripts stored in a markup language document), in a single file dedicated to the program under discussion, or in multiple collaborative files (e.g., files storing one or more modules, subroutines or partial codes). A computer program may be deployed to be implemented on one computer, or on multiple computers located at one site or distributed on multiple sites and interconnected by a communication network. Although the program portions illustrated in the various figures are shown as separate modules that implement various features and functionality through various objects, methods or other processes, these programs may alternatively include multiple submodules, third-party services, components, libraries, etc. (as appropriate). On the contrary, the features and functionality of various components may be appropriately combined into a single component.

[0091] The processes and logic flows described in this specification can be performed by one or more programmable computers that execute one or more computer programs to perform functions by operating input data and generating output. The processes and logic flows can also be performed by a dedicated logic circuit system (such as a CPU, FPGA, or ASIC), and the apparatus can also be implemented as a dedicated logic circuit system (such as a CPU, FPGA, or ASIC).

[0092] The computer that is suitable for carrying out computer program can be based on general or special microprocessor or both or any other kind of CPU.Usually, CPU will receive instruction and data from ROM or RAM or both.The essential element of computer is the CPU for carrying out or carrying out instruction and one or more memory devices for storing instruction and data.Usually, computer will also include one or more mass storage devices (such as magnetic disk, magneto-optical disk or optical disk) for storing data, or computer will be operably coupled to receive data from this mass storage device or data will be transferred to this mass storage device or carry out both.However, computer does not need to have such device.And computer can be embedded in another device, such as, just to name a few, mobile phone, PDA, mobile audio or video player, game console, global positioning system (GPS) receiver or portable storage device (such as USB flash drive).

[0093] Computer-readable media (transient or non-transient, as the case may be) suitable for storing computer program instructions and data include all forms of non-volatile memory, media and memory devices, including by way of example: semiconductor memory devices such as erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM) and flash memory devices; magnetic disks, such as internal hard disks or removable disks; magneto-optical disks; and CD ROM, DVD+ / -R, DVD-RAM and DVD-ROM disks. The memory may store a variety of objects or data, including caches, categories, frameworks, applications, backup data, jobs, web pages, web page templates, database tables, repositories storing business and / or dynamic information, and any other appropriate information, including any parameters, variables, algorithms, instructions, rules, restrictions or references thereto. Additionally, the memory may include any other appropriate data, such as logs, policies, security or access data, report files and others. The processor and memory may be supplemented by, or incorporated into, a special purpose logic circuit system.

[0094] To provide interaction with a user, implementations of the subject matter described in this specification may be implemented on a computer having: a display device for displaying information to a user, such as a CRT (cathode ray tube), LCD, LED, or plasma monitor; and a keyboard and pointing device, such as a mouse, trackball, or trackpad, through which a user can provide input to the computer. Input may also be provided to the computer using a touch screen, such as a tablet computer surface with pressure sensitivity, a multi-touch screen using capacitive or electric sensing, or other types of touch screens. Other types of devices may also be used to provide interaction with a user; for example, feedback provided to a user may be any form of sensory feedback, such as visual feedback, auditory feedback, or tactile feedback; and input from a user may be received in any form, including acoustic input, voice input, or tactile input. In addition, a computer may interact with a user by sending documents to a device used by a user and receiving documents from the device; for example, by sending a web page to a web browser on a user's client device in response to a request received from the web browser.

[0095] The term "graphical user interface" or "GUI" may be used in the singular or plural to describe one or more graphical user interfaces and each of the displays of a particular graphical user interface. Thus, a GUI may represent any graphical user interface, including but not limited to a web browser, a touch screen, or a command line interface (CLI) that processes information and efficiently presents the results of the information to a user. Typically, a GUI may include a plurality of user interface (UI) elements, some or all of which are associated with a web browser, such as interactive fields, drop-down lists, and buttons operable by a business suite user. These and other UI elements may be associated with a web browser or represent functionality of a web browser.

[0096] Implementations of the subject matter described in this specification may be implemented in a computing system including back-end components (e.g., such as a data server), or a computing system including middleware components (e.g., an application server), or a computing system including front-end components (e.g., a client computer with a graphical user interface or a web browser through which a user can interact with implementations of the subject matter described in this specification), or any combination of one or more such back-end components, middleware components, or front-end components. The components of the system may be interconnected by wired and / or wireless digital data communications (e.g., a communication network) of any form or medium. Examples of communication networks include a local area network (LAN), a radio access network (RAN), a metropolitan area network (MAN), a wide area network (WAN), a world interoperability for microwave access (WIMAX), a wireless LAN (WLAN) using, for example, 802.11a / b / g / n / ac / ax / be and / or 802.20, all or a portion of the Internet, and / or any other communication system at one or more locations. The network may communicate, for example, Internet Protocol (IP) packets, Frame Relay frames, Asynchronous Transfer Mode (ATM) cells, voice, video, data, and / or other suitable information between network addresses.

[0097] A computing system may include clients and servers. Clients and servers are generally remote from each other and typically interact through a communication network. The relationship of client and server arises by virtue of computer programs running on the respective computers and having a client-server relationship to each other.

[0098] In some implementations, any or all components (including hardware and / or software) of a computing system may be interfaced with each other and / or with an interface using an API and / or service layer. An API may include specifications for routines, data structures, and object classes. An API may be an independent or subordinate computer language and refers to a complete interface, a single function, or even an API set. The service layer provides software services to a computing system. All service consumers via the service layer may access the functionality of various components of a computing system. Software services provide reusable, defined business functionality through defined interfaces. For example, the interface may be software written in JAVA, C++, or other suitable languages, providing data in XML format or other suitable formats. An API and / or service layer may be an integral component and / or an independent component associated with other components of a computing system. Moreover, without departing from the scope of the present disclosure, any or all parts of the service layer may be implemented as a submodule or submodule of another software module, enterprise application, or hardware module.

[0099] Although this specification contains many specific implementation details, these implementation details should not be interpreted as limitations on the scope of any invention or the scope of what may be claimed, but rather as descriptions of features that may be specific to a particular implementation of a particular invention. Certain features described in this specification in the context of separate implementations may also be implemented in a single implementation in combination. On the contrary, the various features described in the context of a single implementation may also be implemented in multiple implementations individually or in any suitable sub-combination. Moreover, although features may be described above as acting in certain combinations or even initially claimed as such, one or more features from the claimed combination may be cut out of the combination in some cases, and the claimed combination may point to a sub-combination or a change in the sub-combination.

[0100] Specific implementations of the subject matter have been described. It will be apparent to those skilled in the art that other implementations, variations, and permutations of the described implementations are within the scope of the following claims. Although operations are depicted in a particular order in the drawings or claims, this should not be construed as requiring that such operations be performed in the particular order shown or in a sequential order, or that all illustrated operations (some operations may be considered optional) be performed to achieve the desired results. In some cases, multitasking and parallel processing may be advantageous.

[0101] Moreover, the separation and / or integration of various system modules and components in the above-described implementations should not be understood as requiring such separation and / or integration in all implementations, and it should be understood that the described program components and systems can generally be integrated together in a single software product or packaged into multiple software products.

[0102] Therefore, the above description of example implementations does not define or constrain the present disclosure. Other changes, substitutions, and alterations are also possible without departing from the spirit and scope of the present disclosure.

Claims

1. A method comprising: Obtaining a first feature vector of the sample; processing the first feature vector through a plurality of dimensionality reduction processes, wherein each of the plurality of dimensionality reduction processes generates a corresponding second feature vector, each of the second feature vectors having a dimension smaller than a dimension of the first feature vector; For each of the second feature vectors, determining an intermediate set of similarity samples; as well as The intermediate sets of similarity samples are aggregated to generate an output set of similarity samples.

2. The method according to claim 1, wherein the intermediate set of similarity samples is determined by using a k-nearest neighbor (k-NN) algorithm.

3. The method according to claim 2, wherein the k-NN algorithm is an exact k-NN algorithm or an approximate k-NN algorithm. The method according to claim 1 , wherein each of the plurality of dimensionality reduction processes is generated by using a random process.

5. The method according to claim 1, wherein aggregating the intermediate set of similarity samples comprises: Similarity samples included in the intermediate sets exceeding a preset threshold number are selected.

6. The method according to claim 1, wherein aggregating the intermediate set of similarity samples comprises: A similarity sample is selected based on a normalized distance from the corresponding second feature vector. The method of claim 1 , wherein the sample is software code.

8. A computer-readable medium comprising instructions that, when executed, cause an electronic device to perform operations comprising: Obtaining a first feature vector of the sample; processing the first feature vector through a plurality of dimensionality reduction processes, wherein each of the plurality of dimensionality reduction processes generates a corresponding second feature vector, each of the second feature vectors having a dimension smaller than a dimension of the first feature vector; For each of the second feature vectors, determining an intermediate set of similarity samples; as well as The intermediate sets of similarity samples are aggregated to generate an output set of similarity samples.

9. The computer-readable medium of claim 8, wherein the intermediate set of similarity samples is determined by using a k-nearest neighbor (k-NN) algorithm.

10. The computer-readable medium of claim 9, wherein the k-NN algorithm is an exact k-NN algorithm or an approximate k-NN algorithm.

11. The computer-readable medium of claim 8, wherein each of the plurality of dimensionality reduction processes is generated by using a stochastic process.

12. The computer-readable medium of claim 8, wherein aggregating the intermediate set of similarity samples comprises: Similarity samples included in the intermediate sets exceeding a preset threshold number are selected.

13. The computer-readable medium of claim 8, wherein aggregating the intermediate set of similarity samples comprises: A similarity sample is selected based on a normalized distance from the corresponding second feature vector.

14. The computer-readable medium of claim 8, wherein the sample is software code.

15. A computer-implemented system comprising: one or more computers; as well as One or more computer memory devices interoperably coupled with the one or more computers and having a tangible, non-transitory, machine-readable medium storing one or more instructions that, when executed by the one or more computers, perform one or more operations comprising: Obtaining a first feature vector of the sample; processing the first feature vector through a plurality of dimensionality reduction processes, wherein each of the plurality of dimensionality reduction processes generates a corresponding second feature vector, each of the second feature vectors having a dimension smaller than a dimension of the first feature vector; For each of the second feature vectors, determining an intermediate set of similarity samples; and The intermediate sets of similarity samples are aggregated to generate an output set of similarity samples.

16. The computer-implemented system of claim 15, wherein the intermediate set of similarity samples is determined by using a k-nearest neighbor (k-NN) algorithm.

17. The computer implemented system of claim 16, wherein the k-NN algorithm is an exact k-NN algorithm or an approximate k-NN algorithm.

18. The computer-implemented system of claim 15, wherein each of the plurality of dimensionality reduction processes is generated by using a stochastic process.

19. The computer-implemented system of claim 15, wherein aggregating the intermediate set of similarity samples comprises: Similarity samples included in the intermediate sets exceeding a preset threshold number are selected.

20. The computer-implemented system of claim 15, wherein aggregating the intermediate set of similarity samples comprises: A similarity sample is selected based on a normalized distance from the corresponding second feature vector.

Images