Detection of unwanted software using machine learning computations

Abstract

Systems, methods, and software can be used to determine whether software code is undesirable. In some aspects, a method includes, by means of an electronic device, obtaining a set of software features of the software code; by means of an electronic device, obtaining a set of user features of the user of the electronic device; and by means of an electronic device, determining a classification score of the software code based on the set of software features and the set of user features, the classification score indicating whether the software code is potentially undesirable to the user.

Description

TECHNICAL FIELD

[0001] (Cross-Reference to Related Applications) This application claims the benefit of U.S. Patent Application No. 18 / 465,391, filed on September 12, 2023. The disclosure of the prior application is considered part of (and is incorporated herein by reference) the disclosure of this application.

[0002] (Technical Field) The present disclosure relates to detecting undesired software by using machine learning operations.

BACKGROUND ART

[0003] In some implementations, machine learning models can be used in software classification to detect malware. For example, a machine learning model can be used to determine whether software code contains malware code and thus may pose a security risk.

SUMMARY OF THE INVENTION

MEANS FOR SOLVING THE PROBLEMS

[0004] The described implementations of the present subject matter, alone or in combination, may include one or more features.

[0005] For example, in a first implementation, a method includes obtaining, by an electronic device, a set of software features of software code, obtaining, by the electronic device, a set of user features of a user of the electronic device, and determining, by the electronic device, a classification score for the software code based on the set of software features and the set of user features, wherein the classification score indicates whether the software code is potentially undesired to the user.

[0006] Each of the foregoing and other described implementations may optionally include one or more of the following features.

[0007] In a first feature that can be combined with any of the following features, determining a classification score includes determining a software feature vector based on a set of software features, determining a user feature vector based on a set of user features, and determining a classification score based on the software feature vector and the user feature vector.

[0008] A second feature, which can be combined with any of the features described above or below, includes determining a classification score by sending a set of software features and a set of user features to a server, and receiving a classification score from the server in response to sending the set of software features and the set of user features.

[0009] A third feature, which can be combined with any of the features described above or below, further includes comparing the classification score to a threshold score and enabling access to the software code in response to determining that the classification score meets the threshold score.

[0010] In a fourth feature, which can be combined with any of the features mentioned above or below, the classification score is calculated using machine learning operations.

[0011] A fifth feature, which can be combined with any of the features described above or below, includes a machine learning operation that processes software feature vectors by using a first machine learning model and processes user feature vectors by using a second machine learning model.

[0012] A sixth feature, which can be combined with any of the aforementioned features, further includes outputting an indication that shows whether the software code is potentially undesirable to the user.

[0013] In the second implementation, a computer-readable medium containing instructions causes an electronic device to perform an action, which, when executed, includes obtaining a set of software features of software code, obtaining a set of user features of the electronic device's user, and determining a classification score for the software code based on the set of software features and the set of user features, the classification score indicating whether the software code is potentially undesirable to the user.

[0014] Each of the aforementioned and other described implementations may optionally include one or more of the following features:

[0015] In a first feature that can be combined with any of the following features, determining a classification score includes determining a software feature vector based on a set of software features, determining a user feature vector based on a set of user features, and determining a classification score based on the software feature vector and the user feature vector.

[0016] A second feature, which can be combined with any of the features described above or below, includes determining a classification score by sending a set of software features and a set of user features to a server, and receiving a classification score from the server in response to sending the set of software features and the set of user features.

[0017] A third feature, which can be combined with any of the features described above or below, further includes comparing the classification score to a threshold score and, in response to determining that the classification score meets the threshold score, enabling access to the software code.

[0018] In a fourth feature, which can be combined with any of the features mentioned above or below, the classification score is calculated using machine learning operations.

[0019] A fifth feature, which can be combined with any of the features described above or below, includes a machine learning operation that processes software feature vectors by using a first machine learning model and processes user feature vectors by using a second machine learning model.

[0020] A sixth feature, which can be combined with any of the aforementioned features, further includes outputting an indication that the software code is potentially undesirable to the user.

[0021] In the third implementation, the computer implementation system comprises one or more computers and one or more computer memory devices, the computer memory devices being interoperably coupled with one or more computers and having a tangible non-transient machine-readable medium for storing one or more instructions, and when one or more instructions are executed by one or more computers, the system performs one or more operations, which include obtaining a set of software features of the software code, obtaining a set of user features of the user of an electronic device, and determining a classification score of the software code based on the set of software features and the set of user features, the classification score indicating whether the software code is potentially undesirable for the user.

[0022] Each of the aforementioned and other described implementations may optionally include one or more of the following features:

[0023] In a first feature that can be combined with any of the following features, determining a classification score includes determining a software feature vector based on a set of software features, determining a user feature vector based on a set of user features, and determining a classification score based on the software feature vector and the user feature vector.

[0024] In a second feature that can be combined with any of the features described above or below, determining the classification score includes transmitting a set of software features and a set of user features to a server, and receiving the classification score from the server in response to transmitting the set of software features and the set of user features.

[0025] In a third feature that can be combined with any of the features described above or below, the operations further include comparing the classification score with a threshold score, and enabling access to the software code in response to determining that the classification score meets the threshold score.

[0026] In a fourth feature that can be combined with any of the features described above or below, the classification score is calculated using a machine learning operation.

[0027] In a fifth feature that can be combined with any of the features described above or below, the machine learning operation includes processing a software feature vector by using a first machine learning model, and processing a user feature vector by using a second machine learning model.

[0028] In a sixth feature that can be combined with any of the features described above, the operations further include outputting an indication that indicates whether the software code is potentially undesirable for a user. [BRIEF DESCRIPTION OF THE DRAWINGS]

[0029] [Figure 1] FIG. 1 is a schematic diagram illustrating an exemplary system for determining whether software code is a PUP, according to some implementations.

[0030] [Figure 2] FIG. 2 is a flowchart illustrating an exemplary method for operations of detecting undesirable software, according to some implementations.

[0031] [Figure 3] Figure 3 is a schematic diagram illustrating an exemplary operation for determining a classification score in a particular implementation.

[0032] [Figure 4] Figure 4 illustrates a high-level architectural block diagram of a computer based on a particular implementation.

[0033] Similar reference numbers and symbols in various drawings indicate the same elements. [Modes for carrying out the invention]

[0034] Detailed explanation Software classification computations can be improved to detect potentially unwanted programs (PUPs). While malware detection determines whether software code is malicious, PUP detection determines whether software code is unwanted for a particular user. Malicious software code is a PUP. On the other hand, harmless software code can also be a PUP for a particular user. For example, network monitoring software may be harmless to network engineers but considered a PUP to salespeople. Identifying PUPs can improve classification performance by tailoring classification computations to specific users or organizations. This can also prompt organizational administrators to restrict the types of software code available to certain users.

[0035] In some cases, crowdsourcing-based or collaborative filtering approaches can be used in classification calculations, and usage information from groups of users who share the same characteristics as a particular user can be used to determine whether software code is a potentially unwanted application (PUP) for that user. For example, if software code is uninstalled by a group of users who share the same characteristics as a particular user, such statistics can be used to determine whether the software code is a PUP for that user. However, these approaches may have some drawbacks. The software code may be new, and therefore statistics from other users may not be available. Statistics from other users may contain noise, and it may not be accurate to predict whether the software code is a PUP specifically for this particular user.

[0036] In some cases, machine learning operations that process information about the software code as well as information about the user and device can be used to determine whether the software code is a potentially unwanted program (PUP). This approach can improve the accuracy of PUP classification for specific users. Figure 1-4 and its associated explanation provide additional details of these implementations.

[0037] Figure 1 is a schematic diagram showing an exemplary system 100 for determining whether software code is a PUP (Potentially Unwanted Program) according to one implementation. At a high level, the exemplary system 100 includes a client device 108 which is coupled to a software service platform 106 via a network 110 in a communicable manner.

[0038] The client device 108 represents an electronic device that installs and launches software code. In some cases, a browser or client application runs on the client device 108 and can obtain software services by communicating service requests and service responses with a server such as the software service platform 106.

[0039] The client device 108 includes a PUP analyzer 104. The PUP analyzer 104 represents an application, a set of applications, software, a software module, hardware, or any combination thereof, which determines whether the software code is a PUP. In some implementations, the PUP analyzer 104 can obtain software features of the software code and user features, which include information about the client device 108 and the user using the client device 108. The software features and user features can be used to calculate a classification score for the software code. In some cases, machine learning operations, including multiple machine learning models, are used to determine the classification score. The PUP analyzer 104 can determine whether the software code is a PUP by using the classification score. In some cases, the calculation can be performed by the PUP analyzer 104. Alternatively, the client device 108 can calculate the classification score by sending information representing the software features and user features to the software service platform 106. Figure 2-4 and the associated description provide additional details of these implementations.

[0040] The software code analyzed by the PUP analyzer 104 can be source code or binary code. In the software development process, source code can be created by a programmer using a text editor or visual programming tool prior to compilation. Source code can be developed using a human-readable programming language and stored in a text file. Source code can be converted by an assembler or compiler into binary software code that can be executed by a computer. In some cases, source code can be generated by automated tools, such as artificial intelligence driven by a large-scale language model.

[0041] Binary software code can contain streams of bytes generated by compiling source code. Therefore, binary software code may not be in a human-readable format and may not be easily parsed or analyzed by humans.

[0042] Binary software code can be composed of object code, executable code, or bytecode. Object code is the product of a compiler's output of a sequence of statements or instructions in a computer language. Source code can be logically divided into multiple source files. Each source file is compiled independently into a corresponding object file containing object code. Object code within an object file is binary machine code, but it may not be ready to be executed. An object file may contain incomplete references to subroutines outside of itself, and placeholder addresses. During the linking process, these object files can be linked together to form a single executable file containing executable code that can be executed on a computing device. During the linking process, the linker can read the object files, resolve the references between them, perform a final code layout that determines the addresses of blocks of code and data in memory, correct placeholder addresses with actual addresses, and write out an executable file containing the executable code.

[0043] Bytecode, also known as portable code or p-code, is a form of instruction set designed for efficient execution by a software interpreter. Bytecode contains compact numeric codes, constants, and references (typically numeric addresses) that encode the results of a compiler's semantic analysis of things such as the type, range, and nesting depth of program objects. Bytecode includes an instruction set with a one-byte opcode followed by optional parameters. Intermediate representations such as bytecode may be output by programming language implementations to facilitate interpretation, or they may be used to reduce hardware and operating system dependencies by enabling the same code to run cross-platform on different devices. Bytecode can often be executed directly on a virtual machine (p-code machine, i.e., an interpreter) or, for better performance, further compiled into machine code. In some cases, binary software code coded using platform-independent languages ​​such as Java® can be stored in bytecode format.

[0044] The software service platform 106 represents an application, a set of applications, software, a software module, hardware, or any combination thereof, that provides software services to a client device 108. The software service platform 106 can be an application server, a service provider, or any other network entity. The software service platform 106 can be implemented using one or more computers, computer servers, or a cloud computing platform. The software service platform 106 can be used to train machine learning models used in PUP decision calculations. In some cases, the software service platform 106 can send threshold scores to the client device 108 for PUP decisions. In some cases, the software service platform 106 can calculate classification scores.

[0045] Looking at the general description, client device 108 may include, but is not limited to, any of the following: endpoints, computing devices, mobile devices, mobile electronic devices, user devices, mobile stations, subscriber stations, portable electronic devices, mobile communication devices, wireless modems, wireless terminals, or other electronic devices. An example of an endpoint may include mobile devices, IoT (Internet of Things) devices, EoT (Enterprise IoT) devices, cellular phones, personal digital assistants (PDAs), smartphones, laptops, tablets, personal computers (PCs), pagers, portable computers, portable gaming devices, wearable electronic devices, health / medical / adaptive devices, cameras, vehicles, or other mobile communication devices having components for communicating voice or data over a wireless communication network. Vehicles may include automated vehicles (e.g., automobiles, cars, trucks, buses, motorcycles, etc.), aircraft (e.g., airplanes, unmanned aerial vehicles, unmanned aerial vehicle systems, drones, helicopters, etc.), spacecraft (e.g., spaceplanes, space shuttles, space capsules, space stations, satellites, etc.), seaplanes (e.g., ships, boats, hovercraft, submarines, etc.), railway vehicles (e.g., trains, trams, etc.), and other types of vehicles, whether currently existing or arising in the future, including any combination of any of the above. A wireless communication network may include a radio link over at least one of the licensed spectrum and the unlicensed spectrum. The term “mobile device” may also refer to any hardware or software component that can terminate a communication session for a user. In addition, the terms “user equipment,” “UE,” “user equipment device,” “user agent,” “UA,” “user device,” and “mobile device” may be used synonymously in this specification.

[0046] The exemplary system 100 includes a network 110. The network 110 represents an application, a set of applications, software, software modules, hardware, or a combination thereof, which can be configured to transmit data messages between entities within the exemplary system 100. The network 110 may include a wireless network, a wired network, the internet, or a combination thereof. For example, the network 110 may include one or more radio access networks (RANs), a core network (CN), and the internet. The RAN may comprise one or more radio access technologies. In some implementations, the radio access technology may be Global System for Mobile Communications (GSM®), Provisional Specification 95 (IS-95), Universal Mobile Telecommunications System (UMTS), CDMA2000 (Code Division Multiple Access), Evolved Universal Mobile Telecommunications System (E-UMTS), Long-Term Evolution (LTE), LTE Advanced, Fifth Generation (5G), or any other radio access technology. In some cases, the core network may be an Evolved Packet Core (EPC).

[0047] A RAN (Radio-Area Network) is part of a radio telecommunications system that implements radio access technologies such as UMTS, CDMA2000, 3GPP® LTE, 3GPP® LTE-A, and 5G. In many applications, a RAN includes at least one base station. A base station can be a radio base station that can control all or at least some of the radio-related functions in a fixed part of the system. A base station can provide radio interfaces or cells for mobile devices to communicate within their coverage area. Base stations can be distributed throughout the cellular network to provide wide-area coverage. A base station communicates directly with one or more mobile devices, other base stations, and one or more core network nodes.

[0048] The elements in Figure 1 are shown to include various component parts, sections, or modules that implement various features and functionalities; however, these elements may instead include several submodules, third-party services, components, libraries, etc., as needed. Furthermore, the features and functionalities of various components can be combined into fewer components as needed.

[0049] Figure 2 is a flowchart illustrating an exemplary method 200 for detecting unwanted software, according to one implementation. The exemplary method 200 can be implemented by electronic devices, e.g., the client device 102 shown in Figure 1, a server, e.g., the software service platform 106 shown in Figure 1, or a combination thereof. The exemplary method 200 shown in Figure 2 can be implemented using additional actions, fewer actions, or different actions, which can be performed in the order shown or in different orders.

[0050] In 210, the electronic device obtains a set of software features of software code. The software code can be source code or binary code. The software code can be code for software already installed on the electronic device or software pending installation on the electronic device. Pending installations can occur after the user device downloads an application, or receives an update via wireless communication, or receives a user interface action that triggers the installation of a previously stored application. Prior to installation, method 200 can be triggered to determine whether the software code is a PUP. The software code can be code for software that has been received and is pending execution on the electronic device, for example, a script received via the Internet. Prior to execution, method 200 can be triggered to determine whether the software code is a PUP. The software code can be code received in a message, for example, an email attachment. Prior to viewing or storing the attachment, method 200 can be triggered to determine whether the software code is a PUP. Alternatively, or in addition, Method 200 can be triggered according to a security policy on an electronic device and can scan software already installed on the electronic device. The security policy can be configured by the manufacturer, owner, or user of the electronic device. The security policy can also be configured by an administrator of an organization associated with the user of the electronic device, for example, the information technology (IT) administrator of the user's employer. The security policy can configure periodic or event-triggered scans of the electronic device to determine whether any of the currently installed software is a potentially unwanted program (PUP). In some implementations, the electronic device can maintain a record of software already scanned in previous scans.Therefore, each scan should only check the software installed on the electronic device that has not been previously inspected or has been modified since the previous inspection to determine if it is a PUP (Potentially Unusual Program).

[0051] Software features include information about the software code that can be used to determine whether the software code is a PUP (Potentially Unwanted Program). Examples of software features include file size, file format, file type (e.g., whether the software code is binary or source code), file content (part or all of the software code), associated operating system or programming environment, number of specific strings contained in the code, code structure (e.g., order of instruction sets), signature, checksum, etc. Software code features can be obtained from metadata associated with the code, from pre-processing operations that scan the software code and automatically extract feature information from the code, or both.

[0052] In some operations, each software feature can be converted to a numerical value in integer or floating-point format. This numerical value can be concatenated to one or more software feature vectors. Alternatively, or in addition, the numerical value can be combined or transformed to generate one or more software feature vectors. Examples of transformation or combination techniques include multiplication, addition, and passing through nonlinear transformation functions (e.g., Fourier transform, rectification, etc.).

[0053] In section 220, the electronic device acquires a set of user characteristics of the user of the electronic device. User characteristics include information about the user using the electronic device. Examples of user characteristics include user profile information such as the user's name, the user's employer and title, and the user's geographical location (e.g., country and state). In some cases, user profile information can be acquired through a user profile file. For example, the IT administrator of the user's employer can generate a user profile file containing the user's user profile information and store the user profile on the electronic device. Alternatively, or in addition, the user can provide user profile information into the electronic device through a user interface.

[0054] Examples of user characteristics also include information on usage behavior and patterns, such as browsing history, access history (including read / write / keystroke / audio / video / screen access), application installation history, application usage history, etc. In some cases, information on usage behavior and patterns can be obtained by processing user data that captures user activity patterns on an electronic device. In some cases, an electronic device may be used by only one user, and therefore the information on the user's usage behavior and patterns is identical to the information on the usage behavior and patterns of the electronic device. In other cases, an electronic device may be used by multiple users, and therefore the information on the user's usage behavior and patterns may differ from user to user. In these cases, information on the user's usage behavior and patterns, along with user profile information about a particular user who triggers Method 200 by attempting to install software code, are collected as user characteristic information.

[0055] Examples of user characteristics also include information about electronic devices, such as hardware configuration information including memory, processor, graphics, and input and output interfaces; software configuration information including the operating system; and other software already installed on the electronic device. In some cases, information about electronic devices can be obtained through the electronic device's configuration file, such as a system configuration file.

[0056] In some operations, each user feature can be converted to a numerical value in integer or floating-point format. The numerical value can be concatenated to one or more user feature vectors. Alternatively, or in addition, the numerical value can be combined or transformed to generate one or more user feature vectors. Examples of transformation or combination techniques include multiplication, addition, and passing through nonlinear transformation functions (e.g., Fourier transform, rectification, etc.).

[0057] In 230, the electronic device determines a classification score for the software code based on a set of software features and a set of user features.

[0058] In some cases, the calculation of classification scores can be performed by a server. In these cases, the electronic device can transmit software feature and user feature information to the server for processing. In some cases, the electronic device can generate software feature vectors and user feature vectors by performing a conversion process, transmit the software feature vectors and user feature vectors, and represent the software feature and user feature information. Alternatively, the electronic device can transmit software feature and user feature information in text strings, which the server can convert into software feature vectors and user feature vectors. In some cases, the electronic device can encrypt the text strings before transmitting them to the server. In addition, or alternatively, the electronic device can anonymize the user's private information within the software feature and user feature information and transmit the anonymized version to the server.

[0059] In other cases, the calculation of classification scores can be performed by electronic devices.

[0060] In some implementations, classification scores can be calculated using machine learning (ML) operations. Figure 3 is a schematic diagram illustrating an exemplary operation for determining classification scores in one implementation. The illustrated operation can be implemented as a computer program on one or more computers in one or more locations, in which the systems, components, and techniques described below may be implemented.

[0061] Schematic Figure 300 includes a first ML model 312 and a second ML model 314. The first ML model 312 and the second ML model 314 can be implemented by using any suitable machine learning model architecture that enables them to perform the functions described. For example, when configured as a neural network, the first ML model 204 may include at least one neural network layer, e.g., at least one fully connected layer or convolutional layer or transformer. Alternatively, or in addition, the first ML model 204 may be a graph neural network, a recurrent neural network, another machine learning model, or any combination thereof. In the case of multiple neural network layers, they may be stacked in a certain layer order so that data passes sequentially between them. Each neuron in one layer is connected to some or all neurons in the next layer.

[0062] In some cases, the ML models, for example, the first ML model 312 and the second ML model 314, may include the following layers: an input layer that receives input vectors and passes them through to the rest of the network; an intermediate layer between the input and output layers, which processes the data by applying complex nonlinear functions to them; and an output layer that receives the processed data as input and produces the final result.

[0063] Hidden layers transform input features into processed features. Each layer is implemented by using a mathematical function that applies weights to the input to produce an output specific to the intended result. In some cases, hidden layers can be implemented in a hierarchical manner, where each layer within the hidden layers specializes in producing a single transformation for the target result and passes the output value to the next layer for further processing.

[0064] The first ML model 312 and the second ML model 314 can be of the same or different types. For example, both the first ML model 312 and the second ML model 314 can be transformer neural networks, but they can have different numbers of layers or neurons. In another embodiment, the first ML model 312 and the second ML model 314 can be different types of machine learning models, e.g., a transformer neural network and a convolutional neural network. In some cases, the first ML model 312 and the second ML model 314 are trained together on the training dataset. Alternatively, the first ML model 312 and the second ML model 314 can be trained separately on the same or different dataset.

[0065] In the illustrated embodiment, the first ML model 312 receives a software feature vector 302 as input and generates a software output vector 322. The second ML model 314 receives a user feature vector 304 as input and generates a user output vector 324. The software feature vector 302 and the user feature vector 304 may have the same or different lengths. The software output vector 322 and the user output vector 324 may have the same length.

[0066] A dot product operation 330 can be performed on the software output vector 322 and the user output vector 324 to generate a classification score 340. In addition, or alternatively, other combination or transformation functions (e.g., concatenation) can also be used to combine the software output vector 322 and the user output vector 324 and generate a combined value used to determine the classification score 340, for example, by comparing the combined value with a threshold. In one embodiment, the cosine similarity between the software output vector 322 and the user output vector 324 can be calculated and used as a similarity metric.

[0067] In some implementations, instead of using two ML models as illustrated in Figure 3, a single ML model can be trained to generate classification scores. In one embodiment, software feature vectors and user feature vectors can be concatenated to form a single combined input vector. A single ML model can process this combined input vector and generate classification scores.

[0068] In some implementations, instead of obtaining a classification score by using the dot product operation 330 as shown in Figure 3, a third ML model can be used to determine the classification score. Similar to the first ML model 312 and the second ML model 314 discussed above, the third ML model can be implemented using any suitable machine learning model architecture, such as a neural network including a multilayer perceptron (MLP), a graph neural network, or a recurrent neural network. The third ML model can take a software output vector 322 and a user output vector 324 as input and provide a classification score as output. The third ML model can be trained together with the first ML model 312 and the second ML model 314, or separately.

[0069] In addition to the software output vector 322 and the user output vector 324, or as an alternative thereto, the third ML model may use other inputs provided by the first ML model 312 and the second ML model 314. Examples of these other inputs may include residual connections of the first ML model 312 or the second ML model 314. Examples of residual connections may include representations of some or all of the inputs of the first ML model 312 or the second ML model 314, representations of the internal processing results of one or more internal layers of the first ML model 312 or the second ML model 314, or any combination thereof.

[0070] In some cases, an electronic device can determine whether software code is a PUP (Potentially Unwanted Program) by comparing its classification score to a threshold score. For example, if the classification score is greater than the threshold score, the software code is determined to be a PUP. Alternatively, if the classification score is less than the threshold score, the software code is determined to be a PUP. In some cases, a security policy may be used to configure whether software code is determined to be a PUP based on different comparison results, namely, the classification score is greater than the threshold score, the classification score is less than the threshold score, or the classification score is equal to the threshold score.

[0071] Threshold scores can be stored on an electronic device. Threshold scores can be generated by the server and sent to the electronic device prior to method 200 being triggered. The server can send updated threshold scores to the electronic device periodically or upon request from the electronic device. In some implementations, the server calculates a classification score, compares it to the threshold score, and sends an indication to the electronic device showing the comparison result.

[0072] In some cases, notifications may be generated. For example, a notification may be generated in response to a software code being determined to be a PUP (Potentially Unwanted Program). The notification may include an indication of whether the software code is determined to be a PUP. The notification may also include classification scores, threshold scores, software feature information, user feature information, or any combination thereof. The notification may be output within the user interface of an electronic device. In some cases, a visual or audible alert may be output on the electronic device to indicate that the software code is a PUP. Alternatively, or in addition, the notification may be sent for alerting to another device, for example, the user's employer's manager server.

[0073] If it is determined that the software code is not a PUP (Potentially Unwanted Program), the electronic device may proceed with the installation of the software code if its installation is pending, or retain the software code if it is already installed.

[0074] If the software code is determined not to be a PUP (Potentially Unwanted Program), different handling mechanisms can be configured. For example, a notification may be displayed on the user interface of the electronic device to indicate that the software code is a PUP. The notification may also include a classification score, a threshold score, information on software characteristics, information on user characteristics, or any combination thereof. The user may then choose from different options, such as removing without installing, uninstalling, quarantining, retaining, or proceeding with installation. Alternatively, or in addition, a security policy may be provisioned on the electronic device and constitute one of the handling mechanisms.

[0075] Figure 4 illustrates a high-level architectural block diagram of computer 400 in one implementation. Computer 400 can be implemented as the software service platform 106 and client device 108 in Figure 1. Computer 400 can also be used to implement the operation discussed in Figures 2-3. The illustrations described represent only one possible implementation of the subject matter described, and this disclosure is not intended to limit it to a single described implementation. Those skilled in the art will understand that the components described can be connected, combined, and / or used in alternative ways consistent with this disclosure.

[0076] In some cases, the code package establishment process algorithm can be implemented within executable computing code, such as C / C++ executable code. In some cases, computer 400 may include a standalone Linux® system for launching batch applications. In some cases, computer 400 may include a mobile or personal computer.

[0077] The computer 400 may include input devices such as a keypad, keyboard, touchscreen, microphone, speech recognition device, and other devices that can receive user information, and / or output devices that transmit information associated with the operation of the computer, including digital data, visual and / or audio information, or a GUI.

[0078] Computer 400 can function as a client, network component, server, database or other persistence, and / or any other component. In some implementations, one or more components of Computer 400 may be configured to operate within a cloud computing-based environment.

[0079] At a high level, computer 400 is an electronic computing device capable of receiving, transmitting, processing, storing, or managing data. According to some implementations, computer 400 can also include, or be coupled to, application servers, email servers, web servers, cache servers, streaming data servers, business intelligence (BI) servers, and / or other servers in a communicative manner.

[0080] Computer 400 can collect data on network events or mobile application usage events via the network 110 from a web browser or client application, such as an installed plugin. In addition, data can be collected by computer 400 from internal users (e.g., from a command console or by another appropriate access method), external or third parties, other automated applications, and any other appropriate entities, individuals, systems, or computers.

[0081] Each component of computer 400 can communicate using the system bus 412. In some implementations, any and / or all components of computer 400, which are both hardware and / or software, can interact with each other and / or interface 402 via the system bus 412 using the application programming interface (API) 408 and / or service layer 410. API 408 may include specifications for routines, data structures, and object classes. API 408 may be either computer language independent or dependent and may refer to a complete interface, a single function, or even a set of APIs. Service layer 410 provides software services to computer 400. The functionality of computer 400 may be accessible to all service consumers using this service layer. Software services, such as those provided by service layer 410, provide reusable, defined business functionality through defined interfaces. For example, an interface may be software written in Java®, C++, or another preferred language, providing data in Extended Markup Language (XML) format or another preferred format. Although illustrated as an integrated component of computer 400, alternative implementations may illustrate API 408 and / or service layer 410 as independent components related to other components of computer 400. Furthermore, any or all parts of API 408 and / or service layer 410 may be implemented as a child or submodule of another software module, business application, or hardware module without departing from the scope of this disclosure.

[0082] Computer 400 includes an interface 402. Although illustrated as a single interface 402 in Figure 4, two or more interfaces 402 may be used depending on specific needs, desires, or specific implementations of computer 400. Interface 402 is used by computer 400 to communicate with other systems in a distributed environment connected to a network (whether illustrated or not). Generally, interface 402 comprises logic encoded in software and / or hardware in a preferred combination and capable of operating to communicate with the network. More specifically, interface 402 may comprise software that supports one or more communication protocols associated with the communication, so that the network or interface hardware can operate to communicate physical signals inside and outside computer 400.

[0083] The computer 400 includes at least one processor 404. Although illustrated as a single processor 404 in Figure 4, two or more processors may be used depending on specific needs, desires, or specific implementations of the computer. Generally, the processor 404 performs the operation of the computer 400 by executing instructions and manipulating data. Specifically, the processor 404 performs the functionality disclosed in Figures 1-4.

[0084] Computer 400 also includes memory 414 for holding data for computer 400. Although illustrated as a single memory 414 in Figure 4, two or more memories may be used depending on specific needs, desires, or specific implementations of computer 400. Although memory 414 is illustrated as an integrated component of computer 400, in alternative implementations, memory 414 may be located outside of computer 400.

[0085] Application 406 is an algorithmic software engine that provides functionality according to specific needs, desires, or a particular implementation of computer 400, particularly regarding the functionality required for anomaly detection. Although illustrated as a single application 406, application 406 may be implemented as multiple applications 406 on computer 400. In addition, although illustrated as being integrated with computer 400, in alternative implementations, application 406 may be external to computer 400.

[0086] Any number of computers 400 may exist that are associated with or outside the network and communicate through it. Furthermore, this disclosure suggests that many users may use one computer 400, or one user may use multiple computers 400.

[0087] Implementations of the subject matter and functional operations described herein may be implemented in digital electronic circuits, in tangibly embodied computer software or firmware, in computer hardware including the structures disclosed herein and their structural equivalents, or in one or more combinations thereof. Implementations of the subject matter described herein may be implemented as one or more computer programs, i.e., one or more modules of computer program instructions encoded on a tangible, non-transient computer storage medium for execution by a data processing device or for controlling the operation of a data processing device. Alternatively, or in addition, the program instructions may be encoded on artificially generated, propagating signals, such as mechanically generated electrical signals, optical signals, or electromagnetic signals, which are generated to encode information for transmission to a suitable receiver device for execution by a data processing device. The computer storage medium may be a machine-readable storage device, a machine-readable storage substrate, a random or serial access memory device, or one or more combinations thereof.

[0088] The terms “data processing apparatus,” “computer,” or “electronic computer device” (or equivalents as understood by those skilled in the art) refer to data processing hardware and encompass all types of devices, machines, and equipment for processing data, including, for example, a programmable processor, a computer, or multiple processors or computers. The apparatus may also be, or include, dedicated logic circuits, such as a central processing unit (CPU), an FPGA (field-programmable gate array), or an ASIC (application-specific integrated circuit). In some implementations, the data processing apparatus and / or dedicated logic circuits may be hardware-based and / or software-based. The apparatus may optionally include code that constructs an execution environment for computer programs, such as processor firmware, a protocol stack, a database management system, an operating system, or one or more combinations thereof. This disclosure envisions the use of the data processing apparatus with or without a conventional operating system, such as LINUX®, UNIX®, WINDOWS®, MAC OS®, Android®, IOS, or any other suitable conventional operating system.

[0089] Computer programs, which may also be called or represented as programs, software, software applications, modules, software modules, scripts, or code, can be written in any form of programming language, including compiled or interpreted languages, or declarative or procedural languages, and can be deployed as standalone programs or in any form, including modules, components, subroutines, or other units suitable for use in a computing environment. Computer programs may, but do not have to, correspond to files in a file system. A program may be stored in a single file dedicated to that program, in part of a file holding one or more scripts stored in other programs or data, e.g., in a markup language document, or in multiple collaborative files, e.g., in a file storing one or more modules, subprograms, or multiple parts of code. Computer programs can be deployed to run on one computer, or on multiple computers located in one place or distributed across multiple locations and interconnected by a communication network. While multiple parts of a program illustrated in various drawings are shown as individual modules implementing various features and functionalities through various objects, methods, or other processes, the program may, as appropriate, include several submodules, third-party services, components, libraries, etc. Conversely, the features and functionalities of various components may, as appropriate, be combined within a single component.

[0090] The processes and logic flows described herein can be implemented by one or more programmable computers that execute one or more computer programs to perform a function by acting on input data and producing outputs. The processes and logic flows can also be implemented by dedicated logic circuits, such as a CPU, FPGA, or ASIC, and devices can be implemented as such.

[0091] A computer suitable for running computer programs can be based on a general-purpose or dedicated microprocessor, both, or any other type of CPU. Generally, the CPU will receive instructions and data from ROM or RAM or both. Essential elements of a computer are the CPU for executing or running instructions, and one or more memory devices for storing instructions and data. Generally, a computer will also have one or more mass storage devices for storing data, including, or operably coupled to, magnetic disks, magneto-optical disks, or optical disks, receiving data from them, transferring data to them, or both. However, a computer is not required to have such devices. Furthermore, a computer can be embedded in another device, for example, a mobile phone, a personal digital assistant (PDA), a mobile audio or video player, a game console, a Global Positioning System (GPS) receiver, or a portable storage device, such as a USB flash drive.

[0092] Computer-readable media (transient or non-transient, as appropriate) suitable for storing computer program instructions or data include, for example, semiconductor memory devices such as erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), and flash memory devices, magnetic disks such as internal hard disks or removable disks, magneto-optical disks, and all forms of non-volatile memory, media, and memory devices, including CD-ROM, DVD+ / -R, DVD-RAM, and DVD-ROM disks. Memory may store a variety of objects or data, including caches, classes, frameworks, applications, backup data, jobs, web pages, web page templates, database tables, repositories storing business information and / or dynamic information, and any other appropriate information, including any parameters, variables, algorithms, instructions, rules, constraints, or references thereto. In addition, memory may include any other appropriate data, such as logs, policies, security or access data, report files, and so on. Processors and memory may be complemented by or incorporated into dedicated logic circuits.

[0093] To provide user interaction, implementations of the subject matter described herein may be implemented on a computer having a display device for displaying information to the user, such as a CRT (cathode ray tube), LCD, LED, or plasma monitor, and a keyboard and pointing device, such as a mouse, trackball, or trackpad, by which the user can provide input to the computer. Input may also be provided to the computer using a touchscreen, such as a tablet computer surface with pressure sensing, a multi-touch screen using capacitive or electrical sensing, or other types of touchscreens. Other types of devices may also be used to provide user interaction; for example, feedback provided to the user may be any form of sensory feedback, such as visual feedback, auditory feedback, or haptic feedback, and input from the user may be received in any form, including acoustic, verbal, or haptic input. In addition, the computer may interact with the user by sending documents to and receiving documents from a device used by the user, for example, by sending a web page to a web browser on the user's client device in response to a request received from a web browser.

[0094] The term “graphical user interface” or “GUI” may be used in the singular or plural form to describe one or more graphical user interfaces, and each of the displays of a particular graphical user interface. Therefore, GUI can represent any graphical user interface, including, but not limited to, a web browser, a touchscreen, or a command-line interface (CLI) that processes information and efficiently presents the results to the user. Generally, a GUI may include several user interface (UI) elements, some or all of which are associated with a web browser, such as interactive fields, pull-down lists, and buttons, which can be operated by a business suite user. These and other UI elements may be related to, or represent, the functionality of the web browser.

[0095] Implementations of the subject matter described herein can be implemented in a computer system that includes, for example, a data server, a backend component, or a middleware component, such as an application server, or a frontend component, such as a client computer having a graphical user interface or web browser through which a user can interact with the implementation of the subject matter described herein, or any combination of one or more such backend, middleware, or frontend components. The components of the system can be interconnected by any form or medium of wired and / or wireless digital data communication, such as a communication network. Embodiments of a communication network include local area networks (LANs), wireless access networks (RANs), metropolitan area networks (MANs), wide area networks (WANs), Worldwide Interoperability for Microwave Access (WiMAX), wireless local area networks (WLANs) using 802.11a / b / g / n and / or 802.20, all or part of the Internet, and / or one or more other communication systems in one or more locations. The network can communicate between network addresses with, for example, Internet Protocol (IP) packets, Frame Relay frames, Asynchronous Transfer Mode (ATM) cells, voice, video, data, and / or other preferred information.

[0096] A computing system can include a client and a server. Clients and servers are generally remote from each other and typically interact through a communication network. The client-server relationship arises from computer programs running on each computer that have a client-server relationship with each other.

[0097] In some implementations, any or all of the components of a computer system, which are both hardware and / or software, may interact with each other and / or interfaces using APIs and / or a service layer. APIs may include specifications for routines, data structures, and object classes. APIs may be either language-independent or language-dependent, and may refer to a complete interface, a single function, or even a set of APIs. The service layer provides software services to the computer system. The functionality of the various components of the computer system may be accessible to all service consumers through this service layer. Software services provide reusable, defined business functionality through defined interfaces. For example, an interface may be software written in Java®, C++, or another preferred language that provides data in XML format or other preferred format. APIs and / or the service layer may be integrated and / or standalone components in relation to other components of the computer system. Furthermore, any or all parts of the service layer may be implemented as a child or submodule of another software module, enterprise application, or hardware module without departing from the scope of this disclosure.

[0098] This specification contains many specific implementation details, but these should not be interpreted as limitations on the scope of any invention or claim, but rather as descriptions of features that may be specific to a particular implementation of a particular invention. Certain features described herein in the context of separate implementations may also be implemented in combination in a single implementation. Conversely, various features described in the context of a single implementation may also be implemented in multiple implementations, either separately or in any preferred secondary combination. Furthermore, features described above as acting in a combination, and may be initially claimed as such, but one or more features from a claimed combination may, in some cases, be removed from the combination, and the claimed combination may be a secondary combination or a variation of a secondary combination.

[0099] A specific implementation of this subject is described. Other implementations, alternative forms of the described implementation, and permutations are within the following claims, which will be obvious to those skilled in the art. The operations are depicted in a specific order in the drawings or claims, but this should not be understood as requiring that such operations be performed in a specific order shown, or in a sequential order, or that all illustrated operations be performed to achieve a desired result (some operations may be considered optional). In certain circumstances, multitasking and parallel processing may be advantageous.

[0100] Furthermore, the separation and / or integration of various system modules and components in the implementations described above should not be understood as requiring such separation and / or integration in all implementations. The program components and systems described can generally be incorporated together in a single software product or packaged into multiple software products.

[0101] Therefore, the above description of exemplary implementations does not define or restrict this disclosure. Other modifications, substitutions, and alternatives are also possible without departing from the spirit and scope of this disclosure.

Claims

1. It is a method, By using electronic devices, it is possible to obtain a set of software features of software code, The electronic device is used to obtain a set of user characteristics of the user of the electronic device, The electronic device determines a classification score for the software code based on the set of software features and the set of user features, wherein the classification score indicates whether the software code is potentially undesirable to the user. Methods that include...

2. Determining the aforementioned classification score means Based on the aforementioned set of software features, a software feature vector is determined, Based on the aforementioned set of user characteristics, a user feature vector is determined, The classification score is determined based on the software feature vector and the user feature vector. The method according to claim 1, including the method described in claim 1.

3. Determining the aforementioned classification score means Sending the set of software features and the set of user features to the server, In response to transmitting the set of software features and the set of user features, the classification score is received from the server. The method according to claim 1, including the method described in claim 1.

4. The classification score is compared with the threshold score, In response to determining that the classification score satisfies the threshold score, access to the software code is enabled. The method according to claim 1, further comprising:

5. The method according to claim 1, wherein the classification score is calculated using machine learning operations.

6. The method according to claim 5, wherein the machine learning operation includes processing software feature vectors using a first machine learning model and processing user feature vectors using a second machine learning model.

7. The method according to claim 1, further comprising outputting an indication that the software code is potentially undesirable to the user.

8. A computer-readable medium containing instructions, wherein, when the instructions are executed, an electronic device, Obtaining a set of software features of software code, To obtain a set of user characteristics of the user of the aforementioned electronic device, Determining a classification score for the software code based on the set of software features and the set of user features, wherein the classification score indicates whether the software code is potentially undesirable to the user. A computer-readable medium that enables the execution of actions including [specific actions].

9. Determining the aforementioned classification score means Based on the aforementioned set of software features, a software feature vector is determined, Based on the aforementioned set of user characteristics, a user feature vector is determined, The classification score is determined based on the software feature vector and the user feature vector. A computer-readable medium according to claim 8, including the following:

10. Determining the aforementioned classification score means Sending the set of software features and the set of user features to the server, In response to transmitting the set of software features and the set of user features, the classification score is received from the server. A computer-readable medium according to claim 8, including the following:

11. The aforementioned operation further, The classification score is compared with the threshold score, In response to determining that the classification score satisfies the threshold score, access to the software code is enabled. A computer-readable medium according to claim 8, including the following:

12. The computer-readable medium according to claim 8, wherein the classification score is calculated using machine learning operations.

13. The computer-readable medium according to claim 12, wherein the machine learning operation includes processing software feature vectors by using a first machine learning model and processing user feature vectors by using a second machine learning model.

14. The computer-readable medium according to claim 8, further comprising the operation outputting an indication indicating whether the software code is potentially undesirable to the user.

15. A computer implementation system, One or more computers, One or more computer memory devices and The computer memory device is interoperably coupled with the one or more computers and has a tangible, non-transient, machine-readable medium that stores one or more instructions, and when the one or more instructions are executed by the one or more computers, Obtaining a set of software features of software code, To obtain a set of user characteristics of users of electronic devices, Determining a classification score for the software code based on the set of software features and the set of user features, wherein the classification score indicates whether the software code is potentially undesirable to the user. A computer implementation system that performs one or more operations, including [specific operations].

16. Determining the aforementioned classification score means Based on the aforementioned set of software features, a software feature vector is determined, Based on the aforementioned set of user characteristics, a user feature vector is determined, The classification score is determined based on the software feature vector and the user feature vector. The computer implementation system according to claim 15, including the above.

17. Determining the aforementioned classification score means Sending the set of software features and the set of user features to the server, In response to transmitting the set of software features and the set of user features, the classification score is received from the server. The computer implementation system according to claim 15, including the above.

18. The aforementioned operation further, The classification score is compared with the threshold score, In response to determining that the classification score satisfies the threshold score, access to the software code is enabled. The computer implementation system according to claim 15, including the above.

19. The computer implementation system according to claim 15, wherein the classification score is calculated using machine learning operations.

20. The computer implementation system according to claim 19, wherein the machine learning operation includes processing software feature vectors by using a first machine learning model and processing user feature vectors by using a second machine learning model.

Images