CYLANCE INC.

Systems, methods, and software can be used to store properties of binary files from a set of binary files. In some aspects, a method includes: obtaining features from the binary files; clustering the binary files based on a similarity measure between the features, wherein a cluster of binary files comprises binary files that are near duplicates to each other; determining for at least one pair of binary files of a given cluster, at least one sequence of bytes, a pair of binary file comprising a first binary file and a second binary file, and wherein the at least one sequence of bytes being a sequence of bytes present in the first binary file, but not in the second binary file; storing information related to the at least one sequence of bytes as a property of a binary file.

Systems, methods, and software can be used to detect a malware file. In some aspects, a method includes: obtaining a file to be classified as either a malware file or a non-malware file; obtaining a sequence of elements of N 1 -bytes or N 1 -tokens from the file, with N 1 being an integer greater or equal to one; determining a sequence of hash values from the sequence of elements of N 1 -bytes or N 1 -tokens; obtaining a vector based on the sequence of hash values; providing a trained model with the obtained vector as input, the trained model outputting a data whose value enables a classification of the file as either a malware file or a non-malware file.

Systems, methods, and software can be used to determine a subset of files from a set of files. In some aspects, a method includes: obtaining features from the files; clustering the files based on a similarity measure between the features, wherein a cluster of files comprises files that are near duplicates to each other; determining a subset of files by sampling the clusters of files.

Systems, methods, and software can be used to modify labels associated with files, wherein a label is an information that helps categorize a file. In some aspects, a method includes: obtaining features from the files; clustering the files based on a similarity measure between the features, the similarity measure being independent of the labels associated with the files; identifying a mismatch between labels associated with files that belong to a given cluster; modifying some labels of files in the given cluster based on a distribution of labels in the given cluster.

Systems, methods, and software can be used to determine a subset of files from a set of files. In some aspects, a method includes: obtaining a set of vectors associated with the set of files; obtaining at least one value per vector from the set of vectors by performing a dot product between a vector from the set of vectors and a common projection vector; clustering the files or the vectors into clusters of files or vectors based on the at least one value per vector; determining a subset of files by selecting files depending on the clusters of files or vectors.

Systems, methods, and software can be used to determine whether a software code is unwanted. In some aspects, a method includes: obtaining, by an electronic device, a set of software features of a software code; obtaining, by the electronic device, a set of user features of a user of the electronic device; and determining, by the electronic device, a classification score of the software code based on the set of software features and the set of the user features, wherein the classification score indicates whether the software code is potentially unwanted for the user.

Systems, methods, and software can be used to clustering strings. A pair of string elements are obtained. One or more first strings are separated into a set of first string terms. One or more second strings are separated into into a set of second string terms. One or more string term distances are generated based on the set of first string terms and the set of second string terms. A distance between the first string element and the second string element is generated an provide to a clustering algorithm to generate a plurality of clusters.

Systems, methods, and software can be used to modify a software code. In some aspects, a method includes: obtaining a software code; and processing the software code to generate an output code, wherein the output code includes the software code and one or more modification codes, wherein the one or more modification codes are determined by an algorithm that is optimized according to a function of a size of the one or more modification codes and a size of the output code, wherein the size of the output code is larger than a size of the software code.

Systems, methods, and software can be used to train and use machine learning models that generate diverse embedded vectors, according to an implementation. In some aspects, a method includes: processing a set of training samples through a plurality of first machine learning models to generate embedded vectors, wherein each of the plurality of first machine learning models generates an embedded vector for each training sample in the set of training samples; training a second machine learning model by using the embedded vectors; and training the plurality of first machine learning models by using the second machine learning model

Systems, methods, and software can be used to generate natural language description of a software code. In some aspects, a method includes: processing a binary code by using a file encoder model to obtain a file embedding vector; and processing the file embedding vector to obtain a text description of the binary code by using a large language model (LLM).