Using a recurrent neural network (RNN) that has been trained to a satisfactory level of performance, highly discriminative features can be extracted by running a sample through the RNN, and then extracting a final hidden state hi, where i is the number of instructions of the sample. This resulting feature vector may then be concatenated with the other hand-engineered features, and a larger classifier may then be trained on hand-engineered as well as automatically determined features. Related apparatus, systems, techniques and articles are also described.
Please help me write a proper abstract based on the patent claims. CLAIM: 1. A method comprising: receiving or accessing data encapsulating a sample of at least a portion of one or more files; feeding at least a portion of the received or accessed data as a time-based sequence into a recurrent neural network (RNN) trained using historical data; extracting, by the RNN, a final hidden state hi in a hidden layer of the RNN in which i is a number of elements of the sample; and determining, using the RNN and the final hidden state, whether at least a portion of the sample is likely to comprise malicious code. 2. The method of claim 1, wherein the received or accessed data forms at least part of a data stream. 3. The method of claim 1, wherein the at least a portion of the received or accessed data comprises a series of fixed-length encoded words. 4. The method of claim 1, wherein the elements comprises a series of instructions. 5. The method of claim 1, wherein the hidden state is defined by: ht=f(x, ht-1), wherein hidden state ht is a time-dependent function of input x as well as a previous hidden state ht-1. 6. The method of claim 1, wherein the RNN is an Elman network. 7. The method of claim 6, wherein the Elman network has deep transition or decoding functions. 8. The method of claim 6, wherein the Elman network parameterizes f(x, ht-1) as ht=g(W1x+Rht-1); where hidden state ht is a time-dependent function of input x as well as previous hidden state ht-1, W1 is a matrix defining input-to-hidden connections, R is a matrix defining the recurrent connections, and g(·) is a differentiable nonlinearity. 9. The method of claim 8 further comprising: adding an output layer on top of the hidden layer, such that ot=σ(W2ht) where ot is output, W2 defines a linear transformation of hidden activations, and σ(·) is a logistic function. 10. The method of claim 9 further comprising: applying backpropagation through time by which parameters of network W2, W1, and R are iteratively refined to drive the output otto a desired value as portions of the received or accessed data are passed through the RNN. 11. The method of claim 1, wherein the RNN is a long short term memory network. 12. The method of claim 1, wherein the RNN is a clockwork RNN. 13. The method of claim 1, wherein the RNN is a deep transition function. 14. The method of claim 1, wherein the RNN is an echo-state network. 15. The method of claim 1 further comprising: providing data characterizing the determination. 16. The method of claim 15, wherein providing data comprises at least one of: transmitting the data to a remote computing system, loading the data into memory, or storing the data. 17. The method of claim 1, wherein the files are binary files. 18. The method of claim 1, wherein the files are executable files. 19. A system comprising: at least one programmable data processor; and memory storing instructions which, when executed by the at least one programmable data processor, result in operations comprising: receiving or accessing data encapsulating a sample of at least a portion of one or more files; feeding at least a portion of the received or accessed data as a time-based sequence into a recurrent neural network (RNN) trained using historical data; extracting, by the RNN, a final hidden state hi in a hidden layer of the RNN in which i is a number of elements of the sample; and determining, using the RNN and the final hidden state, whether at least a portion of the sample is likely to comprise malicious code. 20. A non-transitory computer program product storing instructions which, when executed by at least one programmable data processor forming part of at least one computing device, result in operations comprising: receiving or accessing data encapsulating a sample of at least a portion of one or more files; feeding at least a portion of the received or accessed data as a time-based sequence into a recurrent neural network (RNN) trained using historical data; extracting, by the RNN, a final hidden state hi in a hidden layer of the RNN in which i is a number of elements of the sample; and determining, using the RNN and the final hidden state, whether at least a portion of the sample is likely to comprise malicious code.