USPTO Grants Patent for Malware Detector Using NLP

ChangeBridge: Patent Grants - AI & Computing (G06N)

Published March 24th, 2026

Detected March 24th, 2026

Summary

The USPTO has granted patent US12585935B2 to Palo Alto Networks, Inc. for a malware detector that utilizes Natural Language Processing (NLP) on dynamic malware analysis reports. The patent describes a system that aggregates text-based features from these reports to classify files and generate a malware detection output.

View original document View source feed page

What changed

The United States Patent and Trademark Office (USPTO) has granted patent US12585935B2 to Palo Alto Networks, Inc. The patent covers a novel malware detection system that employs Natural Language Processing (NLP) techniques on dynamic malware analysis reports. The system preprocesses these reports to extract text-based features, including individual tokens and n-grams, which are then fed into trained neural networks and boosting models to classify files and generate a malware detection output.

This patent grant signifies a new technological development in cybersecurity, specifically in the automated detection of malware. While patents do not impose direct regulatory obligations on other entities, they can influence industry standards and practices. Companies operating in the cybersecurity space, particularly those developing AI-driven threat detection solutions, should be aware of this patented technology. The assignee, Palo Alto Networks, Inc., now holds exclusive rights to this specific implementation, which may impact competitive product development and licensing strategies within the industry.

Source document (simplified)

← USPTO Patent Grants

Execution behavior analysis text-based ensemble malware detector

Grant US12585935B2 Kind: B2 Mar 24, 2026

Assignee

Palo Alto Networks, Inc.

Inventors

Sujit Rokka Chhetri, William Redington Hewlett, II

Abstract

A malware detector has been designed that uses a combination of NLP techniques on dynamic malware analysis reports for malware classification of files. The malware detector aggregates text-based features identified in different pre-processing pipelines that correspond to different types of properties of a dynamic malware analysis report. From a dynamic malware analysis report, the pre-processing pipelines of the malware detector generate a first feature set based on individual text tokens and a second feature set based on n-grams. The malware detector inputs the first feature set into a trained neural network having an embedding layer. The malware detector then extracts a dense layer from the trained neural network and aggregates the extracted layer with the second feature set to form an input for a trained boosting model. The malware detector inputs the cross-pipeline feature values into the trained boosting model to generate a malware detection output.