Palo Alto Networks two-layer ML malware detector

ChangeBridge: Patent Grants - Networking (H04L)

Published March 31st, 2026

Detected March 31st, 2026

Summary

USPTO granted Palo Alto Networks patent US12592948B2 for a two-layer machine learning malware detection system that classifies network traffic across multiple protocols. The invention correlates network sessions by source indicators and uses protocol-specific first-layer classifiers to improve cross-protocol malware detection accuracy. The patent contains 25 claims covering the ML architecture, classification methods, and system configurations.

View original document View source feed page

What changed

USPTO granted Palo Alto Networks patent US12592948B2 on March 31, 2026, covering a system and method for detecting malware traffic using a two-layer machine learning architecture. The first layer includes protocol-specific classifiers (H04L 63/1425, H04L 63/10, G06N 20/00) that analyze traffic sessions, while the second layer correlates sessions with common source indicators and determines cross-protocol classifications. The system uses CPC classifications including network security (H04L 63/14), machine learning (G06N 20/00, G06N 7/01), and network protocols (H04L 69/22).

This patent grant gives Palo Alto Networks exclusive rights to the two-layer ML malware detection technology in the United States. Competitors developing similar cross-protocol malware detection systems may need to design around these claims or seek licensing. The patent does not impose compliance obligations on third parties but establishes IP rights that could affect future product development in network security and ML-based traffic analysis.

Source document (simplified)

← USPTO Patent Grants

Cross protocol malware traffic detection using a two-layer ML architecture

Grant US12592948B2 Kind: B2 Mar 31, 2026

Assignee

Palo Alto Networks, Inc.

Inventors

Lei Xu, Taojie Wang, Shengming Xu

Abstract

A system, method, and device for classifying traffic is disclosed. The method includes (i) correlating a plurality of network traffic sessions with same source indicators to obtain correlated network traffic, (ii) classifying the plurality of network traffic sessions based at least in part on a plurality of first-layer classifiers to obtain a set of first-layer classifications, wherein the plurality of first-layer classifiers are respectively associated with a plurality of protocols, and (iii) determining a second-layer classification for the correlated network traffic based at least in part on the set of first-layer classifications.

CPC Classifications

H04L 63/1425 H04L 63/10 H04L 63/1416 H04L 63/0428 H04L 12/4641 H04L 61/4511 H04L 12/4633 H04L 63/0281 H04L 67/56 H04L 63/30 H04L 63/0272 H04L 63/029 H04L 67/564 H04L 45/74 H04L 63/164 H04L 69/22 H04L 41/0631 H04L 63/1458 H04L 41/12 H04L 41/16 H04L 63/1433 H04L 41/145 H04L 43/022 H04L 63/1408 H04L 63/1441 H04L 69/18 G06N 20/00 G06N 20/20 G06N 7/01 G06N 5/02 G06N 5/01 G06N 5/025 G06F 9/545 G06F 21/552