Generation of embeddings and use thereof for detection and cyber security analysis

1 . An apparatus, comprising:

a memory; and

a processor coupled to the memory, where the processor is configured to:

generate an embedding representative of an entity with an unknown cyber security status based on an identifier of the entity, where the embedding is generated using an artificial intelligence (AI) model trained with a dataset comprising a set of identifiers that identify a corresponding set of other entities; and

classify the entity as being associated with a subset of the corresponding set of other entities based on a similarity metric being indicative that the entity has a similar behavior to the subset of the corresponding set of other entities, where the similarity metric is determined based on the generated embedding representative of the entity and one or more embeddings associated with the subset of the corresponding set of other entities.

2 . The apparatus of claim 1 , where the processor is configured to determine that the similarity metric is indicative that the entity has similar behavior to at least part of the subset of the corresponding set of other entities by the processor being configured to:

calculate the similarity metric based on the generated embedding representative of the entity and one or more of embeddings associated with the subset of the corresponding set of other entities; and

in response to the similarity metric being within a specified range, determining that the entity has similar behavior to at least part of the subset of the corresponding set of other entities.

3 . The apparatus of claim 1 , where the processor is further configured to generate an indication that the entity is associated with unsafe behavior in response to determining that the subset of the corresponding set of other entities is associated with unsafe behavior.

4 . The apparatus of claim 1 , where the processor is further configured to generate an indication that the entity is associated with safe behavior in response to determining that the subset of the corresponding set of other entities is associated with safe behavior.

5 . The apparatus of claim 1 , where:

the entity comprises an internet resource; and

the set of other entities comprises a set of internet resources.

6 . The apparatus of claim 1 , where:

the entity comprises a user; and

the set of other entities comprises a set of users.

7 . The apparatus of claim 1 , where the entity and the other entities comprise hosts or users.

8 . The apparatus of claim 1 , where the embedding is generated further based on metadata associated with the entity, where the metadata comprises information indicative of one or more of:

web responses;

certificate information;

contextual data;

web content.

9 . An apparatus, comprising:

a memory; and

a processor coupled to the memory, the processor is configured to generate an embedding representative of an entity with an unknown cyber security status based on an identifier of the entity, where the identifier of the entity and the set of identifiers that identify a corresponding set of other entities comprise Uniform Resource Identifiers (URIs) and where the embedding is generated using an artificial intelligence (AI) model trained with a dataset comprising a set of identifiers that identify a corresponding set of other entities, wherein the processor is further configured to compare the embedding to embeddings of other entities to infer similarity and classify the entity as safe or unsafe based on cluster association and similarity metrics.

10 . The apparatus of claim 9 , where the AI model comprises a transformer configured to implement fuzzy matching.

11 . The apparatus of claim 9 , where the AI model is configured to implement one or more of: a large language model (LLM); and masked language modeling (MLM).

12 . The apparatus of claim 9 , where the AI model is configured to use a byte-level tokenizer.

13 . The apparatus of claim 9 , where a degree of similarity between (i) the generated embedding representative of the entity with the unknown cyber security status and (ii) a subset of a set of embeddings associated with a corresponding subset of the set of other entities is indicative of a likelihood that the entity has a same cyber security status as the corresponding subset of the set of other entities.

14 . The apparatus of claim 13 , wherein the processor is configured to transmit the embedding representative of the entity to a database comprising the set of embeddings.

15 . A computer-implemented method of classifying an entity with an unknown cyber security status, comprising:

generating an embedding representative of the entity based on an identifier of the entity, where the embedding is generated using an artificial intelligence (AI) model trained with a dataset comprising a set of identifiers that identify a corresponding set of other entities; and

classifying the entity as being associated with a subset of the corresponding set of other entities based on a similarity metric being indicative that the entity has a similar behavior to the subset of the corresponding set of other entities, where the similarity metric is determined based on the generated embedding representative of the entity and one or more embeddings associated with the subset of the corresponding set of other entities.

16 . A non-transitory computer-readable medium storing instructions which when executed by one or more processors causes the one or more processors to:

generate an embedding representative of an entity with an unknown cyber security status based on an identifier of the entity, where the embedding is generated using an artificial intelligence (AI) model trained with a dataset comprising a set of identifiers that identify a corresponding set of other entities; and

classify the entity as being associated with a subset of the corresponding set of other entities based on a similarity metric being indicative that the entity has a similar behavior to the subset of the corresponding set of other entities, where the similarity metric is determined based on the generated embedding representative of the entity and one or more embeddings associated with the subset of the corresponding set of other entities.

17 . An apparatus, comprising:

a memory; and

a processor coupled to the memory, where the processor is configured to:

receive, from a classifier, an indication of a classification of an entity having a cyber security status that is unknown to the apparatus, where the indication of the classification comprises an indication that the entity is associated with a subset of a set of other entities based on a similarity metric being indicative that the entity has a similar behavior to the subset of the corresponding set of other entities, where the similarity metric is determined based on the embedding representative of the entity and one or more embeddings associated with the subset of the corresponding set of other entities; and

block access to the entity in response to the cyber security status of the entity being classified as unsafe.

18 . The apparatus of claim 17 , where the indication of the classification comprises an indication that the entity is associated with a subset of the corresponding set of other entities based on a similarity metric being indicative that the entity has a similar behavior to the subset of the corresponding set of other entities, where the similarity metric is determined based on the embedding representative of the entity and one or more embeddings associated with the subset of the set of other entities.

19 . The apparatus of claim 17 , where the processor is further configured to, prior to classification of the entity by the classifier, transmit an identifier associated with the entity to the classifier, where the classifier is trained based on a set of identifiers that identify the set of other entities.