Methods and apparatus for detecting and identifying malware by mapping feature data into a semantic space
In some embodiments, an apparatus includes a memory and a processor operatively coupled to the memory. The processor is configured to identify a feature vector for a potentially malicious file and provide the feature vector as an input to a trained neural network autoencoder to produce a modified feature vector. The processor is configured to generate an output vector by introducing Gaussian noise into the modified feature vector to ensure a Gaussian distribution for the output vector within a set of modified feature vectors. The processor is configured to provide the output vector as an input to a trained neural network decoder associated with the trained neural network autoencoder to produce an identifier of a class associated with the set of modified feature vectors. The processor is configured to perform a remedial action on the potentially malicious file based on the potentially malicious file being associated with the class.
1. An apparatus, comprising:
a memory; and
a processor operatively coupled to the memory, the processor configured to:
identify a feature vector for a potentially malicious file;
provide the feature vector as an input to a trained neural network encoder to produce a modified feature vector that more closely resembles an identified collection of feature vectors associated with a classification of maliciousness than the feature vector, the modified feature vector being produced based on the classification of maliciousness that was learned by the trained neural network encoder;
generate an output vector by introducing Gaussian noise into the modified feature vector, the Gaussian noise ensuring a Gaussian distribution for the output vector within a set of modified feature vectors;
providing the output vector as an input to a trained neural network decoder associated with the trained neural network encoder to produce as an output an identifier of a class, the set of modified feature vectors being associated with the class; and
performing a remedial action on the potentially malicious file based on the potentially malicious file being associated with the class.
2. The apparatus of claim 1 , wherein the trained neural network decoder is configured to identify that a distance between the output vector and the set of modified feature vectors from a plurality of sets of modified feature vectors is less than a distance between the output vector and each remaining set of modified feature vectors from the plurality of sets of modified feature vectors.
3. The apparatus of claim 1 , wherein the processor is configured to identify the feature vector for the potentially malicious file by extracting characteristics from the potentially malicious file.
4. A method, comprising:
training a triple-loss function neural network by providing an anchor feature vector associated with a first class, a training feature vector associated with the first class, and a training feature vector associated with a second class different from the first class;
identifying a feature vector for an artifact;
providing the feature vector for the artifact as an input to the triple-loss function neural network to produce a modified feature vector that more closely resembles an identified plurality of feature vectors associated with a classification of maliciousness than the feature vector, the modified feature vector being produced based on the classification of maliciousness that was learned by the triple-loss function neural network;
classifying the artifact as associated with a class of artifacts associated with the classification of maliciousness based on a distance between the modified feature vector and a set of modified feature vectors from a plurality of sets of modified feature vectors being less than a distance between the modified feature vector and each remaining set of modified feature vectors from the plurality of sets of modified feature vectors, the set of modified feature vectors being associated with the class of artifacts; and
performing an action associated with the artifact based on the artifact being classified as associated with the class of artifacts associated with the classification of maliciousness.
5. The method of claim 4 , wherein the identifying the feature vector includes identifying the feature vector for a potentially malicious file by extracting characteristics from the artifact.
6. The method of claim 4 , wherein the distance between the modified feature vector and the set of modified feature vectors from the plurality of sets of modified feature vectors is at least one of a Euclidean distance or a Hamming distance.
7. The method of claim 4 , wherein the artifact is a potentially malicious file and the class of artifacts is a class of malware, and the performing the action associated with the artifact includes quarantining the potentially malicious file.
8. A non-transitory processor-readable medium storing code representing instructions to be executed by a processor, the code comprising code to cause the processor to:
identify a feature vector for an artifact;
provide the feature vector as an input to a machine learning model to produce a modified feature vector, the modified feature vector being configured to more closely resemble an identified collection of feature vectors associated with a classification of artifacts than the feature vector, the modified feature vector being produced based on the classification of artifacts that was learned during a training of the machine learning model;
classify the artifact as associated with a class of artifacts based on a distance between the modified feature vector and a set of modified feature vectors from a plurality of sets of modified feature vectors being less than a distance between the modified feature vector and each remaining set of modified feature vectors from the plurality of sets of modified feature vectors, the set of modified feature vectors being associated with the class of artifacts; and
perform an action associated with the artifact based on the artifact being classified as associated with the class of artifacts.
9. The non-transitory processor-readable medium of claim 8 , wherein the machine learning model is a trained neural network encoder, the code to cause the processor to classify the artifact includes code to cause the processor to classify the artifact by providing the modified feature vector to a trained neural network decoder that produces as an output an identifier of the class of artifacts.
10. The non-transitory processor-readable medium of claim 8 , wherein the code to cause the processor to classify the artifact includes code to cause the processor to calculate a distance between the modified feature vector and each set of modified feature vectors from the plurality of sets of modified feature vectors.
11. The non-transitory processor-readable medium of claim 8 , wherein the machine learning model is a trained triple-loss function neural network.
12. The non-transitory processor-readable medium of claim 8 , wherein the code to cause the processor to classify the artifact is further configured to cause the processor to:
introduce Gaussian noise into the modified feature vector prior to classifying the artifact as associated with the class of artifacts to ensure a Gaussian distribution for the set of modified feature vectors associated with the class of artifacts.
13. The non-transitory processor-readable medium of claim 8 , wherein the artifact is a potentially malicious file and the class of artifacts is a class of malware, the code to cause the processor to perform the action associated with the artifact includes code to cause the processor to quarantine the potentially malicious file.
14. The non-transitory processor-readable medium of claim 8 , wherein the distance between the modified feature vector and the set of modified feature vectors from the plurality of sets of modified feature vectors is at least one of a Euclidean distance or a Hamming distance.