Security threat detection by converting scripts using validation graphs

1. An apparatus comprising:

a memory; and

a hardware processor communicatively coupled to the memory, the hardware processor configured to:

receive an automated script comprising a plurality of steps;

determine that a first step of the automated script comprises a first instruction to download an object from a website;

in response to determining that the first step comprises the first instruction, generate a graph comprising a first node representing the object, a second node representing the website, and a first link between the first node and the second node;

determine that a second step of the automated script comprises a second instruction to execute a query against a database;

in response to determining that the second step comprises the second instruction, add, to the graph, a third node representing the query, a fourth node representing the database, and a second link between the third node and the fourth node;

generate a vector based on the graph, the vector comprising a numerical representation of the graph;

determine a cluster of vectors for the vector;

determine, based on the cluster of vectors, a security score for the automated script;

determine that the security score exceeds a threshold; and

in response to determining that the security score exceeds the threshold, prevent the automated script from being executed.

2. The apparatus of claim 1 , wherein the cluster is determined using a long short-term memory neural network.

3. The apparatus of claim 1 , the hardware processor further configured to:

receive a log comprising information about previous executions of the automated script;

determine, from the log, a frequency of execution of the automated script; and

in response to determining the frequency of execution, add, to the graph, a node representing the frequency of execution.

4. The apparatus of claim 1 , the hardware processor further configured to determine a weight and a bias for the vector.

5. The apparatus of claim 1 , the hardware processor further configured to:

receive a query comprising a search score; and

in response to the query, retrieve a plurality of vectors, each vector of the plurality of vectors generated based on an automated script with a security score exceeding the search score.

6. The apparatus of claim 1 , the hardware processor further configured to communicate an alert indicating that the security score exceeds the threshold.

7. The apparatus of claim 1 , the hardware processor further configured to assign the automated script to a threat category.

8. A method comprising:

receiving, by a hardware processor communicatively coupled to a memory, an automated script comprising a plurality of steps;

determining, by the hardware processor, that a first step of the automated script comprises a first instruction to download an object from a website;

in response to determining that the first step comprises the first instruction, generating, by the hardware processor, a graph comprising a first node representing the object, a second node representing the website, and a first link between the first node and the second node;

determining, by the hardware processor, that a second step of the automated script comprises a second instruction to execute a query against a database;

in response to determining that the second step comprises the second instruction, adding, by the hardware processor and to the graph, a third node representing the query, a fourth node representing the database, and a second link between the third node and the fourth node;

generating, by the hardware processor, a vector based on the graph, the vector comprising a numerical representation of the graph;

determining, by the hardware processor, a cluster of vectors for the vector;

determining, by the hardware processor and based on the cluster of vectors, a security score for the automated script;

determining, by the hardware processor, that the security score exceeds a threshold; and

in response to determining that the security score exceeds the threshold, preventing, by the hardware processor, the automated script from being executed.

9. The method of claim 8 , wherein the cluster is determined using a long short-term memory neural network.

10. The method of claim 8 , further comprising:

receiving, by the hardware processor, a log comprising information about previous executions of the automated script;

determining, by the hardware processor and from the log, a frequency of execution of the automated script; and

in response to determining the frequency of execution, adding, by the hardware processor and to the graph, a node representing the frequency of execution.

11. The method of claim 8 , further comprising determining, by the hardware processor, a weight and a bias for the vector.

12. The method of claim 8 , further comprising:

receiving, by the hardware processor, a query comprising a search score; and

in response to the query, retrieving, by the hardware processor, a plurality of vectors, each vector of the plurality of vectors generated based on an automated script with a security score exceeding the search score.

13. The method of claim 8 , further comprising communicating, by the hardware processor, an alert indicating that the security score exceeds the threshold.

14. The method of claim 8 , further comprising assigning, by the hardware processor, the automated script to a threat category.

15. A system comprising:

a database; and

a security threat detector comprising a hardware processor communicatively coupled to a memory, the hardware processor configured to:

receive, from the database, an automated script comprising a plurality of steps;

determine that a first step of the automated script comprises a first instruction to download an object from a website;

in response to determining that the first step comprises the first instruction, generate a graph comprising a first node representing the object, a second node representing the website, and a first link between the first node and the second node;

determine that a second step of the automated script comprises a second instruction to execute a query against a database;

in response to determining that the second step comprises the second instruction, add, to the graph, a third node representing the query, a fourth node representing the database, and a second link between the third node and the fourth node;

generate a vector based on the graph, the vector comprising a numerical representation of the graph;

determine a cluster of vectors for the vector;

determine, based on the cluster of vectors, a security score for the automated script;

determine that the security score exceeds a threshold; and

in response to determining that the security score exceeds the threshold, prevent the automated script from being executed.

16. The system of claim 15 , wherein the cluster is determined using a long short-term memory neural network.

17. The system of claim 15 , the hardware processor further configured to:

receive, from the database, a log comprising information about previous executions of the automated script;

determine, from the log, a frequency of execution of the automated script; and

in response to determining the frequency of execution, add, to the graph, a node representing the frequency of execution.

18. The system of claim 15 , the hardware processor further configured to determine a weight and a bias for the vector.

19. The system of claim 15 , the hardware processor further configured to:

receive a query comprising a search score; and

in response to the query, retrieve a plurality of vectors, each vector of the plurality of vectors generated based on an automated script with a security score exceeding the search score.

20. The system of claim 15 , the hardware processor further configured to communicate an alert indicating that the security score exceeds the threshold.