Methods and apparatus to improve detection of malware in executable code

1. An apparatus comprising:

a communication processor to access a log file, the log file including a memory dump of first functions corresponding to a first portable executable file that failed to execute in a sandbox environment;

a log file filtration controller to exclude at least one known clean function from the first functions of the log file to generate a filtered log file;

a log file normalization controller to generate normalized arguments of second functions of the filtered log file, the log file normalization controller to:

identify a first argument of a first function of the second functions of the filtered log file;

determine a data type of the first argument of the first function;

identify a placeholder representative of the data type of the first argument; and

replace the first argument of the first function with the placeholder representative of the data type of the first argument to generate a first normalized argument of the normalized arguments;

a feature vector generation controller to:

generate an empty version of a feature vector; and

after generating the empty version of the feature vector, populate the feature vector with n-gram groupings of the second functions having the normalized arguments; and

a machine learning engine to train, using stochastic gradient descent, a machine learning model with the feature vector, the machine learning model to be deployed to an end-user device to detect malware in a second portable executable file.

2. The apparatus of claim 1 , wherein the first functions include low-level programming language functions corresponding to the first portable executable file, and failure to execute the first portable executable file in the sandbox environment includes a crash of the first portable executable file at a computer implementing the sandbox environment.

3. The apparatus of claim 1 , wherein the n-gram groupings include bigram groupings.

4. The apparatus of claim 1 , wherein the feature vector is to reduce latency between a query of the machine learning model and an inference of whether the second portable executable file is malicious or benign.

5. A non-transitory computer readable storage medium comprising instructions which, when executed, cause one or more processors to at least:

access a log file, the log file including a memory dump of first functions corresponding to a first portable executable file that failed to execute in a sandbox environment;

exclude at least one known clean function from the first functions of the log file to generate a filtered log file including second functions;

identify a first argument of a first function of the second functions of the filtered log file;

determine a data type of the first argument of the first function;

identify a placeholder representative of the data type of the first argument;

replace the first argument of the first function with the placeholder representative of the data type of the first argument;

generate normalized arguments using at least the first replaced argument;

generate an empty version of a feature vector;

after generating the empty version of the feature vector, populate the feature vector with n-gram groupings of the second functions having the normalized arguments; and

train, using stochastic gradient descent, a machine learning model with the feature vector, the machine learning model to be deployed to an end-user device to detect malware in a second portable executable file.

6. The non-transitory computer readable storage medium of claim 5 , wherein the first functions include low-level programming language functions corresponding to the first portable executable file, and failure to execute the first portable executable file in the sandbox environment includes a crash of the first portable executable file at a computer implementing the sandbox environment.

7. The non-transitory computer readable storage medium of claim 5 , wherein the n-gram groupings include bigram groupings.

8. The non-transitory computer readable storage medium of claim 5 , wherein the feature vector is to reduce latency between a query of the machine learning model and an inference of whether the second portable executable file is malicious or benign.

9. An apparatus comprising:

means for processing communications to access a log file, the log file including a memory dump of first functions corresponding to a first portable executable file that failed to execute in a sandbox environment;

means for filtering log files to exclude at least one known clean function from the first functions of the log file to generate a filtered log file;

means for normalizing log files to generate normalized arguments of second functions of the filtered log file, the means for normalizing log files is to:

identify a first argument of a first function of the second functions of the filtered log file;

determine a data type of the first argument of the first function;

identify a placeholder representative of the data type of the first argument; and

replace the first argument of the first function with the placeholder representative of the data type of the first argument to generate a first normalized argument of the normalized arguments;

means for generating feature vectors to:

generate an empty version of a feature vector; and

after generating the empty version of the feature vector, populate the feature vector with n-gram groupings of the second functions having the normalized arguments; and

means for training a machine learning model using stochastic gradient descent based on the feature vector, the machine learning model to be deployed to an end-user device to detect malware in a second portable executable file.

10. The apparatus of claim 9 , wherein the first functions include low-level programming language functions corresponding to the first portable executable file, and failure to execute the first portable executable file in the sandbox environment includes a crash of the first portable executable file at a computer implementing the sandbox environment.

11. The apparatus of claim 9 , wherein the n-gram groupings include bigram groupings.