Methods and apparatus for detecting whether a string of characters represents malicious activity using machine learning
In some embodiments, a processor can receive an input string associated with a potentially malicious artifact and convert each character in the input string into a vector of values to define a character matrix. The processor can apply a convolution matrix to a first window of the character matrix to define a first subscore, apply the convolution matrix to a second window of the character matrix to define a second subscore and combine the first subscore and the second subscore to define a score for the convolution matrix. The processor can provide the score for the convolution matrix as an input to a machine learning threat model, identify the potentially malicious artifact as malicious based on an output of the machine learning threat model, and perform a remedial action on the potentially malicious artifact based on identifying the potentially malicious artifact as malicious.
1. A non-transitory processor-readable medium storing code representing instructions to be executed by a processor, the instructions comprising code to cause the processor to:
receive a string associated with an artifact;
apply a convolution matrix to a set of values associated with the string to define at least a portion of a feature vector;
provide the feature vector as an input to a machine learning threat model; and
identify the artifact associated with the string as malicious based on an output of the machine learning threat model meeting a predefined criterion.
2. The non-transitory processor-readable medium of claim 1 , the instructions further comprising code to cause the processor to:
convert each character in the string into a vector of values to define a character matrix including the set of values associated with the string.
3. The non-transitory processor-readable medium of claim 1 , the instructions further comprising code to cause the processor to:
perform a remedial action on the artifact based on identifying the artifact as malicious.
4. The non-transitory processor-readable medium of claim 1 , wherein the artifact is at least one of a function of software code, a webpage, a data file, a model file, a source file, a script, a binary executable file, a table in a database system, a development deliverable, a word-processing document, an email message, a text message, a network address, a file path, a device, or an entity.
5. The non-transitory processor-readable medium of claim 1 , the instructions further comprising code to cause the processor to:
select the convolution matrix from a set of convolution matrices based on metadata associated with the string.
6. The non-transitory processor-readable medium of claim 1 , wherein the set of values is a first set of values, the instructions to cause the processor to apply include instructions to cause the processor to apply the convolution matrix to the first set of values and a second set of values associated with the string to define the at least the portion of the feature vector.
7. The non-transitory processor-readable medium of claim 1 , wherein the convolution matrix is a first convolution matrix and the portion of the feature vector is a first portion of the feature vector, the method further comprising:
applying a second convolution matrix to the set of values to define a second portion of the feature vector.
8. An apparatus, comprising:
a memory; and
a hardware processor operatively coupled to the memory, the hardware processor configured to:
identify a set of values associated with a string;
select a convolution matrix based on metadata associated with the string;
apply the convolution matrix to the set of values associated with the string to define at least a portion of a feature vector;
provide the feature vector as an input to a machine learning threat model; and
identify an artifact associated with the string as malicious based on an output of the machine learning threat model.
9. The apparatus of claim 8 , wherein the metadata associated with the string includes at least one of a source of the string, a type of information represented by the string, or a size of the string.
10. The apparatus of claim 8 , wherein the artifact is at least one of a function of software code, a webpage, a data file, a model file, a source file, a script, a binary executable file, a table in a database system, a development deliverable, a word-processing document, an email message, a text message, a network address, a file path, a device, or an entity.
11. The apparatus of claim 8 , wherein the hardware processor is configured to perform a remedial action on the artifact based on identifying the artifact as malicious.
12. The apparatus of claim 8 , wherein the set of values is a first set of values, the hardware processor configured to apply the convolution matrix to the first set of values and a second set of values associated with the string to define the at least the portion of the feature vector.
13. The apparatus of claim 8 , wherein the convolution matrix is a first convolution matrix and the portion of the feature vector is a first portion of the feature vector, the hardware processor configured to apply a second convolution matrix to the set of values to define a second portion of the feature vector.
14. The apparatus of claim 8 , wherein the machine learning threat model is at least one of a deep neural network threat model, a decision tree model, a Bayesian network or a clustering model.
15. A method, comprising:
applying a first convolution matrix to a set of values associated with a string to define a first portion of a feature vector, the string associated with an artifact;
applying a second convolution matrix to the set of values associated with the string to define a second portion of the feature vector;
providing the feature vector as an input to a machine learning threat model; and
identifying the artifact associated with the string as malicious based on an output of the machine learning threat model meeting a predefined criterion.
16. The method of claim 15 , wherein the artifact is at least one of a function of software code, a webpage, a data file, a model file, a source file, a script, a binary executable file, a table in a database system, a development deliverable, a word-processing document, an email message, a text message, a network address, a file path, a device, or an entity.
17. The method of claim 15 , further comprising:
performing a remedial action on the artifact based on identifying the artifact as malicious.
18. The method of claim 15 , wherein the first convolution matrix is selected to detect a first feature of the string and the second convolution matrix is selected to detect a second feature of the string different than the first feature.
19. The method of claim 15 , wherein the set of values is a first set of values, the hardware processor configured to apply the first convolution matrix to the first set of values and a second set of values associated with the string to define the first portion of the feature vector.
20. The method of claim 15 , wherein the machine learning threat model is at least one of a deep neural network threat model, a decision tree model, a Bayesian network or a clustering model.