Methods and apparatus for generic process chain entity mapping

1. An apparatus to perform process chain entity mapping, the apparatus comprising:

at least one memory;

instructions in the apparatus; and

processor circuitry to execute the instructions to:

receive process chain input data, the input data including a system path;

identify a match between a path alias and the input data, wherein the path alias includes an alias for one or more system path format patterns;

extract at least one of (1) metadata information or (2) command line parameter information from the match; and

output transformed data based on the at least one of the metadata information or command line parameter information.

2. The apparatus of claim 1 , wherein the process chain input data includes at least one of an executable file, a text file, or a Uniform Resource Locator (URL) file.

3. The apparatus of claim 1 , wherein the processor circuitry is to identify the path alias using path alias mapping rules, the mapping rules based on empirical evidence obtained using field telemetry data.

4. The apparatus of claim 1 , wherein the process circuitry is to prioritize select system path format patterns when identifying the match.

5. The apparatus of claim 1 , wherein the metadata information includes at least one of a file reputation or a process extension.

6. The apparatus of claim 1 , wherein the command line parameter information includes at least one of a registry key path or an internet protocol address.

7. The apparatus of claim 1 , wherein the processor circuitry is to identify the process chain input data as clean or malicious based on the transformed data output.

8. The apparatus of claim 1 , wherein the processor circuitry is to perform iterative mapping to discriminate future input data as clean or malicious.

9. The apparatus of claim 1 , wherein the transformed data retains original entity characteristics to retain an original input signal associated with the input data.

10. A non-transitory computer readable storage medium comprising instructions which, when executed, cause at least one processor to at least:

receive process chain input data, the input data including a system path;

identify a match between a path alias and the input data, wherein the path alias includes an alias for one or more system path format patterns;

extract at least one of (1) metadata information or (2) command line parameter information from the match; and

output transformed data based on the at least one of the metadata information or the command line parameter information.

11. The non-transitory computer readable storage medium of claim 10 , wherein the instructions, when executed, cause the at least one processor to identify the path alias using path alias mapping rules, the mapping rules based on empirical evidence obtained using field telemetry data.

12. The non-transitory computer readable storage medium of claim 10 , wherein the instructions, when executed, cause the at least one processor to prioritize select system path format patterns when identifying the match.

13. The non-transitory computer readable storage medium of claim 10 , wherein the instructions, when executed, cause the at least one processor to identify the process chain input data as clean or malicious based on the transformed data output.

14. A method to perform process chain entity mapping, the method comprising:

receiving, by executing an instruction with a processor, process chain input data, the input data including a system path;

identifying, by executing an instruction with a processor, a match between a path alias and the input data, wherein the path alias includes an alias for one or more system path format patterns;

extracting, by executing an instruction with a processor, at least one of (1) metadata information or (2) command line parameter information from the match; and

outputting, by executing an instruction with a processor, transformed data based on the at least one of the metadata information or the command line parameter information.

15. The method of claim 14 , further including identifying, by executing an instruction with a processor, the path alias using path alias mapping rules, the mapping rules based on empirical evidence obtained using field telemetry data.

16. The method of claim 14 , further including identifying, by executing an instruction with a processor, the process chain input data as clean or malicious based on the transformed data output.

17. The method of claim 14 , further including performing, by executing an instruction with a processor, iterative mapping to discriminate future input data as clean or malicious.

18. An apparatus comprising:

means for receiving process chain input data, the input data including a system path;

means for identifying a match between a path alias and the input data, wherein the path alias includes an alias for one or more system path format patterns;

means for extracting at least one of (1) metadata information or (2) command line parameter information from the match; and

means for outputting transformed data based on the metadata information or the command line parameter information.

19. The apparatus of claim 18 , wherein the means for identifying includes identifying the path alias using path alias mapping rules, the mapping rules based on empirical evidence obtained using field telemetry data.

20. The apparatus of claim 18 , wherein the means for extracting includes extracting at least one of a file reputation or a process extension.