Sample classification using natural language processing models
Sample classification using natural language processing (NLP) models is disclosed herein. An example apparatus comprises interface circuitry, machine readable instructions, and programmable circuitry to at least one of instantiate or execute the machine readable instructions to access a set of instructions, the set of instructions representing executable instructions, determine an Application Programming Interface (API) call sequence based on the set of instructions, transmit the API call sequence to a NLP model, the NLP model to generate a set of tokens, the set of tokens representing the API call sequence, the set of tokens readable in the NLP model, and classify the API call sequence as clean or malicious based on the tokens, and classify the set of instructions as clean or malicious based on the classification of the API call sequence and at least one other feature of the set of instructions.
1. An apparatus comprising:
interface circuitry;
machine readable instructions; and
programmable circuitry to at least one of instantiate or execute the machine readable instructions to:
access a set of instructions, the set of instructions representing executable instructions;
determine an Application Programming Interface (API) call sequence based on the set of instructions;
transmit the API call sequence to model executor circuitry for execution of a natural language processing (NLP) model, the execution of the NLP model to cause the model executor circuitry to:
generate a set of tokens, the set of tokens representing the API call sequence, the set of tokens readable in the NLP model; and
classify the API call sequence as clean or malicious based on the tokens; and
classify the set of instructions as clean or malicious based on the classification of the API call sequence and at least one other feature of the set of instructions.
2. The apparatus of claim 1 , wherein the programmable circuitry is to cause the model executor circuitry to parse the API call sequence to generate the set of tokens.
3. The apparatus of claim 1 , wherein the set of instructions is an executable file, wherein the programmable circuitry is to generate the API call sequence by executing the executable file in a sandbox environment and recording the API call sequence based on the execution of the set of instructions.
4. The apparatus of claim 1 , wherein first ones of the tokens are clean and second ones of the tokens are malicious.
5. The apparatus of claim 4 , wherein the programmable circuitry is to:
determine a first probability that the API call sequence is clean based on the first ones of the tokens;
determine a second probability that the API call sequence is malicious based on the second ones of the tokens; and
classify the API call sequence as malicious when the second probability is greater than the first probability.
6. The apparatus of claim 1 , wherein the programmable circuitry is to:
compare the set of instructions to known samples, the known samples stored in a database, the database including known API call sequences corresponding to the known samples;
associate the set of instructions with a first one of the known samples when the set of instructions matches the first one of the known samples; and
determine the API call sequence based on the match, the API call sequence associated with a first one of the known API call sequences, the first one of the known API call sequences corresponding to the first one of the known samples.
7. The apparatus of claim 6 , wherein the programmable circuitry is to:
compare a hash of the set of instructions to a hash of the first one of the known samples; and
associate the set of instructions with the first one of the known samples when the hash of the set of instructions matches the hash of the first one of the known samples.
8. The apparatus of claim 1 , wherein the programmable circuitry includes the model executor circuitry.
9. A non-transitory machine readable storage medium comprising instructions to cause programmable circuitry to at least:
access a set of instructions, the set of instructions representing executable instructions;
determine an Application Programming Interface (API) call sequence based on the set of instructions;
transmit the API call sequence to model executor circuitry for execution of a natural language processing (NLP) model, the execution of the NLP model to cause the model executor circuitry to:
generate a set of tokens, the set of tokens representing the API call sequence, the set of tokens readable in the NLP model; and
classify the API call sequence as clean or malicious based on the tokens; and
classify the set of instructions as clean or malicious based on the classification of the API call sequence and at least one other feature of the set of instructions.
10. The non-transitory machine readable storage medium of claim 9 , wherein the instructions cause the programmable circuitry to cause the model executor circuitry to parse the API call sequence to generate the set of tokens.
11. The non-transitory machine readable storage medium of claim 9 , wherein the set of instructions is an executable file, wherein the instructions cause the programmable circuitry to generate the API call sequence by executing the executable file in a sandbox environment and recording the API call sequence based on the execution of the set of instructions.
12. The non-transitory machine readable storage medium of claim 9 , wherein first ones of the tokens are clean and second ones of the tokens are malicious.
13. The non-transitory machine readable storage medium of claim 12 , wherein the instructions cause the programmable circuitry to:
determine a first probability that the API call sequence is clean based on the first ones of the tokens;
determine a second probability that the API call sequence is malicious based on the second ones of the tokens; and
classify the API call sequence as malicious when the second probability is greater than the first probability.
14. The non-transitory machine readable storage medium of claim 9 , wherein the instructions cause the programmable circuitry to:
compare the set of instructions to known samples, the known samples stored in a database, the database including known API call sequences corresponding to the known samples;
associate the set of instructions with a first one of the known samples when the set of instructions matches the first one of the known samples; and
determine the API call sequence based on the match, the API call sequence associated with a first one of the known API call sequences, the first one of the known API call sequences corresponding to the first one of the known samples.
15. The non-transitory machine readable storage medium of claim 14 , wherein the instructions cause the programmable circuitry to:
compare a hash of the set of instructions to a hash of the first one of the known samples; and
associate the set of instructions with the first one of the known samples when the hash of the set of instructions matches the hash of the first one of the known samples.
16. The non-transitory machine readable storage medium of claim 9 , wherein the programmable circuitry includes the model executor circuitry.
17. A method comprising:
accessing, with programmable circuitry, a set of instructions, the set of instructions representing executable instructions;
determining, with the programmable circuitry, an Application Programming Interface (API) call sequence based on the set of instructions;
transmitting, with the programmable circuitry, the API call sequence to a natural language processing (NLP) model, the NLP model to:
generate a set of tokens, the set of tokens representing the API call sequence, the set of tokens readable in the NLP model; and
classify the API call sequence as clean or malicious based on the tokens; and
classifying, with the programmable circuitry, the set of instructions as clean or malicious based on the classification of the API call sequence and at least one other feature of the set of instructions.
18. The method of claim 17 , further including parsing the API call sequence to generate the set of tokens.
19. The method of claim 17 , wherein the set of instructions is an executable file, further including:
generating the API call sequence by executing the executable file in a sandbox environment; and
recording the API call sequence based on the execution of the set of instructions.
20. The method of claim 17 , wherein first ones of the tokens are clean and second ones of the tokens are malicious.
21. The method of claim 20 , further including:
determining a first probability that the API call sequence is clean based on the first ones of the tokens;
determining a second probability that the API call sequence is malicious based on the second ones of the tokens; and
classifying the API call sequence as malicious when the second probability is greater than the first probability.
22. The method of claim 17 , further including:
comparing the set of instructions to known samples, the known samples stored in a database, the database including known API call sequences corresponding to the known samples;
associating the set of instructions with a first one of the known samples when the set of instructions matches the first one of the known samples; and
determining the API call sequence based on the match, the API call sequence associated with a first one of the known API call sequences, the first one of the known API call sequences corresponding to the first one of the known samples.