Methods and apparatus to augment classification coverage for low prevalence samples through neighborhood labels proximity vectors
Disclosed examples include obtaining malicious neighbor samples based on a non-classified sample; obtaining clean neighbor samples based on the non-classified sample; generating a malicious proximity vector representing first distances between the non-classified sample and a first malicious neighbor sample from the malicious neighbor samples; generating a clean proximity vector representing second distances between the non-classified sample and a first clean neighbor sample from the clean neighbor samples; and classifying the non-classified sample as a clean sample or a malicious sample based on at least one of the malicious proximity vector or the clean proximity vector.
1 . An apparatus comprising:
interface circuitry;
machine-readable instructions; and
at least one processor circuit to be programmed by the machine-readable instructions to:
obtain malicious neighbor samples based on a non-classified sample;
obtain clean neighbor samples based on the non-classified sample;
generate a malicious proximity vector representing first distances between the non-classified sample and a first malicious neighbor sample from the malicious neighbor samples;
generate a clean proximity vector representing second distances between the non-classified sample and a first clean neighbor sample from the clean neighbor samples; and
classify the non-classified sample as a clean sample or a malicious sample based on at least one of the malicious proximity vector or the clean proximity vector.
2 . The apparatus of claim 1 , wherein the non-classified sample corresponds to a file that is not classified as malicious or clean.
3 . The apparatus of claim 1 , wherein the first distances include at least one of a hamming distance, a Euclidean distance, or a token set ratio distance.
4 . The apparatus of claim 1 , wherein one or more of the at least one processor circuit is to:
sort the first distances in the malicious proximity vector based on a first one of the first distances first and a second one of the first distances second; and
sort the second distances in the clean proximity vector based on a first one of the second distances first and a second one of the second distances second.
5 . The apparatus of claim 1 , wherein one or more of the at least one processor circuit is to:
generate a hash table based on the non-classified sample;
obtain the malicious neighbor samples from a malicious locality sensitive hashing (LSH) forest based on the hash table; and
obtain the clean neighbor samples from a clean LSH forest based on the hash table.
6 . The apparatus of claim 1 , wherein one or more of the at least one processor circuit is to output a classification of the non-classified sample as the clean sample or the malicious sample after a determination that a feature-based classification of the non-classified sample does not satisfy a threshold.
7 . The apparatus of claim 1 , wherein a quantity of the first distances is based on a quantity of datatypes in the at least one of the malicious neighbor samples or the clean neighbor samples, a quantity of the second distances is based on the quantity of the datatypes.
8 . At least one non-transitory machine-readable medium comprising machine-readable instructions to cause at least one processor circuit to at least:
request malicious neighbor samples based on a non-classified sample;
request clean neighbor samples based on the non-classified sample;
cause storing of a malicious proximity vector, the malicious proximity vector representing first distances between the non-classified sample and a first malicious neighbor sample from the malicious neighbor samples;
cause storing of a clean proximity vector, the clean proximity vector representing second distances between the non-classified sample and a first clean neighbor sample from the clean neighbor samples; and
classify the non-classified sample as clean or malicious based on at least one of the malicious proximity vector or the clean proximity vector.
9 . The at least one non-transitory machine-readable medium of claim 8 , wherein the non-classified sample corresponds to a file.
10 . The at least one non-transitory machine-readable medium of claim 8 , wherein the first distances include at least one of a hamming distance, a Euclidean distance, or a token set ratio distance.
11 . The at least one non-transitory machine-readable medium of claim 8 , wherein the machine-readable instructions are to cause one or more of the at least one processor circuit to:
sort the first distances in the malicious proximity vector based on a first one of the first distances first and a second one of the first distances second; and
sort the second distances in the clean proximity vector based on a first one of the second distances first and a second one of the second distances second.
12 . The at least one non-transitory machine-readable medium of claim 8 , wherein the machine-readable instructions are to cause one or more of the at least one processor circuit to:
generate a hash table based on the non-classified sample;
request the malicious neighbor samples from a malicious locality sensitive hashing (LSH) forest based on the hash table; and
request the clean neighbor samples from a clean LSH forest based on the hash table.
13 . The at least one non-transitory machine-readable medium of claim 8 , wherein the machine-readable instructions are to cause one or more of the at least one processor circuit to output a malicious classification or a clean classification of the non-classified sample based on the at least one of the malicious proximity vector or the clean proximity vector after a determination that a feature-based classification of the non-classified sample does not satisfy a threshold.
14 . The at least one non-transitory machine-readable medium of claim 8 , wherein a quantity of the first distances is based on a quantity of datatypes in the malicious neighbor samples and the clean neighbor samples, a quantity of the second distances is based on the quantity of the datatypes.
15 . A method comprising:
identifying malicious neighbor samples based on a non-classified sample;
identifying clean neighbor samples based on the non-classified sample;
generating, by at least one processor circuit programmed by at least one instruction, a malicious proximity vector that includes first distance values, the first distance values representing first distances between the non-classified sample and a first malicious neighbor sample from the malicious neighbor samples;
generating, by one or more of the at least one processor circuit, a clean proximity vector that includes second distance values, the second distance values representing second distances between the non-classified sample and a first clean neighbor sample from the clean neighbor samples; and
generating, by one or more of the at least one processor circuit, a classification of the non-classified sample as a clean sample or a malicious sample based on at least one of the malicious proximity vector or the clean proximity vector.
16 . The method of claim 15 , wherein the non-classified sample corresponds to a file that is not classified as malicious or clean.
17 . The method of claim 15 , wherein the first distances include at least one of a hamming distance, a Euclidean distance, or a token set ratio distance.
18 . The method of claim 15 , including:
sorting the first distance values in the malicious proximity vector based on a first one of the first distances first and a second one of the first distances second; and
sorting the second distance values in the clean proximity vector based on a first one of the second distances first and a second one of the second distances second.
19 . The method of claim 15 , including generating a hash table based on the non-classified sample, the identifying of the malicious neighbor samples is from a malicious locality sensitive hashing (LSH) forest based on the hash table, the identifying of the clean neighbor samples is from a clean LSH forest based on the hash table.
20 . The method of claim 15 , including outputting the classification of the non-classified sample as the clean sample or the malicious sample after a determination that a feature-based classification of the non-classified sample does not satisfy a threshold.