Methods and apparatus for using machine learning to classify malicious infrastructure

A non-transitory processor-readable medium storing code representing instructions to be executed by a processor, the instructions comprising code to cause the processor to:

• identify an internet protocol (IP) address associated with potentially malicious content;
• define a matrix based on the IP address;
• define each row from a set of rows of the matrix by applying a different subnet mask from a plurality of subnet masks to a binary representation of the IP address to define that row of the matrix;
• apply a convolutional window across the set of rows of the matrix to identify a relative contribution of each row from the set of rows to define a representation of the matrix;
• infer a representation of an internet service provider (ISP) associated with the IP address by providing the IP address as an input to a first machine learning model;
• provide the matrix and the representation of the ISP associated with the IP address as inputs to a second machine learning model trained to generate a classification associated with the IP address based on the matrix and the representation of the ISP associated with the IP address;
• and
• receive, from the second machine learning model, a score associated with a maliciousness of the IP address, the score being based on the classification associated with the IP address.

A method, comprising:

• identifying an internet protocol (IP) address associated with potentially malicious content;
• defining a matrix based on the IP address, each row of the matrix including a representation of a different subnet of the IP address;
• identifying a set of characteristics associated with the IP address;
• defining a feature vector based on the set of characteristics;
• providing the matrix and the feature vector as inputs to a convolutional neural network (CNN) trained to generate a classification associated with the IP address based on the matrix and the feature vector, wherein the CNN slides a convolutional window across the matrix to identify a relative contribution of a set of features in the matrix;
• and
• receiving, from the CNN, a score associated with a maliciousness of the IP address, the score being based on the classification associated with the IP address.