Methods and apparatus to improve detection of malware in executable code

A non-transitory computer readable storage medium comprising instructions which, when executed, cause one or more processors to at least:

• access a log file, the log file including a memory dump of first functions corresponding to a first portable executable file that failed to execute in a sandbox environment;
• exclude at least one known clean function from the first functions of the log file to generate a filtered log file including second functions;
• identify a first argument of a first function of the second functions of the filtered log file;
• determine a data type of the first argument of the first function;
• identify a placeholder representative of the data type of the first argument;
• replace the first argument of the first function with the placeholder representative of the data type of the first argument;
• generate normalized arguments using at least the first replaced argument;
• generate an empty version of a feature vector;
• after generating the empty version of the feature vector, populate the feature vector with n-gram groupings of the second functions having the normalized arguments;
• and
• train, using stochastic gradient descent, a machine learning model with the feature vector, the machine learning model to be deployed to an end-user device to detect malware in a second portable executable file.

An apparatus comprising:

• means for processing communications to access a log file, the log file including a memory dump of first functions corresponding to a first portable executable file that failed to execute in a sandbox environment;
• means for filtering log files to exclude at least one known clean function from the first functions of the log file to generate a filtered log file;
• means for normalizing log files to generate normalized arguments of second functions of the filtered log file, the means for normalizing log files is to:
• identify a first argument of a first function of the second functions of the filtered log file;
• determine a data type of the first argument of the first function;
• identify a placeholder representative of the data type of the first argument;
• and
• replace the first argument of the first function with the placeholder representative of the data type of the first argument to generate a first normalized argument of the normalized arguments;
• means for generating feature vectors to:
• generate an empty version of a feature vector;
• and
• after generating the empty version of the feature vector, populate the feature vector with n-gram groupings of the second functions having the normalized arguments;
• and
• means for training a machine learning model using stochastic gradient descent based on the feature vector, the machine learning model to be deployed to an end-user device to detect malware in a second portable executable file.