Injected byte buffer data classification

A system, comprising:

• a processor, and
• at least one memory storing instructions executed by the processor to perform actions including:
• obtaining injected byte buffer data from a security agent, the injected byte buffer data having resulted from data being injected into a byte buffer;
• classifying the injected byte buffer data, comprising:
• providing the injected byte buffer data as an input to a trained transformer type neural network machine learning model, wherein at least a portion of the injected byte buffer data is provided to the trained transformer type neural network machine learning model in an unmodified form without determining features of the injected byte buffer data or imposing a modality or encoding on the injected byte buffer data,
• classifying the injected byte buffer data by the trained transformer type neural network machine learning model, resulting in a classification output,
• wherein the classification output comprises an indication of whether the injected byte buffer data is associated with a malicious process;
• and
• providing the classification output to the security agent.

A non-transitory computer-readable storage medium storing computer-readable instructions, that when executed by a processor, cause the processor to perform actions comprising:

• detecting, by a network security agent in a network, an injection of code at an endpoint device in a network;
• generating, by the network security agent, a security event associated with the injection of code, wherein the generating the security event comprises logging injected byte buffer data, the injected byte buffer data having resulted from data being injected into a byte buffer;
• sending, by the network security agent, the injected byte buffer data to a remote security service outside the network and configured to return a classification output comprising a probability that the injected byte buffer data is associated with a malicious process, wherein at least a portion of the injected byte buffer data is provided to a trained transformer type neural network machine learning model in an unmodified form without determining features of the injected byte buffer data or imposing a modality or encoding on the injected byte buffer data;
• receiving, by the network security agent, the classification output from the remote security service;
• determining, by the network security agent, whether the classification output exceeds a threshold probability that the injected byte buffer data is associated with the malicious process;
• and
• stopping, by the network security agent, the malicious process in response to the determining that the classification output exceeds the threshold probability.