Methods and apparatus to translate hash-based signature signals for machine learning applications

A non-transitory machine readable storage medium comprising instructions that, when executed, cause processor circuitry to at least:

• determine an element count for a plurality of hash elements of a locality sensitivity hash;
• preserve ones of hash elements of the plurality of hash elements that satisfy an element count threshold;
• compare a hash element of the plurality of hash elements to the preserved ones of the hash elements;
• encode at least one feature vector including the hash element at a location of the hash element based on the hash element being one of the preserved ones of the hash elements;
• produce a cluster of encoded feature vectors based on the at least one feature vector;
• determine an occurrence frequency of hash elements in the cluster;
• and
• create a synthetic hash of the cluster based on a subset of the hash elements in the cluster that satisfy an occurrence frequency threshold, wherein the synthetic hash includes a hash element for a group of similar hash elements that satisfy the occurrence frequency threshold, the synthetic hash to represent relevant features of the plurality of hash elements.

An apparatus comprising:

• at least one memory;
• machine readable instructions;
• and
• processor circuitry to at least one of instantiate or execute the machine readable instructions to:
• group ones of a plurality of locality sensitive hashes that are equal into a first locality sensitive hash group, the first locality sensitive hash group corresponding to a first locality sensitive hash of the plurality of locality sensitive hashes;
• add the first locality sensitive hash to a list of anchor candidates in response to the first locality sensitive hash satisfying a minimum group maliciousness percentage, where the minimum group maliciousness percentage is based on a number of the ones of the plurality of locality sensitive hashes associated with a malicious origin;
• compute a plurality of resemblances of the locality sensitivity hash to a plurality of anchor candidates in the list of anchor candidates;
• sort the plurality of resemblances based on similarity value;
• and
• incorporate a first resemblance of the plurality of resemblances into a feature set for a training dataset of samples, wherein the first resemblance satisfies a similarity value threshold.

A non-transitory machine readable storage medium comprising instructions that, when executed, cause processor circuitry to at least:

• obtain a plurality of locality sensitive hashes from a training dataset of samples;
• group ones of a plurality of locality sensitive hashes that are equal into a first locality sensitive hash group, the first locality sensitive hash group corresponding to a first locality sensitive hash of the plurality of locality sensitive hashes;
• add the first locality sensitive hash to a list of anchor candidates in response to the first locality sensitive hash satisfying a minimum group maliciousness percentage, where the minimum group maliciousness percentage is based on a number of the ones of the plurality of locality sensitive hashes associated with a malicious origin;
• compute a plurality of resemblances of the locality sensitivity hash to a plurality of anchor candidates in the list of anchor candidates;
• sort the plurality of resemblances based on similarity value;
• and
• incorporate a first resemblance of the plurality of resemblances into a feature set for the training dataset of samples, wherein the first resemblance satisfies a similarity value threshold.