Techniques for utilizing embeddings to monitor process trees

A system comprising:

• a memory;
• and
• a processing device, operatively coupled to the memory, to:
• generate a process tree embedding corresponding to a process tree, the process tree comprising a plurality of processes, wherein the processing device is further to:
• generate, for each of the plurality of processes, a respective process embedding based on metadata associated with that process;
• and
• aggregate the respective process embeddings to generate the process tree embedding;
• and
• process the process tree embedding with a machine learning model to generate an identification of malware associated with the process tree, the processing device further to:
• identify a target process, from the plurality of processes, that correspond to an execution associated with the malware;
• identify, from the plurality of processes, an ancestor process of the target process that is associated with spawning the target process;
• and
• produce a natural language explanation that describes, in human-readable terms, which one or more of the plurality of processes in the process tree are relevant in the identification of the malware, the natural language explanation identifying a comparative prioritization of which of the plurality of processes influence a classification of the process tree as being associated with the malware.

A non-transitory computer-readable storage medium including instructions that, when executed by a processing device, cause the processing device to:

• generate a process tree embedding corresponding to a process tree, the process tree comprising a plurality of processes, wherein the processing device is further to:
• generate, for each of the plurality of processes, a respective process embedding based on metadata associated with that process;
• and
• aggregate the respective process embeddings to generate the process tree embedding;
• and
• process, by the processing device, the process tree embedding with a machine learning model to generate an identification of malware associated with the process tree, the processing device further to:
• identify a target process, from the plurality of processes, that correspond to an execution associated with the malware;
• identify, from the plurality of processes, an ancestor process of the target process that is associated with spawning the target process;
• and
• produce a natural language explanation that describes, in human-readable terms, which one or more of the plurality of processes in the process tree are relevant in the identification of the malware, the natural language explanation identifying a comparative prioritization of which of the plurality of processes influence a classification of the process tree as being associated with the malware.