Methods and apparatus for detecting whether a string of characters represents malicious activity using machine learning

A non-transitory processor-readable medium storing code representing instructions to be executed by a processor, the code comprising code to cause the processor to:

• receive an input string associated with a potentially malicious artifact;
• convert each character in the input string into a vector of values to define a character matrix;
• select a convolution matrix;
• apply the convolution matrix to a first window of the character matrix to define a first sub score;
• apply the convolution matrix to a second window of the character matrix to define a second sub score;
• combine the first sub score and the second sub score to define a score for the convolution matrix;
• provide the score for the convolution matrix as an input to a machine learning threat model;
• identify the potentially malicious artifact associated with the input string as malicious based on an output of the machine learning threat model;
• and
• perform a remedial action on the potentially malicious artifact based on identifying the potentially malicious artifact as malicious.

A method, comprising:

• receiving a Uniform Resource Locator (URL) associated with a website;
• converting each character in the URL into a vector of values to define a character matrix;
• applying a first convolution matrix to a set of values within the character matrix to define at least a portion of a first score;
• applying a second convolution matrix to the set of values within the character matrix to define at least a portion of a second score;
• providing the first score and the second score as inputs to a machine learning threat model;
• identifying an artifact associated with the URL as malicious based on an output of the machine learning threat model meeting a predefined criterion;
• and
• performing a remedial action on the artifact based on identifying the artifact as malicious.