Apparatus and methods to classify malware with explainability with artificial intelligence models

A non-transitory computer readable storage medium comprising instructions which, when executed, cause at least one processor to at least:

• generate feature vectors from a first input;
• train a neural network model using a first portion of the feature vectors;
• add one or more fully connected layers to the trained neural network model to form a hybrid model;
• validate the hybrid model using a second portion of the feature vectors;
• and
• deploy the validated hybrid model as a malware classifier, the malware classifier to provide a malware classification with explainability in response to a second input.

A method to classify malware with explainability, the method comprising:

• generating, by executing an instruction with a processor, feature vectors from a first input;
• training, by executing an instruction with the processor, a neural network model using a first portion of the feature vectors;
• adding, by executing an instruction with the processor, one or more fully connected layers to the trained neural network model to form a hybrid model;
• validating, by executing an instruction with the processor, the hybrid model using a second portion of the feature vectors;
• and
• deploying, by executing an instruction with the processor, the validated hybrid model as a malware classifier, the malware classifier to provide a malware classification with explainability in response to a second input.

An apparatus comprising:

• means for generating feature vectors from a first input;
• means for training a neural network model using a first portion of the feature vectors, the means for training to add one or more fully connected layers to the trained neural network model to form a hybrid model and validate the hybrid model using a second portion of the feature vectors;
• and
• means for deploying the validated hybrid model as a malware classifier, the malware classifier to provide a malware classification with explainability in response to a second input.