Methods and apparatus for machine learning to generate a decision tree database to identify commands similar to a command of interest

An apparatus, comprising:

• a memory including processor-executable instructions;
• and
• one or more hardware processors in communication with the memory that, having executed the processor-executable instructions, are configured to:
• receive an indication of a potentially malicious behavior associated with a first feature and a second feature;
• determine, based on the potentially malicious behavior and using one or more models, (1) a first set of similar behaviors, each similar behavior from the first set of similar behaviors including the first feature, and (2) a second set of similar behaviors from the first set of similar behaviors that were previously detected;
• determine a first probability that the potentially malicious behavior will be escalated as potentially malicious based on the first set of similar behaviors and the second set of similar behaviors;
• cause display of at least one of a representation of the first feature, a first indication quantifying the first set of similar behaviors, a second indication quantifying the second set of similar behaviors, or the first probability;
• determine, using the one or more models, (1) a third set of similar behaviors, each similar behavior from the third set of similar behaviors including the first feature and the second feature, and (2) a fourth set of similar behaviors from the third set of similar behaviors that were previously detected;
• determine a second probability that the potentially malicious behavior will be escalated as potentially malicious based on the third set of similar behaviors and the fourth set of similar behaviors;
• and
• cause display of at least one of a representation of the second feature, a third indication quantifying the third set of similar behaviors, a fourth indication quantifying the fourth set of similar behaviors, or the second probability.

A non-transitory processor-readable medium storing code representing instructions to be executed by one or more processors, the instructions comprising code to cause the one or more processors to:

• receive a potentially malicious command including a plurality of features;
• traverse, based on the plurality of features, a plurality of nodes included in a decision tree to identify a leaf node included in the plurality of nodes, the leaf node associated with (1) a first set of similar commands, each similar command from the first set of similar commands including the plurality of features, and (2) a second set of similar commands from the first set of similar commands that were previously detected;
• determine a probability that the potentially malicious command will be escalated as potentially malicious based on the first set of similar commands and the second set of similar commands;
• and
• cause display of a first indication quantifying the first set of similar commands, a second indication quantifying the second set of similar commands, and the probability.