Methods and apparatus to augment classification coverage for low prevalence samples through neighborhood labels proximity vectors

A non-transitory machine readable storage medium comprising instructions that cause one or more processor circuit to at least:

• select, from a feature vector of an unclassified sample, features that are of a categorical nature;
• hash the selected features to generate a vector;
• query a locality sensitive hashing (LSH) forest with the vector to retrieve a plurality of similar neighbor samples independent of a prevalence of the similar neighbor samples in a dataset;
• obtain the plurality of similar neighbor samples from the LSH forest;
• and
• classify the unclassified sample as either clean or malicious based on the plurality of similar neighbor samples, wherein low-prevalence neighbor samples of the plurality of similar neighbor samples influence the classifying with a same likelihood as high-prevalence neighbor samples of the plurality of similar neighbor samples.

A method, comprising:

• selecting, from a feature vector of an unclassified sample, features that are either of a categorical nature or that are to be transformed from numerical to categorical values;
• hashing the selected features to generate a vector;
• querying a locality sensitive hashing (LSH) forest with the vector to retrieve a plurality of similar neighbor samples independent of a prevalence of the similar neighbor samples in a dataset;
• obtaining the plurality of similar neighbor samples from the LSH forest;
• and
• classifying the unclassified sample as either clean or malicious based on the plurality of similar neighbor samples, wherein low-prevalence neighbor samples of the plurality of similar neighbor samples influence the classifying with a same likelihood as high-prevalence neighbor samples of the plurality of similar neighbor samples.