Abstract: Systems and techniques are generally described for anomaly detection in text. In some examples, text data comprising a plurality of words may be received. An image of a first word of the plurality of words may be generated. A feature representation of the first word may be generated using a variational autoencoder. A score may be generated based at least in part on the feature representation. In various examples, the score may indicate a likelihood that an appearance of the first word in the image of the first word is anomalous with respect to at least some other words of the plurality of words.

Abstract: Systems and methods are described for natural language processing of a text sequence. The system can identify a set of text and location information for the set of text in an image. The set of text may correspond to an input sequence space. The system can project embeddings of the text into a latent space for processing. Further, the system can reproject the processed embeddings from the latent space to the input sequence space. The system may perform multiple stages of projecting the embeddings to the latent space and reprojecting the processed embeddings from the latent space to the input sequence space. The system can route the reprojected embeddings to a neural network that can identify class predictions for elements of the set of text.

Abstract: A malware detection system and method for determining whether an executable script is malware is presented. The malware detection system determines whether the executable script is malware by comparing the functional contents of the executable script to the functional contents of known malware. In practice, the executable script is obtained. The executable script is normalized, thereby generating a script signature corresponding to the functionality of the executable script. The script signature is compared to known malware script signatures in a malware signature store to determine whether the executable script is malware. If a complete match is made, the executable script is considered to be malware. If a partial match is made, the executable script is considered to likely be malware. The malware detection system may perform two normalizations, each normalization generating a script signature which is compared to similarly normalized known malware script signatures in the malware signature store.