Abstract: Methods and apparatus are disclosed to detect malware using micro-forests with customer trust seeds. A false positive correction apparatus includes processor circuitry to perform at least one of the first operations, the second operations or the third operations to instantiate classifier circuitry to access a malicious sample, the malicious sample having a first feature vector, sample comparison circuitry to compare the malicious sample to a known sample, the known sample collected from customer data, the known sample having a second feature vector, calculator circuitry to calculate a distance value between the first feature vector and the second feature vector, threshold comparator circuitry to compare the distance value to a threshold, and change the classification of the malicious sample to clean in response to the distance value satisfying the threshold.

Abstract: Apparatus, systems, and methods to classify malware with explainability are disclosed. An example apparatus includes at least one memory; instructions in the apparatus; and processor circuitry. The example processor circuitry is to execute the instructions to: generate feature vectors from a first input; train a neural network model using a first portion of the feature vectors; add one or more fully connected layers to the trained neural network model to form a hybrid model; validate the hybrid model using a second portion of the feature vectors; and deploy the validated hybrid model as a malware classifier, the malware classifier to provide a malware classification with explainability in response to a second input.

Abstract: Methods, apparatus, systems, and articles of manufacture to provide and monitor efficacy of artificial intelligence models are disclosed. An example apparatus includes a model trainer to train an artificial intelligence (AI) model to classify malware using first training data; an interface to deploy the AI model to a processing device; a model implementor to locally apply second training data to the AI model to generate output classifications, the second training data generated after generation of the first training data; and a report generator to generate a report including an efficacy of the AI model based on the output classifications.

Abstract: Apparatus, systems, and methods to classify malware with explainability are disclosed. An example apparatus includes at least one memory; instructions in the apparatus; and processor circuitry. The example processor circuitry is to execute the instructions to: generate feature vectors from a first input; train a neural network model using a first portion of the feature vectors; add one or more fully connected layers to the trained neural network model to form a hybrid model; validate the hybrid model using a second portion of the feature vectors; and deploy the validated hybrid model as a malware classifier, the malware classifier to provide a malware classification with explainability in response to a second input.

Abstract: Methods and apparatus are disclosed to detect malware using micro-forests with customer trust seeds. A false positive correction apparatus includes processor circuitry to perform at least one of the first operations, the second operations or the third operations to instantiate classifier circuitry to access a malicious sample, the malicious sample having a first feature vector, sample comparison circuitry to compare the malicious sample to a known sample, the known sample collected from customer data, the known sample having a second feature vector, calculator circuitry to calculate a distance value between the first feature vector and the second feature vector, threshold comparator circuitry to compare the distance value to a threshold, and change the classification of the malicious sample to clean in response to the distance value satisfying the threshold.

Abstract: Methods, apparatus, systems, and articles of manufacture to provide and monitor efficacy of artificial intelligence models are disclosed. An example apparatus includes a model trainer to train an artificial intelligence (AI) model to classify malware using first training data; an interface to deploy the AI model to a processing device; a model implementor to locally apply second training data to the AI model to generate output classifications, the second training data generated after generation of the first training data; and a report generator to generate a report including an efficacy of the AI model based on the output classifications.