Machine Learning and Feature Engineering for Detecting Living off the Land Attacks

Tiberiu Boros, Andrei Cotaie, Antrei Stan, Kumar Vikramjeet, Vivek Malik, Joseph Davidson

2022

Abstract

Among the methods used by attackers to avoid detection, living off the land is particularly hard to detect. One of the main reasons is the thin line between what is actually operational/admin activity and what is malicious activity. Also, as shown by other research, this type of attack detection is underrepresented in Anti-Virus (AV) software, mainly because of the high risk of false positives. Our research focuses on detecting this type of attack through the use of machine learning. We greatly reduce the number of false detection by corpora design and specialized feature engineering which brings in-domain human expert knowledge. Our code is open-source and we provide pre-trained models.

Paper Citation

in Harvard Style

Boros T., Cotaie A., Stan A., Vikramjeet K., Malik V. and Davidson J. (2022). Machine Learning and Feature Engineering for Detecting Living off the Land Attacks. In Proceedings of the 7th International Conference on Internet of Things, Big Data and Security - Volume 1: IoTBDS, ISBN 978-989-758-564-7, pages 133-140. DOI: 10.5220/0011004500003194

in Bibtex Style

@conference{iotbds22,
author={Tiberiu Boros and Andrei Cotaie and Antrei Stan and Kumar Vikramjeet and Vivek Malik and Joseph Davidson},
title={Machine Learning and Feature Engineering for Detecting Living off the Land Attacks},
booktitle={Proceedings of the 7th International Conference on Internet of Things, Big Data and Security - Volume 1: IoTBDS,},
year={2022},
pages={133-140},
publisher={SciTePress},
organization={INSTICC},
doi={10.5220/0011004500003194},
isbn={978-989-758-564-7},
}

in EndNote Style

TY - CONF

JO - Proceedings of the 7th International Conference on Internet of Things, Big Data and Security - Volume 1: IoTBDS,
TI - Machine Learning and Feature Engineering for Detecting Living off the Land Attacks
SN - 978-989-758-564-7
AU - Boros T.
AU - Cotaie A.
AU - Stan A.
AU - Vikramjeet K.
AU - Malik V.
AU - Davidson J.
PY - 2022
SP - 133
EP - 140
DO - 10.5220/0011004500003194