论文标题
使用自然语言处理和监督学习
Living-off-the-Land Abuse Detection Using Natural Language Processing and Supervised Learning
论文作者
论文摘要
活地是一种逃避技术，该技术是由攻击者使用的，在该技术中，本地二进制文件被滥用以实现恶意意图。由于这些二进制文件通常是合法的系统文件，因此发现这种滥用是困难的，并且经常被现代的反病毒软件遗漏。本文提出了一种使用RAW命令字符串的新型滥用检测算法。首先，使用自然语言处理技术，例如正则表达式和单次编码，用于将命令字符串编码为数字令牌向量。接下来，使用监督的学习技术来学习令牌向量中的恶意模式，并最终预测命令的标签。最后，使用训练阶段和虚拟环境中的统计数据对模型进行评估，以比较其在将新命令检测到现有反病毒产品（例如Windows Defender）的有效性。
Living-off-the-Land is an evasion technique used by attackers where native binaries are abused to achieve malicious intent. Since these binaries are often legitimate system files, detecting such abuse is difficult and often missed by modern anti-virus software. This paper proposes a novel abuse detection algorithm using raw command strings. First, natural language processing techniques such as regular expressions and one-hot encoding are utilized for encoding the command strings as numerical token vectors. Next, supervised learning techniques are employed to learn the malicious patterns in the token vectors and ultimately predict the command's label. Finally, the model is evaluated using statistics from the training phase and in a virtual environment to compare its effectiveness at detecting new commands to existing anti-virus products such as Windows Defender.
