Living-Off-The-Land Command Detection Using Active Learning
Living-Off-The-Land Command Detection Using Active Learning
复制标题
DOI：
10.1145/3471621.3471858
复制
发表时间：
2021-10
期刊：
影响因子：
--
通讯作者：
Talha Ongun;J. W. Stokes;Jonathan Bar Or;K. Tian;Farid Tajaddodianfar;Joshua Neil;C. Seifert;Alina Oprea;John C. Platt
中科院分区：
文献类型：
--
作者：
Talha Ongun;J. W. Stokes;Jonathan Bar Or;K. Tian;Farid Tajaddodianfar;Joshua Neil;C. Seifert;Alina Oprea;John C. Platt
近年来，企业一直是高级对手的目标，他们利用创造性的方法渗透到企业的系统中，并横向移动以获取关键数据。一种越来越常见的规避方法是使用用户计算机上已经安装的工具将恶意活动隐藏在良性程序后面。这些程序通常是操作系统发行版或其他用户安装的二进制文件的一部分，因此这种类型的攻击被称为“live - off - land”。检测这些攻击具有挑战性，因为攻击者可能不会在受害者计算机上创建恶意文件，而反病毒扫描无法检测到它们。我们提出了一种称为LOLAL的主动学习框架的设计，用于检测live - off - land攻击，该攻击迭代地选择一组不确定和异常的样本供人类分析师标记。当有限数量的标记样本可用于训练机器学习模型以检测攻击时，LOLAL特别设计得很好。我们研究了使用词嵌入技术来表示命令行文本的方法，并设计了基于嵌入表示的集成增强分类器来区分恶意和良性样本。我们利用端点安全产品收集的大型匿名数据集，并证明我们的集成分类器在分类不同攻击类别时达到96%的平均F1分数。我们表明，随着更多的训练数据被标记，我们的主动学习方法不断提高分类器的性能，并且当从少量标记实例开始时，在不到30次迭代中收敛。
In recent years, enterprises have been targeted by advanced adversaries who leverage creative ways to infiltrate their systems and move laterally to gain access to critical data. One increasingly common evasive method is to hide the malicious activity behind a benign program by using tools that are already installed on user computers. These programs are usually part of the operating system distribution or another user-installed binary, therefore this type of attack is called “Living-Off-The-Land”. Detecting these attacks is challenging, as adversaries may not create malicious files on the victim computers and anti-virus scans fail to detect them. We propose the design of an Active Learning framework called LOLAL for detecting Living-Off-the-Land attacks that iteratively selects a set of uncertain and anomalous samples for labeling by a human analyst. LOLAL is specifically designed to work well when a limited number of labeled samples are available for training machine learning models to detect attacks. We investigate methods to represent command-line text using word-embedding techniques, and design ensemble boosting classifiers to distinguish malicious and benign samples based on the embedding representation. We leverage a large, anonymized dataset collected by an endpoint security product and demonstrate that our ensemble classifiers achieve an average F1 score of 96% at classifying different attack classes. We show that our active learning method consistently improves the classifier performance, as more training data is labeled, and converges in less than 30 iterations when starting with a small number of labeled instances.