Weeding Out Living-off-the-land Attacks at Scale

The speakers describe building a machine learning system that flags living-off-the-land binary attacks, where legitimate system tools are abused through malicious command lines. The goal was to surface attacks that existing detections miss without flooding a security operations center with false positives. Command lines were the chosen signal, and with roughly 1.5 billion invocations per day the data volume was not the obstacle. Getting trustworthy labels was.

To build labels, the team combined past incident results, indirect labels borrowed from file and URL verdicts and sandbox reports, and rules written by threat analysts as allow and block lists. They split training, validation and test data by time so the model was scored on command lines it had never seen. A gradient-boosted baseline using character-transition features was compared with two convolutional neural networks. The first models looked accurate, but a daily replay of a one percent sample showed hundreds of alerts. The speakers used this to illustrate the base rate fallacy: when malicious events are rare, even a very accurate classifier produces mostly false positives.

The fix was guardrails. The model only matters when analyst rules fire. Block-list matches alert directly, while suspicious or debatable rule matches alert only when the model scores them highly. The reported results showed a manageable number of daily alerts, a true positive rate near 0.9 to 1 over several weeks, and some detections the existing system did not make. The takeaway is that standalone ML rarely works on skewed security data, and that data engineering and ongoing analyst feedback matter as much as the model itself.