Identifying Security Platform Product Abuse with Machine Learning
A deployed ML defense raised security-platform abuse coverage 35% and cut monthly alerts 30%.
The paper studies a deployed machine-learning system for detecting rare abuse of security-platform products, including living-off-the-land misuse inside customer environments and bypass experiments against the product. The design combines multiple data modalities while handling cold start, cost, user behavior, and performance constraints. Reported results are a 35% increase in product-abuse coverage, a 30% reduction in monthly alerts, and adaptation as actor behavior changes. The authors also review explainable features and counterfactual performance on previously identified attacks.
- The system targets rare abuse of security platforms, including living-off-the-land misuse.
- Deployed results: 35% more product-abuse coverage and 30% fewer monthly alerts.
- Design addresses cold start, multi-modal data, cost, and user-behavior constraints.
- Authors retrospectively assess explainable features and counterfactuals on known attacks.
Full article165 words · extracted from arxiv.org · click to collapse
Product abuse is an individually rare, but growing, problem across the SaaS industry. Highly sophisticated threat actors can misuse security platforms within customer environments or conduct bypass experiments on the product itself. Threat actors can leverage living-off-the-land (LOTL) attacks to avoid using cumbersome, frequently detected malware. Remediating this threat requires collecting multiple data modalities across different types of databases, addressing a cold-start problem in the intrinsic rarity of such sophisticated but dangerous events, and designing within the constraints of real-world deployment (e.g., cost, user behavior, performance, etc). To wit, we provide the first study of such a whole-system defense, especially with respect to a deployed and operational capability. Our results show an increase in product abuse coverage by 35\%, a 30\% reduction in monthly alerts, and adaptability to changes in malicious actors' behavior. We review both the constraints we considered in designing the system to meet operational requirements and a retrospective evaluation of the value of explainable features and counterfactual performance on previously identified attacks.
Text extracted automatically; images, tables and formatting may be missing. Original: https://arxiv.org/abs/2609.21303