Identifying Security Platform Product Abuse with Machine Learning
A deployed ML defense raised security-platform abuse coverage 35% and cut monthly alerts 30%.
The paper studies a deployed machine-learning system for detecting rare abuse of security-platform products, including living-off-the-land misuse inside customer environments and bypass experiments against the product. The design combines multiple data modalities while handling cold start, cost, user behavior, and performance constraints. Reported results are a 35% increase in product-abuse coverage, a 30% reduction in monthly alerts, and adaptation as actor behavior changes. The authors also review explainable features and counterfactual performance on previously identified attacks.
- The system targets rare abuse of security platforms, including living-off-the-land misuse.
- Deployed results: 35% more product-abuse coverage and 30% fewer monthly alerts.
- Design addresses cold start, multi-modal data, cost, and user-behavior constraints.
- Authors retrospectively assess explainable features and counterfactuals on known attacks.
From the original article
1 min read at arxiv.orgProduct abuse is an individually rare, but growing, problem across the SaaS industry. Highly sophisticated threat actors can misuse security platforms within customer environments or conduct bypass experiments on the product itself. Threat actors can leverage living-off-the-land (LOTL) attacks to avoid using cumbersome, frequently detected malware.
By Shaefer Drew · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.