Machine Learning for Offensive Security: Sandbox Classification Using Decision Trees and Artificial Neural Networks
The merits of machine learning in information security have primarily focused on bolstering defenses. However, machine learning (ML) techniques are not reserved for organizations with deep pockets and massive data repositories; the democratization of ML has lead to a rise in the number of security teams using ML to support offensive operations. The research presented here will explore two models that our team has used to solve a single offensive task, detecting a sandbox. Using process list data gathered with phishing emails, we will demonstrate the use of Decision Trees and Artificial Neural Networks to successfully classify sandboxes, thereby avoiding unsafe execution. This paper aims to give unique insight into how a real offensive team is using machine learning to support offensive operations.
Code (0)
등록된 구현이 없습니다.
Tasks
BIG-bench Machine LearningGeneral ClassificationSimilar Papers 제목 키워드 기반
Red-Teaming the Agentic Red-Team
The use of agentic systems to perform offensive security operations has moved from a theoretical possibility to a commoditized capability. However, while the community has focused on creating more and more capable agents…
A Content-Based Framework for Cybersecurity Refusal Decisions in Large Language Models
Large language models and LLM-based agents are increasingly used for cybersecurity tasks that are inherently dual-use. Existing approaches to refusal, spanning academic policy frameworks and commercially deployed systems…
Offensive Language Detection Explained
Many online discussion platforms use a content moderation process, where human moderators check user comments for offensive language and other rule violations. It is the moderator{'}s decision which comments to remove fr…
BIG-bench Machine LearningGeneral ClassificationInterpretable Machine LearningCyber-Capable AI Agents: Vulnerabilities, Evaluation Containment, and Defensive Response
Cyber-capable AI agents combine language models with tools, memory, and execution environments to perform multi-step offensive-security tasks. Existing work separately measures cyber capability and catalogs attacks again…
Conformal Prediction for Offensive Security
Despite its introduction more than a quarter century ago, Conformal Prediction (CP) has seen surprisingly few applications to the cyber security world thus far. In particular, we observe that, while CP has been employed …