Dmitrijs Trizna commited on
Commit
2bb8567
·
1 Parent(s): dfc9ed9
Files changed (1) hide show
  1. README.md +10 -0
README.md CHANGED
@@ -1,11 +1,21 @@
1
  # QuasarNix: Adversarially Robust Living-off-The-Land Reverse-Shell Detection Informed by Malicious Data Augmentation and Machine Learning
2
 
 
 
 
 
3
  This repository contains the pre-trained models from the paper "Living-off-The-Land Reverse-Shell Detection by Informed Data Augmentation" by Dmitrijs Trizna, Luca Demetrio, Battista Biggio, and Fabio Roli. The paper pre-print is available on [arXiv](https://arxiv.org/abs/2402.18329).
4
 
5
  Security Information and Event Management (SIEM) cyber-threat detection solutions are highly extensible, with numerous public collections of signature-based rules. However, there are no known repositories with behavioral Machine Learning~(ML) cyber-threat detection heuristics. To address this gap, we develop framework for constructing ML detectors that leverages data augmentation. Based on our framework, we are releasing production-ready adversarially robust ML detectors of Linux living-off-the-land (LOTL) reverse shells, trained on all known LOTL reverse shell manifestations identified by our threat intelligence.
6
 
7
  To the best of our knowledge, we are the first to publicly release generally applicable ML cyber-threat detection models suitable to wide variety of SIEM environments.
8
 
 
 
 
 
 
 
9
  ```bibtex
10
  @misc{trizna2024livingoffthelandreverseshelldetectioninformed,
11
  title={Living-off-The-Land Reverse-Shell Detection by Informed Data Augmentation},
 
1
  # QuasarNix: Adversarially Robust Living-off-The-Land Reverse-Shell Detection Informed by Malicious Data Augmentation and Machine Learning
2
 
3
+ <img src="https://raw.githubusercontent.com/dtrizna/QuasarNix/main/img/quasaroutflow.png" width=600>
4
+
5
+ ## Description
6
+
7
  This repository contains the pre-trained models from the paper "Living-off-The-Land Reverse-Shell Detection by Informed Data Augmentation" by Dmitrijs Trizna, Luca Demetrio, Battista Biggio, and Fabio Roli. The paper pre-print is available on [arXiv](https://arxiv.org/abs/2402.18329).
8
 
9
  Security Information and Event Management (SIEM) cyber-threat detection solutions are highly extensible, with numerous public collections of signature-based rules. However, there are no known repositories with behavioral Machine Learning~(ML) cyber-threat detection heuristics. To address this gap, we develop framework for constructing ML detectors that leverages data augmentation. Based on our framework, we are releasing production-ready adversarially robust ML detectors of Linux living-off-the-land (LOTL) reverse shells, trained on all known LOTL reverse shell manifestations identified by our threat intelligence.
10
 
11
  To the best of our knowledge, we are the first to publicly release generally applicable ML cyber-threat detection models suitable to wide variety of SIEM environments.
12
 
13
+ ## Code
14
+
15
+ <https://github.com/dtrizna/QuasarNix>
16
+
17
+ ## Cite Us
18
+
19
  ```bibtex
20
  @misc{trizna2024livingoffthelandreverseshelldetectioninformed,
21
  title={Living-off-The-Land Reverse-Shell Detection by Informed Data Augmentation},