基于合成数据的鲁棒检测：Living-Off-the-Land 反向 Shell
Robust Synthetic Data-Driven Detection of Living-Off-the-Land Reverse Shells
AI总结：
针对LOTL反向Shell攻击，提出基于合成数据增强的ML检测框架，结合对抗训练，在FPR为10^-5时检测率提升90%，并发布模型与数据集。
摘要：
Living-off-the-land（LOTL）技术对安全运营构成重大挑战，其利用合法工具执行恶意命令，从而规避传统检测方法。为解决此问题，我们提出了一种针对网络安全防御系统（如安全信息与事件管理（SIEM）解决方案）的鲁棒增强框架，通过机器学习实现LOTL攻击（如反向Shell）的检测。利用真实世界威胁情报和对抗性训练，我们的框架在保持合法活动变异性的同时合成多样化恶意数据集，确保高准确率和低误报率。我们通过在企业级数据集上的广泛实验验证了该方法，在行业级误报率（FPR）为10^-5的情况下，检测率较未增强基线提高了90%。我们定义了能够成功规避未受保护模型的黑盒数据驱动攻击，并开发了防御措施以缓解这些攻击，从而生成ML模型的对抗性鲁棒变体。伦理考量是本工作的核心；我们讨论了合成数据生成的安全措施以及四种最佳性能架构（包括对抗性训练和常规训练变体）预训练模型的负责任发布：https://huggingface.co/dtrizna/quasarnix。此外，我们提供了一个包含超过100万个增强攻击变体的恶意LOTL数据集，以促进可复现研究和社区协作：https://huggingface.co/datasets/dtrizna/QuasarNix。这项工作为应对不断演变的LOTL威胁提供了可复现、可扩展且生产就绪的防御方案。
英文摘要：
Living-off-the-land (LOTL) techniques pose a significant challenge to security operations, exploiting legitimate tools to execute malicious commands that evade traditional detection methods. To address this, we present a robust augmentation framework for cyber defense systems as Security Information and Event Management (SIEM) solutions, enabling the detection of LOTL attacks such as reverse shells through machine learning. Leveraging real-world threat intelligence and adversarial training, our framework synthesizes diverse malicious datasets while preserving the variability of legitimate activity, ensuring high accuracy and low false-positive rates. We validate our approach through extensive experiments on enterprise-scale datasets, achieving a 90\% improvement in detection rates over non-augmented baselines at an industry-grade False Positive Rate (FPR) of $10^{-5}$. We define black-box data-driven attacks that successfully evade unprotected models, and develop defenses to mitigate them, producing adversarially robust variants of ML models. Ethical considerations are central to this work; we discuss safeguards for synthetic data generation and the responsible release of pre-trained models across four best performing architectures, including both adversarially and regularly trained variants: https://huggingface.co/dtrizna/quasarnix. Furthermore, we provide a malicious LOTL dataset containing over 1 million augmented attack variants to enable reproducible research and community collaboration: https://huggingface.co/datasets/dtrizna/QuasarNix. This work offers a reproducible, scalable, and production-ready defense against evolving LOTL threats.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
