DID U Misbehave? A New Dataset for In-Depth Understanding of Inconspicuous Software
Résumé
Living-Off-The-Land attacks involve exploiting preinstalled genuine and trusted software for malicious purposes. The various methods available for detecting these attacks often rely on an in-depth understanding of the software components that attackers could abuse. This hypothesis is unrealistic today given the number of software components installed on a system and the number of options available for each software component. We present in this article an open access dataset built from the deep analysis performed by security experts of 912 options of 23 different Linux command-line software programs. The associated section of manual documentation of these command options is labelled as belonging to one of 12 possible behaviour classes from our consolidated taxonomy. Our contributions represent an important step toward understanding system-wide software execution as combinations and chains of individual behaviours regardless of the underlying software.
Origine | Fichiers produits par l'(les) auteur(s) |
---|---|
licence |