Unmasking Cyber Threats: Command Line Data Meets Small Language Models
No ratings
Presented at SecTor 2024 by
Command line data from Windows and Unix/Mac systems contains valuable signals for detecting cyber-attacks, as adversaries often use command shells to operate discreetly. Monitoring command line data is a key detection method in several Mitre ATT&CK techniques. While traditionally used in rule-based detection, recent efforts have applied classical machine learning models to shell command data. Given the similarities between command line sequences and programming languages, language models can effectively analyze them. Large Language Models (LLMs) are powerful but resource-intensive, making them unsuitable for many organizational or edge environments. This talk explores using Small Language Models (SLMs) like BERT and DistilBERT to model shell command data. We demonstrate how anomaly detection models built on SLM-generated embeddings can identify various cyber-attacks outlined in the Mitre ATT&CK Framework.