论文标题
用于进攻安全的机器学习：使用决策树和人工神经网络的沙盒分类
Machine Learning for Offensive Security: Sandbox Classification Using Decision Trees and Artificial Neural Networks
论文作者
论文摘要
信息安全性机器学习的优点主要集中在加强防御方面。但是，机器学习（ML）技术并不是针对具有深厚口袋和大量数据存储库的组织保留的； ML的民主化导致使用ML支持进攻行动的安全团队的数量增加。这里提出的研究将探索我们的团队用来解决一项进攻任务的两种模型，并检测到沙箱。使用带网络钓鱼电子邮件收集的流程列表数据，我们将证明决策树和人工神经网络的使用来成功对沙箱进行分类，从而避免执行不安全。本文旨在对真正的进攻团队如何使用机器学习来支持进攻性运作的独特见解。
The merits of machine learning in information security have primarily focused on bolstering defenses. However, machine learning (ML) techniques are not reserved for organizations with deep pockets and massive data repositories; the democratization of ML has lead to a rise in the number of security teams using ML to support offensive operations. The research presented here will explore two models that our team has used to solve a single offensive task, detecting a sandbox. Using process list data gathered with phishing emails, we will demonstrate the use of Decision Trees and Artificial Neural Networks to successfully classify sandboxes, thereby avoiding unsafe execution. This paper aims to give unique insight into how a real offensive team is using machine learning to support offensive operations.
