.png){kind=icon}
返回
MPSAutodetect: A Malicious Powershell Script Detection Model Based on Stacked Denoising Auto-Encoder
.png){kind=icon}
PRE
AI
DOI：10.1016/j.cose.2022.102658.png)
.png){kind=icon}
原文求助.png){kind=icon}
分享.png){kind=icon}
收藏
摘要
En 中文
PowerShell is an important tool used to automate administrative tasks. It is an open-source tool that is pre-installed on Windows machines and is accessible on many other operating systems. Administrators generally utilize PowerShell to carry out a range of typical management tasks, such as adding and deleting accounts, editing groups, and accessing hard-to-find user information. However, researchers recently found that PowerShell was used to execute various attacks. These attacks leveraged PowerShell's vast number of properties to access privileged information, gain control of entire machines or spread over an organization. Because of the obfuscation and complex natures of these malicious scripts, detection is costly and difficult. Here, we present Malicious PowerShell Script Autodetect (MPSAutodetect), a detection model that relies on machine learning techniques to detect malicious PowerShell scripts. Our model was built with the use of stacked denoising auto-encoders (SdAs) to extract meaningful features. These valuable, easily attained features were fed to the eXtreme gradient boosting (XGBoost) classifier. Two substantial datasets (labelled and unlabelled) were collected to train and test MPSAutodetect in supervised and semi-supervised manners. The dataset contained malicious and benign obfuscated scripts. The results showed that regardless of the features extracted from the SdA, the supervised approach resulted in better detection, with a significant 98% true-positive rate and a low 0.6% false-positive rate. Thus, the analysis of MPSAutodetect showed that the model achieves respectable performance without the hassling process of manual feature engineering.(c) 2022 Elsevier Ltd. All rights reserved.
Keyword:
PowerShell
Deep learning
Stacked denoising auto-encoders
XGBoost
期刊
C
IF:
5.4
论文数:
4.6K
被引数:
1.4W
机构
引用论文
Similar cation channels mediate protection from cerebellar exitotoxicity by exercise and inheritance
OAAI
OAAI分享收藏Effective method for detecting malicious PowerShell scripts based on hybrid features.png)
NEUROCOMPUTING
NEUROCOMPUTINGIF6.5
PREAI
分享收藏分享收藏
没有更多内容
没有更多内容