Machine learning improves detection of abused security software
Identifying Security Platform Product Abuse with Machine Learning
Cryptography and SecurityMachine Learning
Summary
Some bad actors use security software in sneaky ways to avoid being caught, which is a hard problem because it happens rarely and in many complex ways. The researchers studied how to spot this misuse by looking at many types of data and using machine learning models that adapt to new tricks. They built a system that can find 35% more abuse cases while reducing false alarms by 30%, which helps security teams focus on real threats. The system also explains why it makes decisions, which helps understand attacks better.
What this means in practice
- •For security operation teams: Use the system to detect sophisticated misuse of security software inside customer environments, reducing false alerts and increasing coverage.
- •For cloud service providers: Integrate multi-database machine learning models to monitor and block complex product abuse in SaaS security platforms for customers.$Commercial implications: Enables selling enhanced security monitoring tools that improve abuse detection in SaaS products for cloud providers.
Authors
Shaefer Drew, Michael Brautbar, Paul Knight, Edward Raff, Lana Peric-McDermott, Simran Sarin, Nickolas Machado, Hanna Albright, Vitaly Zaytsev
Abstract
Product abuse is an individually rare, but growing, problem across the SaaS industry. Highly sophisticated threat actors can misuse security platforms within customer environments or conduct bypass experiments on the product itself. Threat actors can leverage living-off-the-land (LOTL) attacks to avoid using cumbersome, frequently detected malware. Remediating this threat requires collecting multiple data modalities across different types of databases, addressing a cold-start problem in the intrinsic rarity of such sophisticated but dangerous events, and designing within the constraints of real-world deployment (e.g., cost, user behavior, performance, etc). To wit, we provide the first study of such a whole-system defense, especially with respect to a deployed and operational capability. Our results show an increase in product abuse coverage by 35\%, a 30\% reduction in monthly alerts, and adaptability to changes in malicious actors' behavior. We review both the constraints we considered in designing the system to meet operational requirements and a retrospective evaluation of the value of explainable features and counterfactual performance on previously identified attacks.