3 ms·

it's a needle in the haystack issue. plus most EDR products do not actually alert on benign looking syscalls as it'll quickly cause an false positive overload

• supriyo-biswas 3y ago
  I would be very surprised if EDR products didn't use some form of anomaly detection (e.g. autoencoders[1], ANN embeddings etc.) I've gotten into trouble with employers over editing system configuration files and trying to start reverse shells, and I can't imagine execve() or connect()+dup2() are malicious either. [1] https://www.evilsocket.net/2022/08/15/Process-behaviour-anomaly-detection-using-eBPF-and-unsupervised-learning-Autoencoders/ https://www.evilsocket.net/2022/08/15/Process-behaviour-anom...
  • some_random 3y ago
    They do, it just doesn't work very well.
  • waihtis 3y ago
    They might and some definitely do, but at large enough scale maintaining a good anomaly detection signal to noise ratio becomes very difficult. A single ubuntu terminal spawn will generate something like 20 system calls. Now multiply that with however many actions you take during 8 hours of using a computer with your generic corp of over 10k hosts.
  • alephnerd 3y ago
    Some are working on it (SentinelOne is a notable player with the capacity), but ML domain experience in the Cybersecurity space is severely lacking as a lot of Cybersecurity PMs and Founders are ex-Networking types who view ML/AI as marketing hype. Source: am a PM in the space who has been banging heads with these types of people