Automated False Positive Filtering for esNetwork Alerts and Lolbin Detection for Raw Endpoint Telemetry
Pipeline alerts are beneficial to analysts to determine where their attention is needed. However, a high false positive rate leads to a noisy stream and wastes analysts’ time. The first sub-project will aim to classify the alerts as either low or high likelihood of a false positive, allowing analysts to spend their time where it is most effective.
Living-off-the-Land binaries (Lolbins) is an increasingly common technique among attackers, yet there is currently little detection for such an attack. The second sub-project will fill the gaps and provide automated detection for Lolbin abuse, and increasing detection rate beyond what is possible with out-of-the-box detection.
Ali Dehghantanha
eSentire
Computer science
Cyber Security; Artificial Intelligence; Technology
University of Guelph
Accelerate