Natural Language Processing & Anomaly detection in Sys call logs
summary
Applies Natural Language Processing to Linux x86_64 syscall logs by tokenizing and hashing lines into a sparse matrix and classifying with off‑the‑shelf classifiers; uses hashing vectorizer and labels from malware samples on VirusTotal (2017–2019), runs samples in Docker + gVisor and collects traces with strace/sysdig. Prototype uses K-nearest (and experiments with Random Forest), shows some malicious runs cluster apart but is noisy, hits RAM limits with long traces, and needs stronger isolation and contextual sequence analysis before production use.
AI-written summary · about
chapters (9)
- 0:00Introduction and motivation
- 2:55Defining the problem space
- 5:29Machine learning and logs
- 8:56Syscalls and containerization
- 14:42Securing with GVisor
- 19:01Data processing and tokens
- 24:04Classification algorithms
- 30:01Experimental results
- 37:41Q&A and future work
related talks
26mNLP for security log analysis : Learning to crawl before you run
48mHunting Stealth Adversaries with Graphs & AI
30mData Driven Security
44mApplied Machine Learning for Data Exfil and Other Fun Topics
26mCommand line language – where NLP and cyber security meets
33mBasic Malware Analysis for Incident Responders
32mSysmon Deep Dive: Real Detection Scenarios You Can Reproduce
30mTrawling for IOCs: Catching C2 in a Sea of Data