US 11,146,580 B2 · Script and command line exploitation detection

Abstract

Script and command line exploitation detection is described. Initially, an exploitation detection system collects data describing scripts and command lines launched by various computing devices. The exploitation detection system clusters the scripts and command lines based on a measure of similarity, namely, Bilingual Evaluation Understudy (BLEU) score. Given the clusters and the data describing the scripts and command lines, the exploitation detection system generates encodings of the scripts and command lines for input to a machine learning model, e.g., an autoencoder. From this model, the exploitation detection system receives a measure of unlikeliness that a process corresponding to a given script or command line launches it. The exploitation detection system ranks the scripts and command lines according to the measure of unlikeliness. In this way, the exploitation detection system can display indications of the scripts and command lines that are most unlikely to be launched by their respective process.

Claims20

Dependent claims

In a digital medium environment to enable users to determine whether scripts and commands launched by computing devices are exploiting computing resources, a method implemented by at least one computing device, the method comprising:

collecting data describing the scripts and command lines launched;
clustering the scripts and command lines by:
determining measures of similarity in relation to a given script or command line and any clusters;
determining a most similar cluster based on the measures of similarity determined in relation to the given script or command line and the clusters;
comparing a measure of similarity of the most similar cluster to a pre-defined similarity threshold;
and
responsive to a determination that the measure of similarity exceeds the pre-defined similarity threshold, adding the given script or command line to the most similar cluster;
generating encodings of the scripts and command lines, the encodings representing a first process, a second process, and a cluster of a respective script or command line;
generating measures of unlikeliness that a respective first process launches the scripts and command lines, the measures generated using a machine learning model trained with the encodings to output the measures of unlikeliness;
ranking the scripts and command lines according to the measures of unlikeliness;
and
displaying indications of at least some of the scripts and command lines based on the ranking.

9 more elements

A system to determine whether scripts and commands launched by computing devices are exploiting computing resources, the system comprising:

a clustering module implemented at least partially in hardware of at least one computing device to cluster a plurality of the scripts and command lines launched by computing devices, the plurality of scripts and command lines clustered by:
determining measures of similarity in relation to a given script or command line and any clusters;
determining a most similar cluster based on the measures of similarity determined in relation to the given script or command line and the clusters;
comparing a measure of similarity of the most similar cluster to a pre-defined similarity threshold;
and
responsive to a determination that the measure of similarity exceeds the pre-defined similarity threshold, adding the given script or command line to the most similar cluster;
an anomaly detection module implemented at least partially in the hardware of the at least one computing device to:
generate encodings of the scripts and command lines, the encodings representing a first process, a second process, and a cluster of a respective script or command line;
and
generate measures of unlikeliness that a respective first process launches the scripts and command lines, the measures generated using a machine learning model trained with the encodings to output the measures of unlikeliness.

7 more elements

Dependencies are inferred from the claim text.

Script and command line exploitation detection

Life of this patent

Script and command line exploitation detection

Life of this patent

Abstract

Claims20