Deployable Machine Learning for Security Defense: First International Workshop, MLHat 2020, San Diego, CA, USA, August 24, 2020, Proceedings

Preface
Organization
Contents
Understanding the Adversaries
A Large-Scale Analysis of Attacker Activity in Compromised Enterprise Accounts
	1 Introduction
	2 Data
		2.1 Schema and Data Sources
		2.2 Ethics
	3 Detecting Attacker Activity
		3.1 Historical User Profile and Features
		3.2 Classification Rule Set
	4 Characterizing Attacker Behavior
		4.1 Duration of Attacker Activity and Damage Prevention
		4.2 Attacker Account Access Patterns
		4.3 Uses of Compromised Enterprise Accounts
	5 Related Work
		5.1 Overview of Previous Work
		5.2 Comparing Enterprise Versus Personal Account Hijacking
	6 Summary
	A Rule Set Extended Details
		A.1 Extended Details on Applying Rule Set
	B Modes of Attackers: Extended Analysis
		B.1 Stability of IP Addresses
		B.2 Activity Analysis of Specialized Attackers
	C How Enterprise Accounts Are Compromised
	References
MALOnt: An Ontology for Malware Threat Intelligence
	1 Introduction
	2 Background Concepts
		2.1 Threat Reports
		2.2 Ontology
		2.3 Knowledge Graphs
	3 Literature Review
		3.1 Existing Malware Ontologies
		3.2 Knowledge Graphs for Malware
	4 Ontology Design and Implementation
		4.1 Purpose and Intended Use of MALOnt
		4.2 Competency Questions for MALOnt
		4.3 Creating MALOnt
		4.4 Exemplar Classes and Relationships
	5 Evaluation
	6 Application of MALOnt
		6.1 Annotating Threat Reports
	7 Conclusion and Future Work
	References
Adversarial ML for Better Security
FraudFox: Adaptable Fraud Detection in the Real World
	1 Introduction
	2 Literature Survey
	3 Overview of Proposed Solution
	4 Proposed FraudFox-F, for Fraud Adaptation
	5 Proposed FraudFox-I for Anti-Gaming
		5.1 Adversarial Adaptation
		5.2 Non-stationary Adaptation
	6 Proposed FraudFox-D for Decision Surface
	7 Proposed FraudFox-B for Business Adaptation
	8 Results
	9 Conclusions
	A  Appendix: Proof of Exponential Forgetting Formulae
	B  Appendix: Proof of Larger Covariance Matrix
	C  Appendix: Proof of Optimal Decision Surface for Guessing Fraud
	References
Towards Practical Robustness Improvement for Object Detection in Safety-Critical Scenarios
	1 Introduction
	2 Adversarial Examples in Object Detectors
	3 Two-Stage Adversarial Training
	4 Evaluation
		4.1 Evaluation Setup
		4.2 Adversarial Examples Severity
		4.3 Adversarial Training Results
		4.4 Refined Adversarial Training
		4.5 Experiments on Autonomous Driving
		4.6 Experiments on Other Attacks
	5 Conclusion and Future Works
	References
Domain Generation Algorithm Detection Utilizing Model Hardening Through GAN-Generated Adversarial Examples
	1 Introduction
	2 Related Works
	3 Background
		3.1 Botnets and Domain Generation Algorithms
		3.2 Generative Adversarial Networks
		3.3 Wasserstein GAN
		3.4 Lipschitz Continuity Constant
		3.5 Gradient Penalty Wasserstein GAN
		3.6 Recurrent Neural Networks
		3.7 Convolutional Neural Networks
	4 Proposed Architecture
		4.1 GAN Discriminator Input Formatting
		4.2 GAN Model
		4.3 AGD Detection Model
	5 Experiment Setup
		5.1 Benign Domain Set
		5.2 Algorithmically Generated Domain Set
		5.3 GAN Generated Samples
		5.4 Adversarial Data Augmentation
		5.5 Evaluation Metrics
	6 Results
		6.1 GAN Domain Generation
		6.2 DGA Detection Model
	7 Conclusion
	References
Threats on Networks
Toward Explainable and Adaptable Detection and Classification of Distributed Denial-of-Service Attacks
	1 Introduction
	2 Related Work
		2.1 Statistical Approaches
		2.2 Rule-Based Approaches
		2.3 Learning-Based Approaches
	3 Design
		3.1 Detection Phase
		3.2 Phase Two: Classification
		3.3 Adaptability
	4 Evaluation
		4.1 Model Training
		4.2 Evaluation Under Simulation Environment
		4.3 Real-World Deployment
	5 Discussions
	6 Conclusions
	References
Forecasting Network Intrusions from Security Logs Using LSTMs
	1 Introduction
	2 Related Work
	3 Data Description
	4 Experimental Setup
		4.1 Preprocessing
		4.2 Naïve Baseline
		4.3 ARIMA Baseline
		4.4 Long Short-Term Memory
		4.5 Evaluation Criteria
	5 Results
		5.1 Detailed Results Analysis
		5.2 Feature Importance for LSTM Models
		5.3 Potential Applications
	6 Conclusion
	References
DAPT 2020 - Constructing a Benchmark Dataset for Advanced Persistent Threats
	1 Introduction
	2 Related Work
		2.1 Analysis on Existing Datasets
		2.2 Anomaly Detection and Machine Learning Based APT Detection
	3 DAPT 2020 Dataset Design
		3.1 System Setup
		3.2 Data Collection
		3.3 Semi-supervised Models for APT Detection
	4 Evaluation
		4.1 Anomaly Detection with SAE
		4.2 Anomaly Detection with LSTM-SAE
		4.3 Anomaly Detection with 1-SVM
		4.4 Analysis of Performance on AUC
	5 Discussion
	6 Conclusion
	A  Appendix
		A.1  APT Attack Phases
		A.2  APT Feature Description
	References
Author Index