18385591. COMMAND LINE OBFUSCATION DETECTION TECHNIQUES (Cisco Technology, Inc.)

COMMAND LINE OBFUSCATION DETECTION TECHNIQUES

Organization Name

Cisco Technology, Inc.

Inventor(s)

Michael Adam Polak of Praha CZ

Martin Kopp of Komarov CZ

Vojtech Outrata of Knezmost CZ

COMMAND LINE OBFUSCATION DETECTION TECHNIQUES

This abstract first appeared for US patent application 18385591 titled 'COMMAND LINE OBFUSCATION DETECTION TECHNIQUES

Original Abstract Submitted

Techniques described herein can perform obfuscation detection on command lines used at computing devices in a network. In response to detecting obfuscation in a command line, the disclosed techniques can output a notification for use in connection with network security analysis. The command line obfuscation detection techniques include pre-processing command line input data and converting command lines into token groups. The token groups are then provided as an input to a natural language processor or other machine learned model, which is trained to identify obfuscation probabilities associated with token groups can corresponding command lines. A notification is generated to trigger further analysis in response to an obfuscation probability exceeding a threshold obfuscation probability.