18385591. COMMAND LINE OBFUSCATION DETECTION TECHNIQUES (Cisco Technology, Inc.)
COMMAND LINE OBFUSCATION DETECTION TECHNIQUES
Organization Name
Inventor(s)
Michael Adam Polak of Praha CZ
Vojtech Outrata of Knezmost CZ
COMMAND LINE OBFUSCATION DETECTION TECHNIQUES
This abstract first appeared for US patent application 18385591 titled 'COMMAND LINE OBFUSCATION DETECTION TECHNIQUES
Original Abstract Submitted
Techniques described herein can perform obfuscation detection on command lines used at computing devices in a network. In response to detecting obfuscation in a command line, the disclosed techniques can output a notification for use in connection with network security analysis. The command line obfuscation detection techniques include pre-processing command line input data and converting command lines into token groups. The token groups are then provided as an input to a natural language processor or other machine learned model, which is trained to identify obfuscation probabilities associated with token groups can corresponding command lines. A notification is generated to trigger further analysis in response to an obfuscation probability exceeding a threshold obfuscation probability.
