Reproduce “SENTINEL: A Multi-Pathway Architecture for Detecting Living-Off-the-Land APT Attacks on Windows Command Lines” on OpenResearch
Turn your favorite coding agents into research agents that review literature, develop hypotheses, and run experiments.
Universal app for Apple silicon and Intel. Requires macOS 11 or later.
About this paper
Ahad Bin Islam Shoeb, Kamrul Hasan, Jamal Uddin Tanvin, Liang Hong, Imtiaz Ahmed, Md Arif Billah, Al Amin
SENTINEL combines semantic, character-level, sequence-based, and anomaly signals to detect Windows Living-off-the-Land activity that can evade conventional command classifiers. It reaches 92.0% accuracy on a balanced Volt Typhoon benchmark and 91.2% on obfuscated commands, with 94% malicious recall on the campaign-focused evaluation.
Key insights
- Character-level features provide the largest robustness gain because they preserve clues such as encoding artifacts, inserted characters, aliases, and concatenation operators that tokenization can obscure.
- Modeling command progression adds information beyond isolated command semantics: removing inter-command attention reduced Volt Typhoon performance by about two percentage points.
- Anomaly detection is best viewed as an analyst-routing mechanism rather than the main classifier; removing it changed classification accuracy by only 0.4–0.6%, while its threshold flagged about 5% of benign commands.
Summary by alphaXiv.
Tip: change arxiv.org to autoarxiv.org in any arXiv abstract link to open the paper here.