Automated Rule Mutation for Emerging Attack Variants using Infrastructure-Aware Technique Proximity↗ (원문, 새 창)

본문 미리보기

arXiv:2610.24162v1 Announce Type: new Abstract: Detection rules are typically crafted based on specific observations of an attack. While these rules are effective for particular attack instances, their coverage diminishes when adversaries modify their techniques, such as by employing alternative execution paths or adapting to different telemetry environments while achieving the same objective. To address this challenge, we introduce ARMS, an automated rule mutation solution that generates varia