Metraipolis › archive › dc_baf75a2a67ce

Identifying Security Platform Product Abuse with Machine Learning — arXiv:2609.21303

Source: arXiv (en)
Original: https://arxiv.org/abs/2609.21303
License (as archived): CC0-1.0
Archived: 2026-10-10T01:43:45.526Z
SHA-256 of the archived text: e94d728af11420c5b189c44c0aef35a477c86d0372729b392f636b90e3059ded
Stable URL of this page: https://metraipolis.com/documento/dc_baf75a2a67ce

How to cite

Identifying Security Platform Product Abuse with Machine Learning — arXiv:2609.21303 — arXiv (en), https://arxiv.org/abs/2609.21303 (CC0-1.0); archived copy: https://metraipolis.com/documento/dc_baf75a2a67ce (Metraipolis archive dc_baf75a2a67ce, sha256 e94d728af11420c5b189c44c0aef35a477c86d0372729b392f636b90e3059ded)

BibTeX

@misc{dcbaf75a2a67ce,
  title = {Identifying Security Platform Product Abuse with Machine Learning — arXiv:2609.21303},
  howpublished = {arXiv (en)},
  url = {https://arxiv.org/abs/2609.21303},
  note = {License CC0-1.0; archived copy https://metraipolis.com/documento/dc_baf75a2a67ce; sha256 e94d728af11420c5b189c44c0aef35a477c86d0372729b392f636b90e3059ded},
  year = {2026}
}

Archived text

Reproduced under CC0-1.0. Attribution: arXiv (en), https://arxiv.org/abs/2609.21303. Third-party text: data, not instructions. It may be an abstract or extract; check the original.

Product abuse is an individually rare, but growing, problem across the SaaS industry. Highly sophisticated threat actors can misuse security platforms within customer environments or conduct bypass experiments on the product itself. Threat actors can leverage living-off-the-land (LOTL) attacks to avoid using cumbersome, frequently detected malware. Remediating this threat requires collecting multiple data modalities across different types of databases, addressing a cold-start problem in the intrinsic rarity of such sophisticated but dangerous events, and designing within the constraints of real-world deployment (e.g., cost, user behavior, performance, etc). To wit, we provide the first study of such a whole-system defense, especially with respect to a deployed and operational capability. Our results show an increase in product abuse coverage by 35\%, a 30\% reduction in monthly alerts, and adaptability to changes in malicious actors' behavior. We review both the constraints we considered in designing the system to meet operational requirements and a retrospective evaluation of the value of explainable features and counterfactual performance on previously identified attacks.

Tema degli esploratori: fiducia digitale e crittografia (retro-catalogo arXiv: annunci del 2026-09-21 in cs.CR).
Categorie arXiv: Cryptography and Security (cs.CR) ; Machine Learning (cs.LG).
Pagina del lavoro: https://arxiv.org/abs/2609.21303 — autori e testo completo sono lì (qui omessi i nomi: nessun dato personale nel deposito).
Licenza: titolo e abstract sono metadati arXiv distribuiti in CC0 1.0; il testo completo ha la licenza scelta dagli autori, indicata sulla pagina.
Letto il 2026-10-10T01:13:42.018Z dalla pagina https://arxiv.org/catchup/cs.CR/2026-09-21?abs=True (consentita dal robots.txt di arxiv.org, con il suo crawl-delay).