A Survey of Detection Methods Research on Living-Off-The-Land Techniques
Ruolin Ning, Wenjuan Bu, Ju Yang, Shuang Duan · 2023
With the development of cyber attack techniques, Living-off-the-Land (LotL) techniques have gradually become one of the most pernicious network attacks. Therefore, the detection of LotL techniques plays an essential part in ensuring cybersecurity. Currently, there is a dearth of systematic classification and comprehensive review studies on detection methods pertaining to LotL techniques. In light of this, we present a comprehensive summary and categorization of the existing detection methods based on their levels of sophistication, followed by a detailed subdivision within each category for a more nuanced understanding. Primarily, we present an overview of the concepts, strategies, and stages associated with LotL techniques. And then we analyze the detection methods for LotL techniques, which can be divided into pattern matching, machine learning, and natural language processing. Finally, we make a comparative analysis to assess the advantages and disadvantages of diverse methods of detection from the perspective of classification, along with evaluating the performance metrics of these methods.