Command line language – where NLP and cyber security meets
summary
Built a pipeline called CMDLang framework that tokenizes shell input with bashlex plus a custom splitter, trains POS and NER models and surfaces anomalous flags and IPs; uses CRF trained on ~2,000 lines for POS and ~2,700 for NER with handcrafted context features; annotation uses a preannotation feedback loop to speed labeling; proof of concept runs offline, improves detection versus raw regexes, and catches errors that sometimes beat human annotators.
AI-written summary · about
chapters (9)
- 0:00Introduction
- 2:19Command line analysis in cybersecurity
- 6:33NLP for command logs
- 8:02Linux command framework
- 13:02Model annotation and training
- 16:16CRF training insights
- 20:11Real-world performance
- 22:22Acknowledgments
- 22:49Q&A
related talks
47m Natural Language Processing & Anomaly detection in Sys call logs
26mNLP for security log analysis : Learning to crawl before you run
31mSkynet the CTI Intern: Building Effective Machine Augmented...
40mIRonMAN: InterpRetable Incident Inspector Based ON Large-Scale Language Model and Association miNing
20mThe Power of Words: Generating PowerShell Attacks from Natural Language
24mSecuring Language Models Against Prompt Injection
44mApplied Machine Learning for Data Exfil and Other Fun Topics
59mRAG Against the Machine