DOE OSTI · code-168028
Detecting Living-off-the-land Attacks Using K-means And Graph Convolutional Networks
Abstract
The code ingests Zeek logs derived from network packet captures and goes through data preprocessing before it gets passed into a K-Means model that labels each device as either a client or server. Graph Convolutional Network (GCN) model is used to obtain the embeddings to represent the features in lower dimension. Last, K-means cluster analysis is used to cluster the embeddings for each class.
Keep this discovery
Explore connections, maps & timelines
Quach, Anna [Idaho National Laboratory (INL), Idaho Falls, ID (United States)] (0009000600111116), Rogers, Dempsey [Idaho National Laboratory (INL), Idaho Falls, ID (United States)] (0009000742591784), Thiagarajan, Alaguvalliappan [Idaho National Laboratory (INL), Idaho Falls, ID (United States)]. 2025-09-24. Detecting Living-off-the-land Attacks Using K-means And Graph Convolutional Networks. https://doi.org/10.11578/dc.20251024.1
Cite the original work for its findings. Save a collection to share your selection of sources.