Algorithme d'apprentissage statistique permettant de créer un modèle sur les lignes de commandes des évènements "Création de Processus", afin de détecter des anomalies dans les évènements futurs
Are you aware of any open-source datasets consisting of benign command lines? We would like to release an open-source version of the AnoMark service that we use in Assemblyline but the model we use cannot be released to the public unfortunately due to the dataset it was trained on.
This question obviously depends on the dataset used, but what would a good number to choose for 'order'? The average length of a command line in the dataset? The maximum length of a command line in the dataset? Somewhere in-between?
I see that train_data.csv and train_data.txt are used in the tests, but I cannot seem to find where test_data.csv is being used? If it is not being used anywhere, can it be removed?
When we use the apply_model module to show the top X lines without the store flag, can we also display the "markovScore" value underneath each command to demonstrate why each of these X lines were chosen to be displayed?
It has something to do with the manipulation of the dataframe here