DID U Misbehave? A New Dataset for In-Depth Understanding of Inconspicuous Software

Living-Off-The-Land attacks involve exploiting pre-installed genuine and trusted software for malicious purposes. The various methods available for detecting these attacks often rely on an in-depth understanding of the software components that attackers could abuse. This hypothesis is unrealistic today given the number of software components installed on a system and the number of options available for each software component. We present in this article an open access dataset built from the deep analysis performed by security experts of 912 options from 23 different Linux command-line software programs. The associated manual documentation section of these command options has been labelled according to one of 12 possible behaviour classes from our consolidated taxonomy. Our contributions represent an important step toward understanding system-wide software execution as combinations and chains of individual behaviours regardless of the underlying software.