{"id":"https://openalex.org/W4387251739","doi":"https://doi.org/10.1109/ccis59572.2023.10262997","title":"LOLWTC: A Deep Learning Approach for Detecting Living Off the Land Attacks","display_name":"LOLWTC: A Deep Learning Approach for Detecting Living Off the Land Attacks","publication_year":2023,"publication_date":"2023-08-12","ids":{"openalex":"https://openalex.org/W4387251739","doi":"https://doi.org/10.1109/ccis59572.2023.10262997"},"language":"en","primary_location":{"id":"doi:10.1109/ccis59572.2023.10262997","is_oa":false,"landing_page_url":"http://dx.doi.org/10.1109/ccis59572.2023.10262997","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2023 IEEE 9th International Conference on Cloud Computing and Intelligent Systems (CCIS)","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5101251259","display_name":"Kuiye Ding","orcid":null},"institutions":[{"id":"https://openalex.org/I152269853","display_name":"Qilu University of Technology","ror":"https://ror.org/04hyzq608","country_code":"CN","type":"education","lineage":["https://openalex.org/I152269853"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Kuiye Ding","raw_affiliation_strings":["Qilu University of Technology (Shandong Academy of Science),Jinan,China,250353"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Qilu University of Technology (Shandong Academy of Science),Jinan,China,250353","institution_ids":["https://openalex.org/I152269853"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5101843962","display_name":"Shuhui Zhang","orcid":"https://orcid.org/0000-0001-5017-3207"},"institutions":[{"id":"https://openalex.org/I152269853","display_name":"Qilu University of Technology","ror":"https://ror.org/04hyzq608","country_code":"CN","type":"education","lineage":["https://openalex.org/I152269853"]},{"id":"https://openalex.org/I4210142748","display_name":"Shandong Academy of Sciences","ror":"https://ror.org/04y8d6y55","country_code":"CN","type":"education","lineage":["https://openalex.org/I4210142748"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Shuhui Zhang","raw_affiliation_strings":["Qilu University of Technology (Shandong Academy of Sciences),Shandong Computer Science Center (National Supercomputer Center in Jinan), Shandong Provincial Key Laboratory of Computer Networks,Jinan,China,250014"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Qilu University of Technology (Shandong Academy of Sciences),Shandong Computer Science Center (National Supercomputer Center in Jinan), Shandong Provincial Key Laboratory of Computer Networks,Jinan,China,250014","institution_ids":["https://openalex.org/I152269853","https://openalex.org/I4210142748"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5008120644","display_name":"Feifei Yu","orcid":"https://orcid.org/0000-0003-1169-5699"},"institutions":[{"id":"https://openalex.org/I152269853","display_name":"Qilu University of Technology","ror":"https://ror.org/04hyzq608","country_code":"CN","type":"education","lineage":["https://openalex.org/I152269853"]},{"id":"https://openalex.org/I4210142748","display_name":"Shandong Academy of Sciences","ror":"https://ror.org/04y8d6y55","country_code":"CN","type":"education","lineage":["https://openalex.org/I4210142748"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Feifei Yu","raw_affiliation_strings":["Qilu University of Technology (Shandong Academy of Sciences),Shandong Computer Science Center (National Supercomputer Center in Jinan), Shandong Provincial Key Laboratory of Computer Networks,Jinan,China,250014"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Qilu University of Technology (Shandong Academy of Sciences),Shandong Computer Science Center (National Supercomputer Center in Jinan), Shandong Provincial Key Laboratory of Computer Networks,Jinan,China,250014","institution_ids":["https://openalex.org/I152269853","https://openalex.org/I4210142748"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5039892891","display_name":"Guangqi Liu","orcid":"https://orcid.org/0000-0002-1592-771X"},"institutions":[{"id":"https://openalex.org/I152269853","display_name":"Qilu University of Technology","ror":"https://ror.org/04hyzq608","country_code":"CN","type":"education","lineage":["https://openalex.org/I152269853"]},{"id":"https://openalex.org/I4210142748","display_name":"Shandong Academy of Sciences","ror":"https://ror.org/04y8d6y55","country_code":"CN","type":"education","lineage":["https://openalex.org/I4210142748"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Guangqi Liu","raw_affiliation_strings":["Qilu University of Technology (Shandong Academy of Sciences),Shandong Computer Science Center (National Supercomputer Center in Jinan), Shandong Provincial Key Laboratory of Computer Networks,Jinan,China,250014"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Qilu University of Technology (Shandong Academy of Sciences),Shandong Computer Science Center (National Supercomputer Center in Jinan), Shandong Provincial Key Laboratory of Computer Networks,Jinan,China,250014","institution_ids":["https://openalex.org/I152269853","https://openalex.org/I4210142748"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":3,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"176","last_page":"181"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9997000098228455,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9997000098228455,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9987999796867371,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11644","display_name":"Spam and Phishing Detection","score":0.9973999857902527,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.8149278163909912},{"id":"https://openalex.org/keywords/exploit","display_name":"Exploit","score":0.747646689414978},{"id":"https://openalex.org/keywords/deep-learning","display_name":"Deep learning","score":0.6890504360198975},{"id":"https://openalex.org/keywords/robustness","display_name":"Robustness (evolution)","score":0.6676390171051025},{"id":"https://openalex.org/keywords/scripting-language","display_name":"Scripting language","score":0.6529157757759094},{"id":"https://openalex.org/keywords/malware","display_name":"Malware","score":0.6487282514572144},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.6443610191345215},{"id":"https://openalex.org/keywords/embedding","display_name":"Embedding","score":0.5757154226303101},{"id":"https://openalex.org/keywords/machine-learning","display_name":"Machine learning","score":0.5291006565093994},{"id":"https://openalex.org/keywords/word-embedding","display_name":"Word embedding","score":0.5060867667198181},{"id":"https://openalex.org/keywords/random-forest","display_name":"Random forest","score":0.46258899569511414},{"id":"https://openalex.org/keywords/set","display_name":"Set (abstract data type)","score":0.4171580970287323},{"id":"https://openalex.org/keywords/natural-language-processing","display_name":"Natural language processing","score":0.3415018618106842},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.262589693069458}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8149278163909912},{"id":"https://openalex.org/C165696696","wikidata":"https://www.wikidata.org/wiki/Q11287","display_name":"Exploit","level":2,"score":0.747646689414978},{"id":"https://openalex.org/C108583219","wikidata":"https://www.wikidata.org/wiki/Q197536","display_name":"Deep learning","level":2,"score":0.6890504360198975},{"id":"https://openalex.org/C63479239","wikidata":"https://www.wikidata.org/wiki/Q7353546","display_name":"Robustness (evolution)","level":3,"score":0.6676390171051025},{"id":"https://openalex.org/C61423126","wikidata":"https://www.wikidata.org/wiki/Q187432","display_name":"Scripting language","level":2,"score":0.6529157757759094},{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.6487282514572144},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.6443610191345215},{"id":"https://openalex.org/C41608201","wikidata":"https://www.wikidata.org/wiki/Q980509","display_name":"Embedding","level":2,"score":0.5757154226303101},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.5291006565093994},{"id":"https://openalex.org/C2777462759","wikidata":"https://www.wikidata.org/wiki/Q18395344","display_name":"Word embedding","level":3,"score":0.5060867667198181},{"id":"https://openalex.org/C169258074","wikidata":"https://www.wikidata.org/wiki/Q245748","display_name":"Random forest","level":2,"score":0.46258899569511414},{"id":"https://openalex.org/C177264268","wikidata":"https://www.wikidata.org/wiki/Q1514741","display_name":"Set (abstract data type)","level":2,"score":0.4171580970287323},{"id":"https://openalex.org/C204321447","wikidata":"https://www.wikidata.org/wiki/Q30642","display_name":"Natural language processing","level":1,"score":0.3415018618106842},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.262589693069458},{"id":"https://openalex.org/C185592680","wikidata":"https://www.wikidata.org/wiki/Q2329","display_name":"Chemistry","level":0,"score":0.0},{"id":"https://openalex.org/C199360897","wikidata":"https://www.wikidata.org/wiki/Q9143","display_name":"Programming language","level":1,"score":0.0},{"id":"https://openalex.org/C55493867","wikidata":"https://www.wikidata.org/wiki/Q7094","display_name":"Biochemistry","level":1,"score":0.0},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.0},{"id":"https://openalex.org/C104317684","wikidata":"https://www.wikidata.org/wiki/Q7187","display_name":"Gene","level":2,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/ccis59572.2023.10262997","is_oa":false,"landing_page_url":"http://dx.doi.org/10.1109/ccis59572.2023.10262997","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2023 IEEE 9th International Conference on Cloud Computing and Intelligent Systems (CCIS)","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[{"score":0.6800000071525574,"id":"https://metadata.un.org/sdg/4","display_name":"Quality Education"}],"awards":[],"funders":[{"id":"https://openalex.org/F4320321001","display_name":"National Natural Science Foundation of China","ror":"https://ror.org/01h0zpd94"}],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":12,"referenced_works":["https://openalex.org/W1832693441","https://openalex.org/W2896457183","https://openalex.org/W2996806689","https://openalex.org/W3033021283","https://openalex.org/W3080802004","https://openalex.org/W3152957156","https://openalex.org/W3183738810","https://openalex.org/W3205859170","https://openalex.org/W4226512862","https://openalex.org/W4290062161","https://openalex.org/W6795883925","https://openalex.org/W6841472730"],"related_works":["https://openalex.org/W2097492617","https://openalex.org/W2753240997","https://openalex.org/W1764168690","https://openalex.org/W2537959205","https://openalex.org/W2740895074","https://openalex.org/W2772446090","https://openalex.org/W4284893819","https://openalex.org/W2249809453","https://openalex.org/W3152891574","https://openalex.org/W4286432911"],"abstract_inverted_index":{"Living":[0],"off":[1],"the":[2,110,125],"Land":[3],"(LotL)":[4],"attacks":[5,17,139],"have":[6],"gained":[7],"attention":[8],"in":[9,91],"recent":[10],"years":[11],"because":[12],"they":[13],"are":[14,99],"sneaky.":[15],"These":[16,97],"exploit":[18],"legitimate":[19],"tools,":[20],"scripts,":[21],"and":[22,30,44,65,112,140],"system":[23],"permissions,":[24],"making":[25],"them":[26],"hard":[27],"to":[28,54,87],"detect":[29],"track.":[31],"As":[32],"a":[33,56,76],"result,":[34],"defense":[35],"costs":[36],"increase.":[37],"However,":[38],"most":[39],"research":[40],"focuses":[41],"on":[42,124],"detecting":[43,71,137],"classifying":[45],"malware":[46],"rather":[47],"than":[48],"LotL":[49,72,138],"attacks.":[50,73],"This":[51,131],"study":[52],"aims":[53],"explore":[55],"novel":[57],"approach":[58],"that":[59],"combines":[60],"machine":[61],"learning,":[62,64],"deep":[63,77,105],"natural":[66],"language":[67],"processing":[68],"methods":[69],"for":[70,102,136],"We":[74],"propose":[75],"learning":[78],"detection":[79],"framework":[80],"called":[81],"LOLWTC.":[82,115],"It":[83,116],"utilizes":[84],"word":[85],"embedding":[86],"represent":[88],"qualitative":[89],"features":[90],"command-line":[92],"text":[93],"as":[94],"two-dimensional":[95],"matrices.":[96],"matrices":[98],"then":[100],"used":[101],"classification":[103],"using":[104],"networks.":[106],"Experimental":[107],"results":[108],"demonstrate":[109],"robustness":[111],"effectiveness":[113],"of":[114,122],"achieves":[117],"an":[118],"impressive":[119],"f1":[120],"score":[121],"0.9945":[123],"test":[126],"set":[127],"during":[128],"10-fold":[129],"cross-validation.":[130],"showcases":[132],"its":[133],"significant":[134],"potential":[135],"addressing":[141],"associated":[142],"security":[143],"concerns.":[144]},"counts_by_year":[{"year":2026,"cited_by_count":3}],"updated_date":"2026-07-14T23:27:15.235271","created_date":"2025-10-10T00:00:00"}