{"id":"https://openalex.org/W7166668337","doi":"https://doi.org/10.48550/arxiv.2606.28917","title":"ML-Powered LDAP Reconnaissance Detection using Weak Supervision","display_name":"ML-Powered LDAP Reconnaissance Detection using Weak Supervision","publication_year":2026,"publication_date":"2026-06-27","ids":{"openalex":"https://openalex.org/W7166668337","doi":"https://doi.org/10.48550/arxiv.2606.28917"},"language":null,"primary_location":{"id":"doi:10.48550/arxiv.2606.28917","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2606.28917","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"type":"preprint","indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.48550/arxiv.2606.28917","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5139656829","display_name":"Shaefer Drew","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Drew, Shaefer","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5068036546","display_name":"Edward Raff","orcid":"https://orcid.org/0000-0002-9900-1972"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Raff, Edward","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5084452718","display_name":"Michael Brautbar","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Brautbar, Michael","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5139650185","display_name":"Yaron Zinar","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Zinar, Yaron","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5139646179","display_name":"Benjamin Malmberg","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Malmberg, Benjamin","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5139657781","display_name":"Dor Agron","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Agron, Dor","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5139712772","display_name":"Sagi Sheinfeld","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Sheinfeld, Sagi","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5139635649","display_name":"Avraham Kama","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Kama, Avraham","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5139632716","display_name":"Asaf Romano","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Romano, Asaf","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11598","display_name":"Internet Traffic Analysis and Secure E-voting","score":0.3847000002861023,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11598","display_name":"Internet Traffic Analysis and Secure E-voting","score":0.3847000002861023,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11896","display_name":"Opportunistic and Delay-Tolerant Networks","score":0.04809999838471413,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10927","display_name":"Access Control and Trust","score":0.039799999445676804,"subfield":{"id":"https://openalex.org/subfields/3312","display_name":"Sociology and Political Science"},"field":{"id":"https://openalex.org/fields/33","display_name":"Social Sciences"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/lightweight-directory-access-protocol","display_name":"Lightweight Directory Access Protocol","score":0.949400007724762},{"id":"https://openalex.org/keywords/directory","display_name":"Directory","score":0.6926000118255615},{"id":"https://openalex.org/keywords/classifier","display_name":"Classifier (UML)","score":0.6636999845504761},{"id":"https://openalex.org/keywords/directory-service","display_name":"Directory service","score":0.5285000205039978},{"id":"https://openalex.org/keywords/protocol","display_name":"Protocol (science)","score":0.4771000146865845},{"id":"https://openalex.org/keywords/limiting","display_name":"Limiting","score":0.4050999879837036}],"concepts":[{"id":"https://openalex.org/C181177684","wikidata":"https://www.wikidata.org/wiki/Q188816","display_name":"Lightweight Directory Access Protocol","level":3,"score":0.949400007724762},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8159000277519226},{"id":"https://openalex.org/C2777683733","wikidata":"https://www.wikidata.org/wiki/Q201456","display_name":"Directory","level":2,"score":0.6926000118255615},{"id":"https://openalex.org/C95623464","wikidata":"https://www.wikidata.org/wiki/Q1096149","display_name":"Classifier (UML)","level":2,"score":0.6636999845504761},{"id":"https://openalex.org/C138338577","wikidata":"https://www.wikidata.org/wiki/Q756230","display_name":"Directory service","level":3,"score":0.5285000205039978},{"id":"https://openalex.org/C2780385302","wikidata":"https://www.wikidata.org/wiki/Q367158","display_name":"Protocol (science)","level":3,"score":0.4771000146865845},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.44850000739097595},{"id":"https://openalex.org/C188198153","wikidata":"https://www.wikidata.org/wiki/Q1613840","display_name":"Limiting","level":2,"score":0.4050999879837036},{"id":"https://openalex.org/C77088390","wikidata":"https://www.wikidata.org/wiki/Q8513","display_name":"Database","level":1,"score":0.3612000048160553},{"id":"https://openalex.org/C9652623","wikidata":"https://www.wikidata.org/wiki/Q190109","display_name":"Field (mathematics)","level":2,"score":0.35749998688697815},{"id":"https://openalex.org/C177264268","wikidata":"https://www.wikidata.org/wiki/Q1514741","display_name":"Set (abstract data type)","level":2,"score":0.31630000472068787},{"id":"https://openalex.org/C51632099","wikidata":"https://www.wikidata.org/wiki/Q3985153","display_name":"Training set","level":2,"score":0.3086000084877014},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.2903999984264374},{"id":"https://openalex.org/C77618280","wikidata":"https://www.wikidata.org/wiki/Q1155772","display_name":"Scheme (mathematics)","level":2,"score":0.27489998936653137},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.271699994802475},{"id":"https://openalex.org/C95922358","wikidata":"https://www.wikidata.org/wiki/Q5432725","display_name":"False positive rate","level":2,"score":0.265500009059906},{"id":"https://openalex.org/C136389625","wikidata":"https://www.wikidata.org/wiki/Q334384","display_name":"Supervised learning","level":3,"score":0.26019999384880066}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.48550/arxiv.2606.28917","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2606.28917","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"doi:10.48550/arxiv.2606.28917","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2606.28917","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"sustainable_development_goals":[{"id":"https://metadata.un.org/sdg/16","display_name":"Peace, Justice and strong institutions","score":0.6097047924995422}],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Lightweight":[0],"Directory":[1,16],"Access":[2],"Protocol":[3],"(LDAP)":[4],"is":[5,142,150],"a":[6,34,41,100,114,126,189],"protocol":[7],"that":[8],"allows":[9],"users":[10,22],"to":[11,26,63,70,80,98,124,188],"query":[12,83],"and":[13,75,103,166,173,203,214],"modify":[14],"Active":[15],"(AD)":[17],"data.":[18],"By":[19,85],"default,":[20],"all":[21,27],"have":[23],"read":[24],"access":[25],"AD":[28],"data":[29],"through":[30],"LDAP,":[31],"making":[32],"it":[33,149,158],"common":[35],"initial":[36],"tool":[37],"for":[38,131,153],"reconnaissance":[39,55],"when":[40],"threat":[42,50],"actor":[43],"first":[44,93],"compromises":[45],"an":[46,67,76],"identity.":[47],"To":[48],"capture":[49],"actors":[51],"early":[52],"in":[53],"the":[54,92,170,174,184,196],"phase,":[56],"we":[57],"developed":[58,118],"two":[59],"machine":[60],"learning":[61],"frameworks":[62],"detect":[64],"LDAP":[65,73,87,105,135,171,176],"reconnaissance:":[66],"ML":[68],"classifier":[69,172,185],"predict":[71],"malicious":[72,82,108,134],"queries":[74,88,106],"ML-based":[77,175],"data-mining":[78],"method":[79,179],"extract":[81],"signatures.":[84,136],"correlating":[86],"with":[89,145,183,210],"endpoint":[90],"detections,":[91],"framework":[94,130],"uses":[95],"weak":[96],"supervision":[97],"label":[99],"massive":[101],"dataset":[102],"classify":[104],"as":[107],"or":[109],"benign.":[110],"For":[111],"immediate":[112],"deployment,":[113],"second":[115],"technique":[116],"was":[117],"on":[119,195],"top":[120],"of":[121],"this":[122,138,154],"approach":[123,141],"employ":[125],"rigorous":[127],"statistical":[128],"hypothesis-testing":[129],"mining":[132,178],"novel,":[133],"While":[137],"weakly":[139],"supervised":[140],"limited":[143],"compared":[144],"manual":[146],"human":[147],"labeling,":[148],"more":[151],"practical":[152],"use":[155],"case":[156],"because":[157],"leverages":[159],"large-scale":[160],"automated":[161],"corpus":[162],"construction,":[163],"reducing":[164],"costs":[165],"time.":[167],"Ultimately,":[168],"both":[169],"signature":[177],"achieved":[180],"performance":[181],"benchmarks,":[182],"achieving":[186],"up":[187],"65\\%":[190],"True":[191],"Positive":[192],"Rate":[193],"(TPR)":[194],"holdout":[197],"set":[198],"while":[199],"limiting":[200],"false":[201],"positives,":[202],"mined":[204],"signatures":[205],"demonstrating":[206],"81.48\\%":[207],"field":[208],"precision":[209],"CrowdStrike's":[211],"Managed":[212],"Detection":[213],"Response":[215],"team.":[216]},"counts_by_year":[],"updated_date":"2026-07-28T07:46:37.118299","created_date":"2026-07-01T00:00:00"}