Joseph Reinert

The Specificity Floor: Dual-Use Detection Is an Information Problem, Not a Model Problem

Living-off-the-land / dual-use activity is the hard core of intrusion detection: a benign administrator and an attacker run the same tools, and on host telemetry their events can be shaped identically. We show that separating them is an information problem, not a model problem —...