# Identifying Security Platform Product Abuse with Machine Learning

arXiv: https://arxiv.org/abs/2609.21303 · HTML: https://mlsanity.com/paper/2609.21303/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 10 of its 40 references that are in the map.
- First posted on arXiv 18 Sep 2026.

## Builds on (most cited first, 10 of 10)

- [A Unified Approach to Interpreting Model Predictions](https://mlsanity.com/paper/1705.07874/) (2017)
- [A Survey of Machine Learning Methods and Challenges for Windows Malware Classification](https://mlsanity.com/paper/2006.09271/) (2020)
- [A System for Automated Open-Source Threat Intelligence Gathering and Management](https://mlsanity.com/paper/2101.07769/) (2021)
- [A Query System for Efficiently Investigating Complex Attack Behaviors for Enterprise Security](https://mlsanity.com/paper/1810.03464/) (2018)
- [That Escalated Quickly: An ML Framework for Alert Prioritization](https://mlsanity.com/paper/2302.06648/) (2023)
- [Living off the Analyst: Harvesting Features from Yara Rules for Malware Detection](https://mlsanity.com/paper/2411.18516/) (2024)
- [Living-off-the-Land Abuse Detection Using Natural Language Processing and Supervised Learning](https://mlsanity.com/paper/2208.12836/) (2022)
- [Cybersecurity is the True Frontier for Generative AI Success or Failure](https://mlsanity.com/paper/2606.28929/) (2026)
- [A Likelihood Ratio Detector for Identifying Within-Perimeter Computer Network Attacks](https://mlsanity.com/paper/1609.00104/) (2016)
- [Robust Synthetic Data-Driven Detection of Living-Off-the-Land Reverse Shells](https://mlsanity.com/paper/2402.18329/) (2024)

## Abstract (arXiv)

Product abuse is an individually rare, but growing, problem across the SaaS industry. Highly sophisticated threat actors can misuse security platforms within customer environments or conduct bypass experiments on the product itself. Threat actors can leverage living-off-the-land (LOTL) attacks to avoid using cumbersome, frequently detected malware. Remediating this threat requires collecting multiple data modalities across different types of databases, addressing a cold-start problem in the intrinsic rarity of such sophisticated but dangerous events, and designing within the constraints of real-world deployment (e.g., cost, user behavior, performance, etc). To wit, we provide the first study of such a whole-system defense, especially with respect to a deployed and operational capability. Our results show an increase in product abuse coverage by 35%, a 30% reduction in monthly alerts, and adaptability to changes in malicious actors' behavior. We review both the constraints we considered in designing the system to meet operational requirements and a retrospective evaluation of the value of explainable features and counterfactual performance on previously identified attacks.