How we trained an ML model to detect DLL hijacking

Kaspersky’s Securelist reports on building a machine-learning model to detect DLL hijacking, detailing how three generations of models were developed and progressively refined for practical use. The project used internal dynamic library load data and anonymised telemetry, with training samples numbering in the tens of millions of objects, including about 20 million clean files and around 50,000 definitively malicious ones.

In their labeled dataset, the unknown category comprised roughly 18 million, with about 6 million in another unknown/uncategorised segment, Malicious around 50,000 and 1,000 in the unique-files column, and Clean around 20 million and 250,000 in the unique-files column. The models evolved from broad interpretations of DLL hijacking to a third generation that achieved lower false-positives and higher true-positives, reaching about 0.8 true positives at a similar low false-positive rate.

Practically, the three generations are used within telemetry streams that number around 6.5 million security events daily, linked to 800,000 unique files, and the system can detect thousands of files used in DLL hijacking each month. The article notes detection stability over time, with the third-generation model deployed in a Kaspersky SIEM and MDR context and described as aiding in preventing DLL hijacking incidents for clients.