Institution profile

Crowdstrike Holdings Inc

Industry researchnorthamerica · us
Official website
Research library6linked papers
Opportunities0open roles
Selected work

Representative Papers

Cybersecurity Detection Classification with Reasoning-enabled Language Models

Jul 30, 2026

This work addresses alert fatigue and detection backlogs in Security Operations Centers by proposing an automated triage method that integrates chain-of-thought reasoning into large language models. It pioneers the application of chain-of-thought prompting to Windows endpoint threat detection, enhanced through automatic prompt optimization, self-training, and reinforcement learning fine-tuned with verifiable rewards. To mitigate confidence degradation during reasoning, an independent probability calibrator is introduced. Experimental results demonstrate that the proposed approach, under task-specific fine-tuning, substantially outperforms general-purpose large language models, achieving an overall accuracy of 82.6%. In high-confidence automated triage scenarios, it improves recall rates by 43.0% for benign samples and 18.3% for malicious ones.

0 citationsRead paper

ML-Powered LDAP Reconnaissance Detection using Weak Supervision

Jun 27, 2026

This study addresses the challenge of early detection of stealthy reconnaissance activities in Active Directory conducted via the LDAP protocol, which are often difficult to identify due to their benign appearance. To tackle this issue, the authors propose an automated, annotation-free detection approach that innovatively integrates weakly supervised learning with statistical hypothesis testing. The weakly supervised component trains a classifier to assess the maliciousness of LDAP queries, achieving a 65% true positive rate on a hold-out set while maintaining low false positives. Complementarily, statistical hypothesis testing correlates endpoint telemetry to extract high-confidence signatures of malicious queries, yielding a practical precision of 81.48%. This work represents the first effort to combine these techniques for LDAP-based reconnaissance detection, enabling scalable, automatic discovery and signature extraction of malicious behaviors.

0 citationsRead paper

Large Byte Model: Teaching Language Models About Compiled Code

Jun 01, 2026

Traditional large language models struggle to directly process raw bytes of executable files, limiting their applicability to binary understanding tasks such as malware analysis. This work proposes the first large language model natively designed for byte-level input, integrating a custom byte tokenizer, byte-level language modeling, and injection of binary-domain knowledge to enable semantic understanding and question answering over compiled code. Experimental results demonstrate that the proposed approach achieves 69% accuracy in malware family classification and 98% accuracy in architecture classification, substantially outperforming general-purpose large language models. These findings underscore the effectiveness and necessity of native byte-level modeling combined with domain-specific knowledge for advancing binary analysis capabilities.

0 citationsRead paper
Recent publications

Latest Papers

Cybersecurity Detection Classification with Reasoning-enabled Language Models

Jul 30, 2026

This work addresses alert fatigue and detection backlogs in Security Operations Centers by proposing an automated triage method that integrates chain-of-thought reasoning into large language models. It pioneers the application of chain-of-thought prompting to Windows endpoint threat detection, enhanced through automatic prompt optimization, self-training, and reinforcement learning fine-tuned with verifiable rewards. To mitigate confidence degradation during reasoning, an independent probability calibrator is introduced. Experimental results demonstrate that the proposed approach, under task-specific fine-tuning, substantially outperforms general-purpose large language models, achieving an overall accuracy of 82.6%. In high-confidence automated triage scenarios, it improves recall rates by 43.0% for benign samples and 18.3% for malicious ones.

0 citationsRead paper

ML-Powered LDAP Reconnaissance Detection using Weak Supervision

Jun 27, 2026

This study addresses the challenge of early detection of stealthy reconnaissance activities in Active Directory conducted via the LDAP protocol, which are often difficult to identify due to their benign appearance. To tackle this issue, the authors propose an automated, annotation-free detection approach that innovatively integrates weakly supervised learning with statistical hypothesis testing. The weakly supervised component trains a classifier to assess the maliciousness of LDAP queries, achieving a 65% true positive rate on a hold-out set while maintaining low false positives. Complementarily, statistical hypothesis testing correlates endpoint telemetry to extract high-confidence signatures of malicious queries, yielding a practical precision of 81.48%. This work represents the first effort to combine these techniques for LDAP-based reconnaissance detection, enabling scalable, automatic discovery and signature extraction of malicious behaviors.

0 citationsRead paper

Large Byte Model: Teaching Language Models About Compiled Code

Jun 01, 2026

Traditional large language models struggle to directly process raw bytes of executable files, limiting their applicability to binary understanding tasks such as malware analysis. This work proposes the first large language model natively designed for byte-level input, integrating a custom byte tokenizer, byte-level language modeling, and injection of binary-domain knowledge to enable semantic understanding and question answering over compiled code. Experimental results demonstrate that the proposed approach achieves 69% accuracy in malware family classification and 98% accuracy in architecture classification, substantially outperforming general-purpose large language models. These findings underscore the effectiveness and necessity of native byte-level modeling combined with domain-specific knowledge for advancing binary analysis capabilities.

0 citationsRead paper