<?xml version="1.0" encoding="utf-8"?>
<TEI xmlns="http://www.tei-c.org/ns/1.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:hal="http://hal.archives-ouvertes.fr/" xmlns:gml="http://www.opengis.net/gml/3.3/" xmlns:gmlce="http://www.opengis.net/gml/3.3/ce" version="1.1" xsi:schemaLocation="http://www.tei-c.org/ns/1.0 http://api.archives-ouvertes.fr/documents/aofr-sword.xsd">
  <teiHeader>
    <fileDesc>
      <titleStmt>
        <title>HAL TEI export of hal-04957256v2</title>
      </titleStmt>
      <publicationStmt>
        <distributor>CCSD</distributor>
        <availability status="restricted">
          <licence target="https://creativecommons.org/publicdomain/zero/1.0/">CC0 1.0 - Universal</licence>
        </availability>
        <date when="2026-05-15T23:57:52+02:00"/>
      </publicationStmt>
      <sourceDesc>
        <p part="N">HAL API Platform</p>
      </sourceDesc>
    </fileDesc>
  </teiHeader>
  <text>
    <body>
      <listBibl>
        <biblFull>
          <titleStmt>
            <title xml:lang="en">DID U Misbehave? A New Dataset for In-Depth Understanding of Inconspicuous Software</title>
            <author role="aut">
              <persName>
                <forename type="first">Antonin</forename>
                <surname>Verdier</surname>
              </persName>
              <email type="md5">5bea11245bb2fc17ed4ef33c2b3b4bed</email>
              <email type="domain">univ-tlse3.fr</email>
              <idno type="idhal" notation="string">antonin-verdier</idno>
              <idno type="idhal" notation="numeric">1170590</idno>
              <idno type="halauthorid" notation="string">2398620-1170590</idno>
              <affiliation ref="#struct-394761"/>
              <affiliation ref="#struct-443875"/>
            </author>
            <author role="aut">
              <persName>
                <forename type="first">Romain</forename>
                <surname>Laborde</surname>
              </persName>
              <email type="md5">8c145f8c73207a8262c4e48c30770be1</email>
              <email type="domain">irit.fr</email>
              <idno type="idhal" notation="string">romain-laborde</idno>
              <idno type="idhal" notation="numeric">13844</idno>
              <idno type="halauthorid" notation="string">15693-13844</idno>
              <idno type="ORCID">https://orcid.org/0000-0002-0943-6180</idno>
              <idno type="GOOGLE SCHOLAR">https://scholar.google.com/citations?hl=en&amp;user=1pJCzucAAAAJ</idno>
              <idno type="IDREF">https://www.idref.fr/200735152</idno>
              <affiliation ref="#struct-394761"/>
              <affiliation ref="#struct-301366"/>
              <affiliation ref="#struct-443875"/>
            </author>
            <author role="aut">
              <persName>
                <forename type="first">Abir</forename>
                <surname>Laraba</surname>
              </persName>
              <email type="md5">ed65fa703a2c578326895a1d704acfa5</email>
              <email type="domain">irit.fr</email>
              <idno type="idhal" notation="numeric">1510353</idno>
              <idno type="halauthorid" notation="string">1505428-1510353</idno>
              <affiliation ref="#struct-443875"/>
            </author>
            <author role="aut">
              <persName>
                <forename type="first">Abdelmalek</forename>
                <surname>Benzekri</surname>
              </persName>
              <email type="md5">faa65eb20668bb871d62a33756c19970</email>
              <email type="domain">irit.fr</email>
              <idno type="idhal" notation="numeric">831859</idno>
              <idno type="halauthorid" notation="string">126127-831859</idno>
              <idno type="IDREF">https://www.idref.fr/08302302X</idno>
              <idno type="VIAF">https://viaf.org/viaf/196046239</idno>
              <idno type="ORCID">https://orcid.org/0000-0001-8236-8690</idno>
              <affiliation ref="#struct-34499"/>
              <affiliation ref="#struct-394761"/>
              <affiliation ref="#struct-443875"/>
            </author>
            <editor role="depositor">
              <persName>
                <forename>Antonin</forename>
                <surname>Verdier</surname>
              </persName>
              <email type="md5">ea1c2f02c5a6e2917f2e28aae564826d</email>
              <email type="domain">live.fr</email>
            </editor>
            <funder ref="#projanr-109992"/>
            <funder ref="#projeurop-727690"/>
            <funder ref="#projeurop-735846"/>
            <funder>CNRS EU-CHECK</funder>
          </titleStmt>
          <editionStmt>
            <edition n="v1">
              <date type="whenSubmitted">2025-02-19 16:35:28</date>
            </edition>
            <edition n="v2" type="current">
              <date type="whenSubmitted">2025-03-26 14:56:43</date>
              <date type="whenModified">2026-02-09 17:29:09</date>
              <date type="whenReleased">2025-04-04 10:53:13</date>
              <date type="whenProduced">2024-12-04</date>
              <date type="whenEndEmbargoed">2025-03-26</date>
              <ref type="file" target="https://hal.science/hal-04957256v2/document">
                <date notBefore="2025-03-26"/>
              </ref>
              <ref type="file" subtype="author" n="1" target="https://hal.science/hal-04957256v2/file/DUMB-cr.pdf" id="file-5006913-4338303">
                <date notBefore="2025-03-26"/>
              </ref>
            </edition>
            <respStmt>
              <resp>contributor</resp>
              <name key="1325934">
                <persName>
                  <forename>Antonin</forename>
                  <surname>Verdier</surname>
                </persName>
                <email type="md5">ea1c2f02c5a6e2917f2e28aae564826d</email>
                <email type="domain">live.fr</email>
              </name>
            </respStmt>
          </editionStmt>
          <publicationStmt>
            <distributor>CCSD</distributor>
            <idno type="halId">hal-04957256</idno>
            <idno type="halUri">https://hal.science/hal-04957256</idno>
            <idno type="halBibtex">verdier:hal-04957256</idno>
            <idno type="halRefHtml">&lt;i&gt;2024 8th Cyber Security in Networking Conference (CSNet)&lt;/i&gt;, Dec 2024, Paris, France. pp.205-212, &lt;a target="_blank" href="https://dx.doi.org/10.1109/CSNet64211.2024.10851723"&gt;&amp;#x27E8;10.1109/CSNet64211.2024.10851723&amp;#x27E9;&lt;/a&gt;</idno>
            <idno type="halRef">2024 8th Cyber Security in Networking Conference (CSNet), Dec 2024, Paris, France. pp.205-212, &amp;#x27E8;10.1109/CSNet64211.2024.10851723&amp;#x27E9;</idno>
            <availability status="restricted">
              <licence target="https://creativecommons.org/licenses/by-nc/4.0/">CC BY-NC 4.0 - Attribution - Non-commercial use<ref corresp="#file-5006913-4338303"/></licence>
            </availability>
          </publicationStmt>
          <seriesStmt>
            <idno type="stamp" n="UNIV-TLSE2">Université Toulouse 2</idno>
            <idno type="stamp" n="UNIV-TLSE3">Université de Toulouse</idno>
            <idno type="stamp" n="CNRS">CNRS - Centre national de la recherche scientifique</idno>
            <idno type="stamp" n="OPENAIRE">OpenAIRE</idno>
            <idno type="stamp" n="UT1-CAPITOLE">Université Toulouse 1 Capitole</idno>
            <idno type="stamp" n="IRIT">IRIT - Institut de Recherche en Informatique de Toulouse</idno>
            <idno type="stamp" n="IRIT-SIERA" corresp="IRIT">Service IntEgration and netwoRk Administration</idno>
            <idno type="stamp" n="ANR">ANR</idno>
            <idno type="stamp" n="IRIT-ASR" corresp="IRIT">Architecture, Systèmes, Réseaux</idno>
            <idno type="stamp" n="TOULOUSE-INP">Toulouse - INP</idno>
            <idno type="stamp" n="UNIV-UT3">Université Toulouse 3</idno>
            <idno type="stamp" n="UT3-INP">Université de Toulouse / Toulouse INP</idno>
            <idno type="stamp" n="UT3-TOULOUSEINP">Université de Toulouse / Toulouse INP</idno>
            <idno type="stamp" n="IUT_UT3">IUT Paul Sabatier</idno>
            <idno type="stamp" n="TRUSTINCLOUDS">Projet "TRUSTINCloudS" du PEPR Cloud </idno>
          </seriesStmt>
          <notesStmt>
            <note type="audience" n="2">International</note>
            <note type="invited" n="0">No</note>
            <note type="popular" n="0">No</note>
            <note type="peer" n="1">Yes</note>
            <note type="proceedings" n="0">No</note>
          </notesStmt>
          <sourceDesc>
            <biblStruct>
              <analytic>
                <title xml:lang="en">DID U Misbehave? A New Dataset for In-Depth Understanding of Inconspicuous Software</title>
                <author role="aut">
                  <persName>
                    <forename type="first">Antonin</forename>
                    <surname>Verdier</surname>
                  </persName>
                  <email type="md5">5bea11245bb2fc17ed4ef33c2b3b4bed</email>
                  <email type="domain">univ-tlse3.fr</email>
                  <idno type="idhal" notation="string">antonin-verdier</idno>
                  <idno type="idhal" notation="numeric">1170590</idno>
                  <idno type="halauthorid" notation="string">2398620-1170590</idno>
                  <affiliation ref="#struct-394761"/>
                  <affiliation ref="#struct-443875"/>
                </author>
                <author role="aut">
                  <persName>
                    <forename type="first">Romain</forename>
                    <surname>Laborde</surname>
                  </persName>
                  <email type="md5">8c145f8c73207a8262c4e48c30770be1</email>
                  <email type="domain">irit.fr</email>
                  <idno type="idhal" notation="string">romain-laborde</idno>
                  <idno type="idhal" notation="numeric">13844</idno>
                  <idno type="halauthorid" notation="string">15693-13844</idno>
                  <idno type="ORCID">https://orcid.org/0000-0002-0943-6180</idno>
                  <idno type="GOOGLE SCHOLAR">https://scholar.google.com/citations?hl=en&amp;user=1pJCzucAAAAJ</idno>
                  <idno type="IDREF">https://www.idref.fr/200735152</idno>
                  <affiliation ref="#struct-394761"/>
                  <affiliation ref="#struct-301366"/>
                  <affiliation ref="#struct-443875"/>
                </author>
                <author role="aut">
                  <persName>
                    <forename type="first">Abir</forename>
                    <surname>Laraba</surname>
                  </persName>
                  <email type="md5">ed65fa703a2c578326895a1d704acfa5</email>
                  <email type="domain">irit.fr</email>
                  <idno type="idhal" notation="numeric">1510353</idno>
                  <idno type="halauthorid" notation="string">1505428-1510353</idno>
                  <affiliation ref="#struct-443875"/>
                </author>
                <author role="aut">
                  <persName>
                    <forename type="first">Abdelmalek</forename>
                    <surname>Benzekri</surname>
                  </persName>
                  <email type="md5">faa65eb20668bb871d62a33756c19970</email>
                  <email type="domain">irit.fr</email>
                  <idno type="idhal" notation="numeric">831859</idno>
                  <idno type="halauthorid" notation="string">126127-831859</idno>
                  <idno type="IDREF">https://www.idref.fr/08302302X</idno>
                  <idno type="VIAF">https://viaf.org/viaf/196046239</idno>
                  <idno type="ORCID">https://orcid.org/0000-0001-8236-8690</idno>
                  <affiliation ref="#struct-34499"/>
                  <affiliation ref="#struct-394761"/>
                  <affiliation ref="#struct-443875"/>
                </author>
              </analytic>
              <monogr>
                <meeting>
                  <title>2024 8th Cyber Security in Networking Conference (CSNet)</title>
                  <date type="start">2024-12-04</date>
                  <date type="end">2024-12-06</date>
                  <settlement>Paris</settlement>
                  <country key="FR">France</country>
                </meeting>
                <imprint>
                  <publisher>IEEE</publisher>
                  <biblScope unit="pp">205-212</biblScope>
                </imprint>
              </monogr>
              <idno type="doi">10.1109/CSNet64211.2024.10851723</idno>
            </biblStruct>
          </sourceDesc>
          <profileDesc>
            <langUsage>
              <language ident="en">English</language>
            </langUsage>
            <textClass>
              <keywords scheme="author">
                <term xml:lang="en">Living-off-the-land attacks</term>
                <term xml:lang="en">Dataset</term>
                <term xml:lang="en">Behaviour analysis</term>
                <term xml:lang="en">Software documentation</term>
              </keywords>
              <classCode scheme="halDomain" n="info.info-cr">Computer Science [cs]/Cryptography and Security [cs.CR]</classCode>
              <classCode scheme="halTypology" n="COMM">Conference papers</classCode>
              <classCode scheme="halOldTypology" n="COMM">Conference papers</classCode>
              <classCode scheme="halTreeTypology" n="COMM">Conference papers</classCode>
            </textClass>
            <abstract xml:lang="en">
              <p>Living-Off-The-Land attacks involve exploiting preinstalled genuine and trusted software for malicious purposes. The various methods available for detecting these attacks often rely on an in-depth understanding of the software components that attackers could abuse. This hypothesis is unrealistic today given the number of software components installed on a system and the number of options available for each software component. We present in this article an open access dataset built from the deep analysis performed by security experts of 912 options of 23 different Linux command-line software programs. The associated section of manual documentation of these command options is labelled as belonging to one of 12 possible behaviour classes from our consolidated taxonomy. Our contributions represent an important step toward understanding system-wide software execution as combinations and chains of individual behaviours regardless of the underlying software.</p>
            </abstract>
          </profileDesc>
        </biblFull>
      </listBibl>
    </body>
    <back>
      <listOrg type="structures">
        <org type="researchteam" xml:id="struct-394761" status="OLD">
          <orgName>Service IntEgration and netwoRk Administration</orgName>
          <orgName type="acronym">IRIT-SIERA</orgName>
          <date type="end">2025-01-01</date>
          <desc>
            <address>
              <addrLine>IRIT118 Route de Narbonne31062 Toulouse Cedex 9</addrLine>
              <country key="FR"/>
            </address>
            <ref type="url">https://www.irit.fr/departement/architecture-systemes-reseaux/equipe-siera/</ref>
          </desc>
          <listRelation>
            <relation active="#struct-34499" type="direct"/>
            <relation active="#struct-81148" type="indirect"/>
            <relation name="443875" active="#struct-443875" type="indirect"/>
            <relation active="#struct-116256" type="indirect"/>
            <relation active="#struct-443875" type="indirect"/>
            <relation active="#struct-217752" type="indirect"/>
            <relation name="UMR5505 / URA1399" active="#struct-441569" type="indirect"/>
            <relation active="#struct-448187" type="indirect"/>
            <relation active="#struct-1149079" type="indirect"/>
            <relation name="FED4171" active="#struct-217752" type="indirect"/>
          </listRelation>
        </org>
        <org type="regroupinstitution" xml:id="struct-443875" status="VALID">
          <idno type="ROR">https://ror.org/017tgbk05</idno>
          <orgName>Communauté d'universités et établissements de Toulouse</orgName>
          <orgName type="acronym">Comue de Toulouse</orgName>
          <desc>
            <address>
              <addrLine>41 Allée Jules Guesde, 31000 Toulouse</addrLine>
              <country key="FR"/>
            </address>
            <ref type="url">https://www.univ-toulouse.fr/</ref>
          </desc>
        </org>
        <org type="regrouplaboratory" xml:id="struct-301366" status="OLD">
          <orgName>Institut Universitaire de Technologie - Paul Sabatier</orgName>
          <orgName type="acronym">IUT Toulouse Auch Castres</orgName>
          <date type="end">2025-01-01</date>
          <desc>
            <address>
              <addrLine>Université Toulouse III - 115C, route de Narbonne - 31077 Toulouse</addrLine>
              <country key="FR"/>
            </address>
            <ref type="url">https://iut.univ-tlse3.fr/</ref>
          </desc>
          <listRelation>
            <relation active="#struct-217752" type="direct"/>
            <relation active="#struct-443875" type="indirect"/>
          </listRelation>
        </org>
        <org type="laboratory" xml:id="struct-34499" status="OLD">
          <idno type="IdRef">030947448</idno>
          <idno type="ISNI">0000000121927225</idno>
          <idno type="RNSR">199511949P</idno>
          <idno type="ROR">https://ror.org/01rx4qw44</idno>
          <orgName>Institut de recherche en informatique de Toulouse</orgName>
          <orgName type="acronym">IRIT</orgName>
          <date type="start">1990-01-01</date>
          <date type="end">2025-01-01</date>
          <desc>
            <address>
              <addrLine>118 Route de Narbonne, F-31062 Toulouse Cedex 9</addrLine>
              <country key="FR"/>
            </address>
            <ref type="url">http://www.irit.fr/</ref>
          </desc>
          <listRelation>
            <relation active="#struct-81148" type="direct"/>
            <relation name="443875" active="#struct-443875" type="indirect"/>
            <relation active="#struct-116256" type="direct"/>
            <relation active="#struct-443875" type="indirect"/>
            <relation active="#struct-217752" type="direct"/>
            <relation name="UMR5505 / URA1399" active="#struct-441569" type="direct"/>
            <relation active="#struct-448187" type="direct"/>
            <relation active="#struct-1149079" type="direct"/>
            <relation name="FED4171" active="#struct-217752" type="direct"/>
          </listRelation>
        </org>
        <org type="institution" xml:id="struct-81148" status="VALID">
          <idno type="IdRef">026404354</idno>
          <idno type="ISNI">0000000121902837</idno>
          <idno type="ROR">https://ror.org/0443n9e75</idno>
          <orgName>Université Toulouse Capitole</orgName>
          <orgName type="acronym">UT Capitole</orgName>
          <date type="start">1970-01-01</date>
          <desc>
            <address>
              <addrLine>2 rue du Doyen-Gabriel-Marty - 31042 Toulouse Cedex 9</addrLine>
              <country key="FR"/>
            </address>
            <ref type="url">http://www.ut-capitole.fr/</ref>
          </desc>
          <listRelation>
            <relation name="443875" active="#struct-443875" type="direct"/>
          </listRelation>
        </org>
        <org type="institution" xml:id="struct-116256" status="VALID">
          <idno type="IdRef">026403994</idno>
          <idno type="ROR">https://ror.org/04ezk3x31</idno>
          <orgName>Université Toulouse - Jean Jaurès</orgName>
          <orgName type="acronym">UT2J</orgName>
          <date type="start">1971-01-01</date>
          <desc>
            <address>
              <addrLine>5 allées Antonio Machado - 31058 Toulouse Cedex 9</addrLine>
              <country key="FR"/>
            </address>
            <ref type="url">http://www.univ-tlse2.fr</ref>
          </desc>
          <listRelation>
            <relation active="#struct-443875" type="direct"/>
          </listRelation>
        </org>
        <org type="institution" xml:id="struct-217752" status="OLD">
          <idno type="IdRef">026404672</idno>
          <idno type="ISNI">0000000121617331</idno>
          <idno type="ROR">https://ror.org/02v6kpv12</idno>
          <idno type="Wikidata">Q1273188</idno>
          <orgName>Université Toulouse III - Paul Sabatier</orgName>
          <orgName type="acronym">UT3</orgName>
          <date type="end">2025-01-01</date>
          <desc>
            <address>
              <addrLine>118 route de Narbonne - 31062 Toulouse</addrLine>
              <country key="FR"/>
            </address>
            <ref type="url">http://www.univ-tlse3.fr/</ref>
          </desc>
          <listRelation>
            <relation active="#struct-443875" type="direct"/>
          </listRelation>
        </org>
        <org type="regroupinstitution" xml:id="struct-441569" status="VALID">
          <idno type="IdRef">02636817X</idno>
          <idno type="ISNI">0000000122597504</idno>
          <idno type="ROR">https://ror.org/02feahw73</idno>
          <orgName>Centre National de la Recherche Scientifique</orgName>
          <orgName type="acronym">CNRS</orgName>
          <date type="start">1939-10-19</date>
          <desc>
            <address>
              <country key="FR"/>
            </address>
            <ref type="url">https://www.cnrs.fr/</ref>
          </desc>
        </org>
        <org type="institution" xml:id="struct-448187" status="VALID">
          <idno type="IdRef">026388820</idno>
          <idno type="ISNI">0000000121766169</idno>
          <idno type="ROR">https://ror.org/033p9g875</idno>
          <orgName>Institut National Polytechnique (Toulouse)</orgName>
          <orgName type="acronym">Toulouse INP</orgName>
          <desc>
            <address>
              <country key="FR"/>
            </address>
            <ref type="url">https://www.inp-toulouse.fr/</ref>
          </desc>
          <listRelation>
            <relation active="#struct-443875" type="direct"/>
          </listRelation>
        </org>
        <org type="regrouplaboratory" xml:id="struct-1149079" status="OLD">
          <orgName>Toulouse Mind &amp; Brain Institut</orgName>
          <orgName type="acronym">TMBI</orgName>
          <date type="start">2021-01-01</date>
          <date type="end">2025-01-01</date>
          <desc>
            <address>
              <addrLine>CHU Purpan, Pavillon Baudot, 31059 Toulouse cedex 9</addrLine>
              <country key="FR"/>
            </address>
            <ref type="url">https://www.tmbi.fr/</ref>
          </desc>
          <listRelation>
            <relation active="#struct-116256" type="direct"/>
            <relation active="#struct-443875" type="indirect"/>
            <relation name="FED4171" active="#struct-217752" type="direct"/>
          </listRelation>
        </org>
      </listOrg>
      <listOrg type="projects">
        <org type="anrProject" xml:id="projanr-109992" status="VALID">
          <idno type="anr">ANR-23-PECL-0009</idno>
          <orgName>TRUSTINClouds</orgName>
          <desc>Sécurité des infrastructures Cloud</desc>
          <date type="start">2023</date>
        </org>
        <org type="europeanProject" xml:id="projeurop-727690" status="INCOMING">
          <idno type="number">GA 956562</idno>
          <orgName>LeADS</orgName>
          <desc>H2020 Legality Attentive Data Scientists</desc>
        </org>
        <org type="europeanProject" xml:id="projeurop-735846" status="INCOMING">
          <desc>Horizon Europe DUCA (GA 101086308)</desc>
        </org>
      </listOrg>
    </back>
  </text>
</TEI>