US-23-Huang-IRonMAN.pdf

IR-on-MAN is an interpretable incident inspector presented at Black Hat USA 2023 that uses a command-line-specific embedding model (CmdGPT), a domain-aware "Meaningful Tokenizer," and latent feature mining to detect malicious command-lines and surface significant tokens for explainable detection. The briefing covers model architecture (knowledge distillation from a teacher), token impact analysis, clustering and cross-incident mining, demo site and Sigma rule export, and evaluation on a red-team dataset reporting ~96.9% recall and ~85.6% precision.