Zero-Day Exploit Detection Using Machine Learning
Summary: Palo Alto Networks Unit 42 trained two deep learning models, one for SQL injection and one for command injection, on real-world zero-day and benign traffic to catch exploits that signature-based IPS misses. The models detected an unknown IoT zero-day seen on April 29, 2022 that default IPS did not alert on, plus exploits for Atlassian Confluence CVE-2022-26134, Tenda AC18 router CVE-2022-31446, Moodle CVE-2022-0332 and Django CVE-2022-34265.
What you should know: The IoT zero-day case is the one to sit with: the default IPS configuration produced no alert at all, and only the machine learning model flagged the traffic with high confidence, while the C2 server went down shortly after, closing off verification.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026