BSides London 2021 BSides London 2021

Saturday, November 13, 2021

- GMT
To pwd or not to pwd

Based upon my dissertation on identifying users by bash commands history. I will present some interesting findings from the dataset of bash_histories I have collected, as well as showing the most useful features for the identification (who would have thought some people have a trailing space at the end of just 3 of their 20k commands, while some people have dozens, if not hundreds?)