Probabilistic Program Modeling for High-Precision Anomaly Classification

摘要: The trend constantly being observed in the evolution of advanced modern exploits is their growing sophistication stealthy attacks. Code-reuse attacks such as return-oriented programming allow intruders to execute mal-intended instruction sequences on a victim machine without injecting external code. We introduce new anomaly-based detection technique that probabilistically models and learns program's control flows for high-precision behavioral reasoning monitoring. Our prototype Linux named STILO, which stands STatically InitiaLized markOv. Experimental evaluation involves real-world code-reuse over 4,000 testcases from server utility programs. STILO achieves up 28-fold improvement accuracy state-of-the-art HMM-based anomaly detection. findings suggest probabilistic modeling program dependences provides significant source behavior information building real-time system