Horus: An Effective and Reliable Framework for Code-Reuse Exploits Detection in Data Stream

Abstract

Recent years have witnessed a rapid growth of code-reuse attacks in advance persistent threats and cyberspace crimes. Carefully crafted code-reuse exploits circumvent modern protection mechanisms and hijack the execution flow of a program to perform expected functionalities by chaining together existing codes. The sophistication and intricacy of code-reuse exploits hinder the scrutinization and dissection of them. Although the previous literature has introduced some feasible approaches, effectiveness and reliability in practical applications remain severe challenges. To address this issue, we propose Horus, a data-driven framework for effective and reliable detection on code-reuse exploits. In order to raise the effectiveness against underlying noises, we comprehensively leverage the strengths of time-series and frequency-domain analysis, and propose a learning-based detector that synthesizes the contemporary twofold features. Then we employ a lightweight interpreter to speculatively and tentatively translate the suspicious bytes to open the black box and enhance the reliability and interpretability. Additionally, a functionality-preserving data augmentation is adopted to increase the diversity of limited training data and raise the generality for real-world deployment. Comparative experiments and ablation studies are conducted on a dataset composed of real-world instances to verify and prove the prevalence of Horus. The experimental results illustrate that Horus outperforms existing methods on the identification of code-reuse exploits from data stream with an acceptable overhead. Horus does not rely on any dynamic executions and can be easily integrated into existing defense systems. Moreover, Horus is able to provide tentative interpretations about attack semantics irrespective of target program, which further improve system’s effectiveness and reliability.

Use of Ensemble Learning to Detect Buffer Overflow Exploitation

“…This review of the existing literature on the use of ML for exploitation detection focuses on papers that use runtime traces from processors as signals. Research that uses network traffic, such as [18], [19], [20], [26] static file analysis, [21], [22], [23] is excluded from the scope of this literature review. Furthermore, research on the use of heuristic-based techniques is also excluded.…”

“…Machine Learning (ML)-based exploitation detection research is limited in terms of quantity and content. To the best of our knowledge, we were able to find only 14 papers [13], [14], [15], [16], [17], [18], [19], [20], [21], [22], [23], [24], [25], [26] that discussed the use of ML for exploitation detection. None of the 14 papers publicly presented their datasets.…”

“…None of the 14 papers publicly presented their datasets. These research papers were segmented into seven that relied on runtime traces [13], [14], [15], [16], [17], [24], [25], four that relied on network traces, [18], [19], [20], [26] and three that relied on static analysis of the application under test (AUT) (i.e., vulnerable program) [21], [22], [23]. Of the 14 papers, 13 did not discuss feature importance and only one paper discussed feature importance by providing a single table with the Fisher score of each feature [16].…”