Long-span program behavior modeling and attack detection

Xiaokui Shu, Danfeng Yao, Naren Ramakrishnan, Trent Jaeger

Research output: Contribution to journalArticlepeer-review

22 Scopus citations


Intertwined developments between program attacks and defenses witness the evolution of program anomaly detection methods. Emerging categories of program attacks, e.g., non-control data attacks and data-oriented programming, are able to comply with normal trace patterns at local views. This article points out the deficiency of existing program anomaly detection models against new attacks and presents long-span behavior anomaly detection (LAD), a model based on mildly context-sensitive grammar verification. The key feature of LAD is its reasoning of correlations among arbitrary events that occurred in long program traces. It extends existing correlation analysis between events at a stack snapshot, e.g., paired call and ret, to correlation analysis among events that historically occurred during the execution. The proposed method leverages specialized machine learning techniques to probe normal program behavior boundaries in vast high-dimensional detection space. Its two-stage modeling/detection design analyzes event correlation at both binary and quantitative levels. Our prototype successfully detects all reproduced real-world attacks against sshd, libpcre, and sendmail. The detection procedure incurs 0.1 ms to 1.3 ms overhead to profile and analyze a single behavior instance that consists of tens of thousands of function call or system call events. 2017 Copyright is held by the owner/author(s). Publication rights licensed to ACM.

Original languageEnglish (US)
Article number12
JournalACM Transactions on Privacy and Security
Issue number4
StatePublished - Sep 2017

All Science Journal Classification (ASJC) codes

  • General Computer Science
  • Safety, Risk, Reliability and Quality


Dive into the research topics of 'Long-span program behavior modeling and attack detection'. Together they form a unique fingerprint.

Cite this