Hi-Res: Precise Exploit Detection Using Object-Granular Memory Monitoring

Despite numerous methods for identifying, preventing, and protecting against kernel-level exploits, attacks persist. One of the key challenges is the prevalence of weird machines- unintended computational artifacts that attackers dynamically stitch together from unmonitored low-level operations. This paper presents Hi-Res, a programmable detection framework that distinguishes exploit behaviors from benign behaviors by systematically deriving a high-level view from their low-level memory operations. Unlike traditional methods that rely on expert-driven, hand-crafted monitors, Hi-Res automatically generates a unique fingerprint of kernel execution given a specific input and execution contexts. Hi-Res projects memory traces into a high-resolution hyperplane, where behavioral finger-prints are constructed from observed access patterns. Using this representation, Hi-Res, is able to explore the hypothesis that low-level program traces exhibit locality properties that are distinct, context-sensitive memory access patterns unique to specific workloads. This locality coupled with the concrete Hi-Res representation enables the empirical modeling of working sets without prior knowledge of program semantics. By analyzing specific dynamic context tuples-such as system call, access-from location, allocation contexts, and call stacks-we demonstrate that these fingerprints reliably differentiate between normal and exploit behaviors. Our results confirm that locality serves as a robust signal for precise exploit detection, establishing Hi-Res as a general, data-driven framework for dynamic security monitoring.