A Feasibility Study of Autonomically Detecting In-Process Cyber-Attacks

A cyber-attack detection system issues alerts when an attacker attempts to coerce a trusted software application to perform unsafe actions on the attacker's behalf. One way of issuing such alerts is to create an application-agnostic cyber- attack detection system that responds to prevalent software vulnerabilities. The creation of such an autonomic alert system, however, is impeded by the disparity between implementation language, function, quality-of-service (QoS) requirements, and architectural patterns present in applications, all of which contribute to the rapidly changing threat landscape presented by modern heterogeneous software systems. This paper evaluates the feasibility of creating an autonomic cyber-attack detection system and applying it to several exemplar web-based applications using program transformation and machine learning techniques. Specifically, we examine whether it is possible to detect cyber-attacks (1) online, i.e., as they occur using lightweight structures derived from a call graph and (2) offline, i.e., using machine learning techniques trained with features extracted from a trace of application execution. In both cases, we first characterize normal application behavior using supervised training with the test suites created for an application as part of the software development process. We then intentionally perturb our test applications so they are vulnerable to common attack vectors and then evaluate the effectiveness of various feature extraction and learning strategies on the perturbed applications. Our results show that both lightweight on-line models based on control flow of execution path and application specific off-line models can successfully and efficiently detect in-process cyber-attacks against web applications.

I. Introduction

Cyber-attacks continue to grow in frequency and severity, e.g., from 2015 to 2016 the average annualized loss from cyber-attacks increased $3.03 million in financial services companies,$2.95 million in technology companies, and $2.24 million in retail companies [1]. Various techniques have been developed to help prevent and defend against cyber-attacks. Manual approaches [2]–[4], such as defensive programming and code reviews, are widely applied to limit and correct mistakes made by software developers. Dynamic taint analysis techniques [5], [6] aid in detecting code vulnerabilities. Likewise, machine learning techniques [7]–[9] have been applied to detect cyber-attacks and identify vulnerabilities.