Tracing Software Exploitation

Abstract

Current exploit detection techniques are designed based on expert observations, manual analysis, and heuristic-like techniques. Because of the manual process for creating such defences, they are usually limited in the number of exploit techniques that can be detected. Machine Learning-based techniques offer greater promise to detect zero-day exploits. Current research in the use of machine learning for unknown attack detection is limited to intrusion detection and malware analysis, limited research is available for the detection of exploits targeting zero-day vulnerabilities using machine learning methods. These limitations stem from the lack of extensive datasets that are tailored for the problem of software exploitation. In this paper, we introduce a method and toolset for creating exploit traces datasets. Our approach allows capturing full traces of benign software under exploitation and recording of the vulnerable threads within an application, providing a comprehensive view of program execution. We evaluated our method and tools on 13 unique and distinct applications and recorded their traces while they were under attack. Our approach was able to successfully trace 53% of the applications and was able to detect the exploit payloads in 71% of the applications that were successfully traced.