Authors:
Tiago Heinrich
1
;
Newton Will
2
;
Rafael Obelheiro
3
and
Carlos Maziero
1
Affiliations:
1
Computer Science Department, Federal University of Paraná, Curitiba, 81530–015, Brazil
;
2
Computer Science Department, Federal University of Technology, Paraná, Dois Vizinhos, 85660–000, Brazil
;
3
Computer Science Department, State University of Santa Catarina, Joinville, 89219–710, Brazil
Keyword(s):
WebAssembly, WASI Interface, Intrusion Detection, Web Services, Security.
Abstract:
The security of Web Services for users and developers is essential; since WebAssembly is a new format that has gained attention in this type of environment over the years, new measures for security are important. However, intrusion detection solutions for WebAssembly applications are generally limited to static binary analysis. We present a novel approach for dynamic WebAssembly intrusion detection, using data categorization and machine learning. Our proposal analyses communication data extracted from the WebAssembly sandbox, with the goal of better capturing the applications’ behavior. Our approach was validated using two strategies, online and offline, to assess the effectiveness of categorical data for intrusion detection. The obtained results show that both strategies are feasible for WebAssembly intrusion detection, with a high detection rate and low false negative and false positive rates.