Hardware Data Flow Anomaly Detection for Unknown Attacks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing security techniques are inadequate in detecting and mitigating data-oriented attacks, as they incur significant performance overheads and are ineffective against unknown data attacks, particularly as attackers shift focus from control flow attacks to data flow attacks.
Innovation Solution
A data flow anomaly detection system that uses hardware-based telemetry data to monitor and protect control flows by instrumenting application programs to generate metadata on API calls and code locations, encoding data trace records, and employing machine learning to train a data flow model for anomaly detection, enabling real-time detection of unknown data flow attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If hardware-based telemetry data and machine learning are used for data flow anomaly detection, then detection accuracy for unknown data attacks is improved, but computational overhead and system complexity increase
Solution Approach 1:
The system performs preliminary actions by training the machine learning model offline using historical data flow patterns before deployment. During runtime, the pre-trained model quickly evaluates new data flows against established patterns, enabling accurate detection without heavy computational overhead during critical monitoring phases
Solution Approach 2:
The system creates simplified copies of data flow patterns by training the machine learning model on representative historical data. The model learns to recognize normal and malicious patterns through training datasets, allowing it to detect anomalies in real-time without requiring complex rule-based systems or exhaustive analysis of every data flow
2Reliability
If traditional security techniques are used to detect data-oriented attacks, then known attack patterns can be identified, but performance overhead is significant and unknown attacks cannot be detected
Solution Approach 1:
The system replaces traditional mechanical rule-based security techniques with a machine learning-based approach. Instead of using fixed signatures and patterns that require extensive matching computations, the ML model learns data flow patterns and detects anomalies through probabilistic reasoning, reducing computational overhead while improving detection of unknown attacks
Solution Approach 2:
The system changes the detection parameters from fixed rule-based thresholds to dynamic patterns learned by the machine learning model. The model adapts to normal data flow variations and identifies deviations that indicate attacks, allowing flexible detection that maintains system performance while detecting both known and unknown attack types
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A system includes a processor to execute a data flow instrumented application to generate data trace data representing data flows of the data flow instrumented application; processor trace circuitry to generate processor trace (PT) data from the data trace data; and a data flow detecting pipeline to monitor the data flows represented by the PT data in real time and generate an alert if one or more of the data flows deviates from a data flow model for the data flow instrumented application.