WADE flags anomalous WebAssembly behavior with per-app LSTM models
Original title: WADE: An LSTM-Based Anomaly Detection Engine for WebAssembly Applications
On 67 Wasm apps and ten vulnerability classes, the authors report zero false negatives and a 0.42% false positive rate.
WADE (WebAssembly Anomaly Detection Engine) learns normal function-level execution of browser WebAssembly applications with an LSTM trained on benign traces, then flags runtime deviations. The authors note Wasm's limited runtime protections, including the lack of stack canaries and ASLR. Models are application-specific rather than signature-based, so detection is not tied to a per-vulnerability signature. Evaluation used 67 WebAssembly applications spanning ten vulnerability classes.
Unconfirmed: False-negative and false-positive rates are the authors' evaluation results only.
- Monitoring uses function-level execution traces collected under benign conditions.
- Detection does not rely on per-vulnerability signatures.
- The evaluation set is 67 applications and ten vulnerability classes.
- Reported false positives are 0.42%, with zero false negatives.
From the original article
1 min read at arxiv.orgWebAssembly (Wasm) enables near-native performance for web applications through a portable and sandboxed execution model. However, its limited runtime protection mechanisms (e. g.
By Ilaria Campestrini · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.