Authors:
Calebe Helpa
1
;
Tiago Heinrich
2
;
Marcus Botacin
3
;
Newton Will
4
;
Rafael Obelheiro
5
and
Carlos Maziero
1
Affiliations:
1
Computer Science Department, Federal University of Paraná, Curitiba, 81530–015, Brazil
;
2
Max Planck Institute for Informatics (MPI), Saarbrücken, 66123, Germany
;
3
Texas A&M University, College Station, TX, 77843, U.S.A.
;
4
Computer Science Department, Federal University of Technology, Paraná, Dois Vizinhos, 85660–000, Brazil
;
5
Computer Science Department, State University of Santa Catarina, Joinville, 89219–710, Brazil
Keyword(s):
WebAssembly, Intrusion Detection, Security.
Abstract:
Debugging formats are well-known means to store information from an application, that help developers to find errors, bugs, or unexpected behavior during the development period. The Debugging With Attributed Record Format (DWARF) is an example of a generic format that can be used for a range of programming languages and formats, such as WebAssembly, a low-level binary format that provides a compilation target for high-level languages. Given the use of debugging formats, their potential for intrusion detection is still unknown. Our study consists of evaluating the use of data extracted with the DWARF format, and their respective potential for an intrusion detection solution. In this context, we present a strategy for identifying Potentially Unwanted Application (PUA) in WebAssembly binaries, through feature extraction and static analysis using the DWARF format as a data source from WebAssembly binary. Our results are promising, with an overall f1score performance above 96% for the alg
orithms.
(More)