Lstm detects unusual behavior in webassembly to spot attacks
WADE: An LSTM-Based Anomaly Detection Engine for WebAssembly Applications
Cryptography and SecurityMachine Learning
Summary
WebAssembly runs web apps fast but lacks some protections against hacking methods. The authors created WADE, a system that watches how WebAssembly apps normally behave and learns these patterns using a type of AI called LSTM. When the app acts differently from learned normal behavior, WADE raises an alert. This method can catch new attacks without needing to know their details in advance. Tests showed WADE can detect all attacks with very few false alarms.
What this means in practice
- •For web developers: Identify and block attacks on WebAssembly apps by checking for unusual behaviors during execution in browsers.
- •For security operation teams: Monitor deployed web apps using WebAssembly to detect zero-day exploits without relying on known vulnerability signatures.
Authors
Ilaria Campestrini, Stefano Zanero, Engin Kirda
Abstract
WebAssembly (Wasm) enables near-native performance for web applications through a portable and sandboxed execution model. However, its limited runtime protection mechanisms (e.g., the lack of stack canaries and address space layout randomization (ASLR)) leave Wasm applications vulnerable to traditional attacks. We present WADE (WebAssembly Anomaly Detection Engine), a system that detects anomalous runtime behaviors in browser-executed WebAssembly applications. WADE monitors function-level execution traces collected under benign conditions and trains a Long Short-Term Memory (LSTM) network to learn the normal execution behavior of each application. At runtime, the model flags deviations from these learned patterns as potential attacks. Unlike signature-based approaches, WADE builds application-specific behavioral models, enabling detection of both known and previously unseen attacks without per-vulnerability signatures. We evaluate WADE on a dataset of 67 WebAssembly applications spanning ten vulnerability classes, achieving zero false negatives and a 0.42% false positive rate.