WADE：基于 LSTM 的 WebAssembly 应用异常检测引擎
WADE: An LSTM-Based Anomaly Detection Engine for WebAssembly Applications
Ilaria Campestrini · Stefano Zanero · Engin Kirda
中文摘要
WebAssembly（Wasm）通过可移植、沙箱化的执行模型，使网页应用获得接近原生的性能。然而，其运行时保护机制有限，例如缺少栈保护值（stack canaries）和地址空间布局随机化（ASLR），使 Wasm 应用易受传统攻击。WADE（WebAssembly Anomaly Detection Engine）用于检测浏览器中运行的 Wasm 应用异常行为。系统监控良性条件下采集的函数级执行轨迹，并训练长短期记忆网络（LSTM），学习各应用的正常执行模式；运行时将偏离已学模式的轨迹标记为潜在攻击。WADE 构建应用特定的行为模型，无需为每种漏洞维护特征签名，因而既能检测已知攻击，也能检测此前未见攻击。在涵盖十类漏洞的 67 个 WebAssembly 应用数据集上，WADE 实现了零漏报和 0.42% 的误报率。
关键要点
- 01Wasm 运行时缺少栈保护值和 ASLR，传统安全防护不足
- 02监控函数级执行轨迹，以 LSTM 学习应用正常行为模式
- 03将偏离已学模式标记为潜在攻击，无需逐漏洞签名
- 04可检测已知及此前未见攻击，并构建应用特定行为模型
- 05在 67 个应用、十类漏洞上实现零漏报和 0.42% 误报率
解读
尚无解读。
原始英文摘要
arXiv:2610.31984v1 Announce Type: cross Abstract: WebAssembly (Wasm) enables near-native performance for web applications through a portable and sandboxed execution model. However, its limited runtime protection mechanisms (e.g., the lack of stack canaries and address space layout randomization (ASLR)) leave Wasm applications vulnerable to traditional attacks. We present WADE (WebAssembly Anomaly Detection Engine), a system that detects anomalous runtime behaviors in browser-executed WebAssembly applications. WADE monitors function-level execution traces collected under benign conditions and trains a Long Short-Term Memory (LSTM) network to learn the normal execution behavior of each application. At runtime, the model flags deviations from these learned patterns as potential attacks. Unlike signature-based approaches, WADE builds application-specific behavioral models, enabling detection of both known and previously unseen attacks without per-vulnerability signatures. We evaluate WADE on a dataset of 67 WebAssembly applications spanning ten vulnerability classes, achieving zero false negatives and a 0.42% false positive rate.