MemHookNet: Real-Time Multi-Class Heap Anomaly Detection with Log Hooking
Source abstract
Abstract
Heap memory anomalies, such as Use-After-Free (UAF), Double-Free, and Memory Leaks, pose critical security threats including system crashes, data leakage, and remote exploits. Existing methods often fail to handle multiple anomaly types and meet real-time detection demands. To address these challenges, this paper proposes MemHookNet, a real-time multi-class heap anomaly detection framework that combines log hooking with deep learning. Without modifying source code, MemHookNet non-intrusively captures memory operation logs at runtime and transforms them into structured sequences encoding operation types, pointer identifiers, thread context, memory sizes, and temporal intervals. A sliding-window Long Short-Term Memory (LSTM) module efficiently filters out suspicious segments, which are then transformed into pointer access graphs for classification using a GATv2-based model. Experimental results demonstrate that MemHookNet achieves 82.2% accuracy and 81.5% recall with an average inference time of 15 ms, outperforming DeepLog and GLAD-PAW by 11.7% in accuracy and reducing latency by over 80%.
Source: openalex_inverted_index · Quality: baseline
Research context
OpenAlex topics: Anomaly Detection Techniques and Applications · Power System Reliability and Maintenance · Electricity Theft Detection Techniques
SciVX discovery tags are terminology-based. OpenAlex topics are source-provided classifications.
References (40)
Show source-provided references
1. Mitre. Stubborn Weaknesses in the CWE Top 25 [Internet]. 2024 [cited 2024 Jan 1]. Available from: https://cwe.mitre.org/top25/archive/2023/2023_stubborn_weaknesses.html.
2. Spatio-temporal context reduction: a pointer-analysis-based static approach for detecting use-after-free vulnerabilities
3. A memory-related vulnerability detection approach based on vulnerability model with petri net10.1016/j.jlamp.2023.100859 ↗
4. AddressWatcher: sanitizerbased localization of memory leak fixes10.1109/TSE.2024.3438119 ↗
5. Demystifying the dependency challenge in kernel fuzzing
6. Wögerer · A survey of static program analysis techniques. Tech Rep · 2005
7. UAFSan: an object-identifier-based dynamic approach for detecting use-after-free vulnerabilities
8. Toward hybrid static-dynamic detection of vulnerabilities in IoT firmware10.1109/MNET.011.2000450 ↗
9. Deeplog: anomaly detection and diagnosis from system logs through deep learning
10. Loganomaly: unsupervised detection of sequential and quantitative anomalies in unstructured logs
11. Graph neural networks based log anomaly detection and explanation
12. Deep learning for time series anomaly detection: a survey10.1145/3691338 ↗
13. Preventing use-after-free with dangling pointers nullification
14. UAF-GUARD: defending the use-after-free exploits via fine-grained memory permission management10.1016/j.cose.2022.103048 ↗
15. A unified model for multi-class anomaly detection
16. Huang · International forum on digital TV and wireless multimedia communications · 2024 · 228
17. Deep learning for anomaly detection in log data: a survey
18. Statically discover cross-entry use-after-free vulnerabilities in the linux kernel
19. Cppcheck Team. Cppcheck software official website [Internet]. 2018 [cited 2024 Jan 1]. Available from: http://cppcheck.sourceforge.net/.
20. Wheeler DA. Flawfinder software official website [Internet]. 2018 [cited 2024 Jan 1]. Available from: https://www.dwheeler.com/flawfinder/.
21. Valgrind Team. Valgrind: a memory debugging, memory leak detection, and profiling tool; 2018 [Internet]. [cited 2024 Jan 1]. Available from: http://valgrind.org/.
22. Google. AddressSanitizer [Internet]. 2024 [cited 2024 Jan 1]. Available from: https://github.com/google/sanitizers/wiki/AddressSanitizer.
23. Dangsan: scalable use-after-free detection
24. DangZero: efficient use-after-free detection via direct page table access
25. BUDAlloc: defeating use-after-free bugs by decoupling virtual address management from kernel
26. Shoshitaishvili Y, Brunton G, Rawat N. Angr: a platform for analyzing binary programs [Internet]. 2018 [cited 2024 Jan 1]. Available from: https://github.com/angr/angr.
27. Google Inc. Driller: a hybrid fuzzing tool combining static and dynamic analysis [Internet]. 2018 [cited 2024 Jan 1]. Available from: https://github.com/googleprojectzero/driller.
28. Deep learning for anomaly detection in time-series data: review, analysis, and guidelines10.1109/ACCESS.2021.3107975 ↗
29. Glad-paw: graph-based log anomaly detection by position aware weighted graph attention network
30. Deeptralog: trace-log combined microservice anomaly detection through graph-based deep learning
31. Kern P. Injecting shared libraries with LD_PRELOAD for cyber deception [master’s thesis]. Vienna, Austria: Technische Universität Wien; 2023.
32. A LSTM-based anomaly detection model for log analysis10.1007/s11265-021-01644-4 ↗
33. Understanding memory access patterns for prefetching
34. Multi-class sentiment classification on Bengali social media comments using machine learning
35. Emotion detection using a bidirectional long-short term memory (bilstm) neural network
36. Advanced hybrid LSTM-transformer architecture for real-time multi-task prediction in engineering systems10.1038/s41598-024-55483-x ↗
37. Arabic language opinion mining based on long short-term memory (LSTM)10.3390/app12094140 ↗
38. Brody S, Alon U, Yahav E. How attentive are graph attention networks? arXiv:2105.14491. 2021.
39. An explainable geometric-weighted graph attention network for identifying functional networks associated with gait impairment
40. Multivariate time-series anomaly detection via graph attention network