Machine learning (ML)-based methods have recently become attractive for detecting security vulnerability exploits. Unfortunately, state-of-the-art ML models like long short-term memories (LSTMs) and transformers incur significant computation overheads. This overhead makes it infeasible to deploy them in real-time environments. We propose a novel ML-based exploit detection model, ML-FEED, that enables highly efficient inference without sacrificing performance. We develop a novel automated technique to extract vulnerability patterns from the Common Weakness Enumeration (CWE) and Common Vulnerabilities and Exposures (CVE) databases. This feature enables ML-FEED to be aware of the latest cyber weaknesses. Second, it is not based on the traditional approach of classifying sequences of application programming interface (API) calls into exploit categories. Such traditional methods that process entire sequences incur huge computational overheads. Instead, ML-FEED operates at a finer granularity and predicts the exploits triggered by every API call of the program trace. Then, it uses a state table to update the states of these potential exploits and track the progress of potential exploit chains. ML-FEED also employs a feature engineering approach that uses natural language processing-based word embeddings, frequency vectors, and one-hot encoding to detect semantically-similar instruction calls. Then, it updates the states of the predicted exploit categories and triggers an alarm when a vulnerability fingerprint executes. Our experiments show that ML-FEED is 72.9x and 75,828.9x faster than state-of-the-art lightweight LSTM and transformer models, respectively. We trained and tested ML-FEED on 79 real-world exploit categories. It predicts categories of exploit in real-time with 98.2% precision, 97.4% recall, and 97.8% F1 score. These results also outperform the LSTM and transformer baselines.

翻译：基于机器学习（ML）的方法近年来在检测安全漏洞利用方面备受关注。遗憾的是，长短期记忆网络（LSTM）和Transformer等最先进的ML模型会引入显著的计算开销，使得它们在实时环境中难以部署。我们提出了一种新型基于ML的漏洞利用检测模型ML-FEED，该模型在保持高性能的同时实现了高效推理。我们开发了一种新颖的自动化技术，能从通用弱点枚举（CWE）和通用漏洞与暴露（CVE）数据库中提取漏洞模式。这一特性使ML-FEED能够感知最新的网络弱点。其次，该模型并非基于传统的应用程序编程接口（API）调用序列分类方法（这类处理完整序列的传统方法计算开销巨大），而是以更细粒度运行，预测程序轨迹中每个API调用触发的漏洞利用行为。随后，它利用状态表更新这些潜在漏洞利用的状态，并追踪潜在攻击链的进展。ML-FEED还采用基于自然语言处理的词嵌入、频率向量和独热编码的特征工程方法，以检测语义相似的指令调用。在此基础上，模型更新预测的漏洞利用类别状态，并在漏洞指纹执行时触发警报。实验表明，ML-FEED的推理速度分别为最先进的轻量级LSTM和Transformer模型的72.9倍和75,828.9倍。我们在79个真实世界漏洞利用类别上对ML-FEED进行了训练与测试。该模型能以98.2%精确率、97.4%召回率和97.8% F1分数实时预测漏洞利用类别，这些结果同样优于LSTM和Transformer基线模型。