Back to results
US 2025/0094576 A1Published application
Automatic detection of deserialization attacks with markov chains
AssigneeOracle International Corporation
InventorsFrancois Gauthier, Sora Bae
Life of this patent
Estimating the term…
Abstract
A method for detecting a deserialization attack may include identifying, in a byte stream, a class name corresponding to a class, generating, for the class, a feature vector, generating, by applying a benign deserialization model to the feature vector, a benign probability window, generating, by applying a malicious deserialization model to the feature vector, a malicious probability window, comparing the benign probability window and the malicious probability window to obtain a comparison result, and determining, based on the comparison result, that the class is malicious.
Claims20
A method for detecting a deserialization attack, comprising:
- identifying, in a byte stream, a first class name corresponding to a first class;
- generating, for the first class, a first feature vector;
- generating, by applying a benign deserialization model to the first feature vector, a first benign confidence interval of a probability that the first class is benign, wherein the benign deserialization model comprises a Markov chain comprising a set of states and a set of probabilities of transitioning between two states in the set of states at a corresponding timestep;
- generating, by applying a malicious deserialization model to the first feature vector, a first malicious confidence interval of a probability that the first class is malicious;
- comparing the first benign confidence interval and the first malicious confidence interval to obtain a first comparison result, wherein comparing the first benign confidence interval and the first malicious confidence interval comprises determining whether the first benign confidence interval and the first malicious confidence interval overlap;
- and
- determining, based on the first comparison result, that the first class is malicious.
4 more elements
A system for detecting a deserialization attack, comprising:
- a repository configured to store:
- a first class corresponding to a first feature vector, and
- a byte stream comprising a first class name corresponding to the first class;
- a computer processor and a memory;
- a feature generator executing on the computer processor and using the memory, wherein the feature generator is configured to generate, for the first class, the first feature vector;
- and
- a deserialization manager executing on the computer processor and using the memory, wherein the deserialization manager is configured to:
- identify, in the byte stream, the first class name,
- generate, by applying a malicious deserialization model to the first feature vector, a first malicious confidence interval of a probability that the first class is malicious,
- generate, by applying a benign deserialization model to the first feature vector, a first benign confidence interval of a probability that the first class is benign, wherein the benign deserialization model comprises a Markov chain comprising a set of states and a set of probabilities of transitioning between two states in the set of states at a corresponding timestep,
- compare the first benign confidence interval and the first malicious confidence interval to obtain a first comparison result, wherein comparing the first benign confidence interval and the first malicious confidence interval comprises determining whether the first benign confidence interval and the first malicious confidence interval overlap, and
- determine, based on the first comparison result, that the first class is malicious.
9 more elements
A method for detecting a deserialization attack, comprising:
- sending a byte stream to a deserialization manager configured to perform:
- identifying, in the byte stream, a first class name corresponding to a first class,
- generating, for the first class, a first feature vector,
- generating, by applying a benign deserialization model to the first feature vector, a first benign confidence interval of a probability that the first class is benign, wherein the benign deserialization model comprises a Markov chain comprising a set of states and a set of probabilities of transitioning between two states in the set of states at a corresponding timestep,
- generating, by applying a malicious deserialization model to the first feature vector, a first malicious confidence interval of a probability that the first class is malicious,
- comparing the first benign confidence interval and the first malicious confidence interval to obtain a first comparison result, wherein comparing the first benign confidence interval and the first malicious confidence interval comprises determining whether the first benign confidence interval and the first malicious confidence interval overlap,
- making a first determination, based on the first comparison result, that the first class is malicious, and
- transmitting the first determination that the first class is malicious;
- and
- receiving, from the deserialization manager, the first determination that the first class is malicious.
7 more elements
Dependencies are inferred from the claim text.