Detecting Code Injection Attacks in Internet Explorer

Code injection vulnerabilities are a major threat to Internet security. The ability for a malicious website to install malware on a host using these vulnerabilities without its knowledge is particularly menacing. In this paper, we approach this problem from a new perspective by constructing a Markov chain graph from the system calls Internet Explorer executes and then modeling this graph over time. We apply a Gaussian process change-point algorithm to detect code injection attacks. To show the efficacy of this approach, we collect a novel dataset of system call traces of 6 code injection attacks using 3 distinct exploits against the Internet Explorer browser. Our algorithm was able to detect all of the code injection attacks with a limited number of false positives.