Towards Model-based Run-time Cybersecurity: On Control-Flow Anomaly Detection, Attack Identification, and Hardware Monitoring

2026-08-12

AI Summary

This work addresses the vulnerability of conventional control-flow-based runtime monitoring to evasion through adversarial obfuscation, which often leads to detection failure or misclassification. To overcome this limitation, the paper proposes a model-driven, hardware-software co-designed security architecture. At the software layer, suspicious behaviors are initially identified through control-flow anomaly detection combined with attack-tree reasoning; concurrently, the hardware layer independently performs fine-grained control-flow validation. This synergistic approach effectively thwarts adversarial camouflage. In a case study involving authentication services, the framework accurately reclassifies a code injection attack—previously misjudged as a low-risk configuration issue—as a high-confidence control-flow hijacking event, thereby substantially enhancing both detection robustness and diagnostic precision.

Abstract

Methods to increase the resilience of systems to cyber-attacks become increasingly important. Control-flow monitoring provides a principled basis to ensure integrity and detect possible anomalies at run-time. Once anomalies have been detected, so-called attack trees can be used to identify possible types of attacks. However, this approach is vulnerable to camouflage, by which attackers try to evade detection (and correct identification) by deliberately manipulating also the system's observed control flow. In this paper, we outline a model-based approach that provides more robust intrusion detection and attack identification through an architecture that combines software- with hardware-based monitoring. In this approach, software-level observation indicates suspicious activities, while hardware-level monitoring checks them separately in more detail, making it much harder for attacks to camouflage themselves and go undetected. We illustrate the approach with an authentication-service example that captures a realistic failure mode: a software-level observer sees an anomalous but apparently harmless control-flow deviation, maps it to a benign root cause in an attack tree, but misses the true intrusion. A second, independent hardware control-flow monitor observes the actual transition sequence and thereby changes the attack-tree diagnosis from a low-severity configuration or maintenance issue to a high-confidence code-injection or control-flow hijack. In this scenario, the proposed combination of control-flow anomaly detection, attack-tree based intrusion identification, and hardware-based monitoring can improve not only anomaly detection, but also the diagnostic precision of attack-tree-based cyber-attack identification.

Problem

• control-flow anomaly
• attack identification
• camouflage
• intrusion detection
• hardware monitoring

Innovation

• model-based cybersecurity
• control-flow monitoring
• attack tree
• hardware-software co-monitoring
• intrusion detection