Research on Jet Injection Detection Technology Based on Time Series Prediction Algorithm

This study aims to address the challenge of detecting heap spray attacks in firmware systems by utilizing the TransformerAR time series prediction algorithm to predict the normal memory allocation range, thereby identifying such attacks. We employ eBPF (Extended Berkeley Packet Filter) kernel dynamic programming technology to intercept system calls and non-invasively capture the heap memory size requested by applications, storing critical information at the kernel level. By reading this information in the user space, the TransformerAR algorithm learns the normal memory allocation patterns of processes over a long period and predicts the confidence interval of memory allocation over a short future period. This serves as the basis for determining whether a process is under a heap spray attack, thereby improving the detection success rate of such attacks. Comparative experiments with various time series algorithms demonstrate that the TransformerAR model achieves optimal detection performance, with an accuracy rate of 93.8%. Additionally, by leveraging eBPF technology to directly access system resources and states and intercept heap spray attacks, this approach ensures high detection accuracy while minimizing system resource overhead.