WADE learns WebAssembly execution patterns to flag abnormal function-call paths

WebAssembly applications execute within a portable sandbox whose protections differ from native executables. WADE instruments application behavior and constructs a distinct learned baseline for each workload. If an exploit alters the sequence of calls made by an application, runtime monitoring can flag the deviation even if no signature for that particular vulnerability exists. That is an AI-based security detector operating on execution evidence rather than a language model making an exploitability claim.

WADE collects benign WebAssembly function-level execution sequences and uses an LSTM anomaly detector to flag deviations. The authors report evaluation across 67 Wasm applications and ten vulnerability classes, with zero observed false negatives and a 0.42 percent false positive rate on that dataset. Zero misses is bounded to the evaluated attacks and applications; it cannot prove zero misses for unseen deployments. Data-only abuses that preserve normal-looking function traces may evade the detector, and instrumentation overhead and baseline drift need independent workload tests.

Compare traced normal and exploited workloads under prospective holdouts, monitor performance overhead and test whether semantically harmful actions without anomalous calls are invisible. Learned call-sequence detection can complement execution containment but should not substitute for memory safety and authorization checks. Primary evidence.

Additional evidence and trust boundary

Behavior-based monitoring can detect exploit-induced changes in a WebAssembly call sequence even when no vulnerability signature has been written. It can also miss an exploit that changes only data values while preserving those sequences. Deployment requires measuring instrument overhead and the false-positive impact of normal software updates, which the reported benchmark alone cannot establish. Supporting record.