UISCOPE: Accurate, Instrumentation-free, and Visible Attack Investigation for GUI Applications Runqing Yang y, Shiqing Ma z, Haitao Xu x, Xiangyu Zhang {, Yan Chen $ y Zhejiang University, z Rutgers University, x Arizona State University, { Purdue University, $ Northwestern University
[email protected],
[email protected],
[email protected], {
[email protected],
[email protected] Abstract—Existing attack investigation solutions for GUI ap- independent tasks. In this paper, we hence focus on GUI plications suffer from a few limitations such as inaccuracy applications. (because of the dependence explosion problem), requiring in- strumentation, and providing very low visibility. Such limitations System event (e.g., system calls) auditing is a built-in have hindered their widespread and practical deployment. In this feature in mainstream operating systems and can be used for paper, we present UISCOPE, a novel accurate, instrumentation- such investigation. Existing work [41], [28], [25], [30], [45], free, and visible attack investigation system for GUI applications. [52], [42], [37] has demonstrated their great potential, but they The core idea of UISCOPE is to perform causality analysis on suffer from a few major limitations. both UI elements/events which represent users’ perspective and low-level system events which provide detailed information of 1) Inaccurate analysis results. In many causality anal- what happens under the hood, and then correlate system events ysis, when a long-running process interacts with many input with UI events to provide high accuracy and visibility. Long and output objects, each output object will be conservatively running processes are partitioned to individual UI transitions, to considered causally dependent on all the preceding input which low-level system events are attributed, making the results objects.