Control-flow anomaly detection gains hardware layer to counter attacker camouflage

Cybersecurity researchers have long relied on watching how software behaves while it runs to catch intruders before they cause damage. But a new paper argues that this method, known as control-flow anomaly detection, has a blind spot that sophisticated attackers can exploit — and it proposes a fix that pairs software observation with a second, independent layer of hardware checks.

The paper, titled “Towards Model-based Run-time Cybersecurity: On Control-Flow Anomaly Detection, Attack Identification, and Hardware Monitoring,” was authored by Martin Sachenbacher and published on 12 August 2026. It lays out a model-based approach designed to make intrusion detection systems harder to fool, particularly in situations where an attacker deliberately disguises malicious activity as something harmless.

Key takeaways

• Control-flow monitoring detects integrity anomalies in a system while it is actually running, not after the fact.
• Attack trees are used to classify what type of cyber-attack might be behind a detected anomaly.
• Attackers can manipulate the observed control flow itself to camouflage an intrusion and dodge detection.
• The paper proposes combining software-level monitoring with hardware-level monitoring to close that gap.
• An authentication-service example shows how a hardware check can flip a misdiagnosed “benign” incident into a confirmed, high-confidence attack.

Enhancing Cybersecurity through Control-Flow Monitoring

Control-flow anomaly detection works by tracking the sequence of steps a piece of software actually executes and flagging deviations from what is expected. It gives defenders a way to catch problems as they happen rather than after damage is already done, which is why the paper frames it as a foundational tool for run-time system integrity.

… Continue reading the full article at the original source below.