  In the software design, protecting a computer system from a plethora of
software attacks or malware in the wild has been increasingly important. One
branch of research to detect the existence of attacks or malware, there has
been much work focused on modeling the runtime behavior of a program. Stemming
from the seminal work of Forrest et al., one of the main tools to model program
behavior is system call sequences. Unfortunately, however, since mimicry
attacks were proposed, program behavior models based solely on system call
sequences could no longer ensure the security of systems and require additional
information that comes with its own drawbacks. In this paper, we report our
preliminary findings in our research to build a mimicry resilient program
behavior model that has lesser drawbacks. We employ branch sequences to harden
our program behavior model against mimicry attacks while employing hardware
features for efficient extraction of such branch information during program
runtime. In order to handle the large scale of branch sequences, we also employ
LSTM, the de facto standard in deep learning based sequence modeling and report
our preliminary experiments on its interaction with program branch sequences.
