ROP Attack Detection Approach Based on Hardware Branch Information [基于硬件分支信息的ROP攻击检测方法]

作者：Li W.-W.^*; Ma Y.; Wang J.-J.; Gao W.-Y.; Yang Q.-S.; Li M.-S.

来源：Journal of Software, 2020, 31(11): 3588-3602.

DOI：10.13328/j.cnki.jos.005829

• Control flow integrity
• Evasion attack
• History flushing attack
• Return-oriented programming

Control flow integrity (CFI) is an effective method to defend against return-oriented programming (ROP) attack. To address the four drawbacks of current CFI approaches, i.e., high performance overhead, relying on software code information, subject to history flushing attack, and evasion attack, this study proposed an ROP attack detection approach based on hardware branch information-mispredicted indirect branch checker, called MIBChecker. It performs real time ROP detection on every mispredicted indirect branch via events triggered by performance monitor unit, and produces a new critical syscall data detection approach to defend against ROP attacks using short gadgets-chain. Experiments show that MIBChecker can detect gadgets which is not affected by history flushing attack, and can effectively detect common ROP attack and evasion attack with only 5.7% performance overhead.

• 单位
  中国科学院大学