摘要:控制流完整性保护技术（control flow integrity，简称CFI）是防御面向返回编程攻击（return-oriented programming，简称ROP）的一种有效途径.针对现有CFI中存在的四大问题：性能开销大、依赖程序代码信息、容易遭受历史刷新攻击以及规避攻击，提出了基于硬件分支信息的ROP攻击检测方法——MIBChecker （mispredicted indirect branch checker）.该方法实时地利用硬件性能管理单元（performance monitor unit，简称PMU）的事件触发机制，针对每个预测失败的间接分支进行ROP攻击检测，规避了历史刷新攻击的可能，同时提出基于敏感系统调用参数的新型检测方法来检测短攻击链（称为gadgets-chain） ROP攻击.实验结果表明，MIBChecker能够不受历史刷新攻击的影响进行ROP短指令片段（称为gadget）检测，可有效地检测出常规ROP攻击和规避攻击，并仅引入5.7%的性能开销.



Abstract:Control flow integrity (CFI) is an effective method to defend against return-oriented programming (ROP) attack. To address the four drawbacks of current CFI approaches, i.e., high performance overhead, relying on software code information, subject to history flushing attack, and evasion attack, this study proposed an ROP attack detection approach based on hardware branch information—mispredicted indirect branch checker, called MIBChecker. It performs real time ROP detection on every mispredicted indirect branch via events triggered by performance monitor unit, and produces a new critical syscall data detection approach to defend against ROP attacks using short gadgets-chain. Experiments show that MIBChecker can detect gadgets which is not affected by history flushing attack, and can effectively detect common ROP attack and evasion attack with only 5.7% performance overhead.



PDF全文下载地址:

http://jos.org.cn/jos/article/pdf/5829