BeCFI:Detecting Hidden Control Flow with Performance Monitoring Counters

摘要：

　　Most of existing control ow integrity eorts target keeping intended control ow in good integrity.However,they fail to expose hidden control ow that may be introduced by the execution of rootkits,ROP gadgets,etc.To overcome the challenge,we propose an innovative approach BeCFI to detect hidden control ow based on crossview principle.Since modern processors are capable of observing the execution of all branch instructions,BeCFI obtains the hardware view with the support of performance monitoring counters(PMC).To obtain software view,we build a software-based counters by compiler-patching and binary-overwriting,and monitors the execution of branch instruction with software-based counters.If a control transfer only appears in hardware view,BeCFI considers that it is hidden control transfer.We have developed a prototype system on Intel x86 Linux kernel.Our evaluations show BeCFI is capable of detecting the hidden control ow introduced by kernel rootkits and ROP attacks.Furthermore our performance tests demonstrates that BeCFI incurs an acceptable overhead.

关键词： control flow integrity operating system kernel branch performance monitoring counters

会议类型: 国内会议

会议名称: 第八届中国可信计算与信息安全学术会议

会议地点: 湖北恩施

会议语种:英文

页码: 1-16

在线出版日期: 2014-09-13（万方平台首次上网日期，不代表论文的发表时间）