HDROP:Detecting ROP Attacks Using Performance Monitoring Counters
Combining short instruction sequences originated only from existing code pieces, Return Oriented Programming (ROP) attacks can bypass the code-integrity effort model To defeat this kind of attacks, cur rent approaches check every instruction executed on a processor, which results in heavy performance overheads.In this paper, we propose an innovative approach, called HDROP, to detecting the attacks.It utilizes the observation that ROP attacks often make branch predictor in modern processors fail to determine the accurate branch destination.With the support of PMC (Performance Monitoring Counters) that is capable of counting performance events, we catch the abnormal increase in branch mis-prediction and detect the existence of ROP attacks.In HDROP, each basic unit being checked consists of hundreds of instructions rather than a single one, which effectively avoids significant performance overheads.The prototype system we developed on commodity hardware shows that HDROP succeeds in detecting ROP attacks, and the performance tests demonstrate that our approach has acceptably lower overheads.
ROP misprediction branch performance monitoring counters
HongWei Zhou Xin Wu WenChang Shi JinHui Yuan Bin Liang
Key Laboratory of Data Engineering and Knowledge Engineering,Ministry of Education,Beijing,China ; S Key Laboratory of Data Engineering and Knowledge Engineering,Ministry of Education,Beijing,China ; S Information Engineering University,Zhengzhou,China
国际会议
福州
英文
172-186
2014-05-05（万方平台首次上网日期，不代表论文的发表时间）