| 本文已被：浏览 1795次 下载 4684次 |
码上扫一扫！ |
|
|
| 基于硬件分支信息的ROP攻击检测方法 |
|
李威威1,2, 马越1, 王俊杰1, 高伟毅1,2, 杨秋松1, 李明树1
|
|
1.中国科学院 软件研究所 基础软件国家工程研究中心, 北京 100190;2.中国科学院大学, 北京 100049
|
|
| 摘要: |
| 控制流完整性保护技术（control flow integrity，简称CFI）是防御面向返回编程攻击（return-oriented programming，简称ROP）的一种有效途径.针对现有CFI中存在的四大问题：性能开销大、依赖程序代码信息、容易遭受历史刷新攻击以及规避攻击，提出了基于硬件分支信息的ROP攻击检测方法——MIBChecker （mispredicted indirect branch checker）.该方法实时地利用硬件性能管理单元（performance monitor unit，简称PMU）的事件触发机制，针对每个预测失败的间接分支进行ROP攻击检测，规避了历史刷新攻击的可能，同时提出基于敏感系统调用参数的新型检测方法来检测短攻击链（称为gadgets-chain） ROP攻击.实验结果表明，MIBChecker能够不受历史刷新攻击的影响进行ROP短指令片段（称为gadget）检测，可有效地检测出常规ROP攻击和规避攻击，并仅引入5.7%的性能开销. |
| 关键词: 面向返回编程 控制流完整性 历史刷新攻击 规避攻击 |
| DOI：10.13328/j.cnki.jos.005829 |
| 分类号:TP309 |
| 基金项目:“核高基”国家科技重大专项（2014ZX01029101-002）；中国科学院战略性先导科技专项（XDA-Y01-01） |
|
| ROP Attack Detection Approach Based on Hardware Branch Information |
|
LI Wei-Wei1,2, MA Yue1, WANG Jun-Jie1, GAO Wei-Yi1,2, YANG Qiu-Song1, LI Ming-Shu1
|
|
1.National Engineering Research Center of Fundamental Software, Institute of Software, Chinese Academy of Sciences, Beijing 100190, China;2.University of Chinese Academy of Sciences, Beijing 100049, China
|
| Abstract: |
| Control flow integrity (CFI) is an effective method to defend against return-oriented programming (ROP) attack. To address the four drawbacks of current CFI approaches, i.e., high performance overhead, relying on software code information, subject to history flushing attack, and evasion attack, this study proposed an ROP attack detection approach based on hardware branch information—mispredicted indirect branch checker, called MIBChecker. It performs real time ROP detection on every mispredicted indirect branch via events triggered by performance monitor unit, and produces a new critical syscall data detection approach to defend against ROP attacks using short gadgets-chain. Experiments show that MIBChecker can detect gadgets which is not affected by history flushing attack, and can effectively detect common ROP attack and evasion attack with only 5.7% performance overhead. |
| Key words: return-oriented programming control flow integrity history flushing attack evasion attack |
