Abstract:Return-Oriented Programming (ROP) is one of the most common techniques to exploit software vulnerabilities. However, existing defense techniques can be defeated by attackers, or suffer from high performance overhead. In this paper, we propose a defense framework, named ROPSentry, to detect ROP attacks at runtime. It is built on the observation that ROP exploits usually trigger different hardware events than normal programs generated by compilers. Hence, we leverage hardware performance counters to track such hardware events and analyze behavioral patterns of ROP attacks. ROPSentry has two approaches. The ROP-only defense approach detects ROP attacks via capturing the patterns of ROP exploits, where we propose to sample the hardware performance counters at mispredicted return events instead of at every microinstruction for a low performance overhead. To further reduce performance overhead, we propose a self-adaptive defense approach to dynamically switch between low and high sampling rates. It detects the patterns of spraying attacks (i.e., one common ROP payload delivery technique) at a low sampling rate, and then switches to a high sampling rate for detecting the patterns of ROP exploits. Our evaluation on 11 real-world ROP exploits, 50 synthetically generated ROP exploits and 1000 benign websites has shown that, the ROP-only and self-adaptive approaches are effective in detecting ROP attacks with low performance overhead (11% and 1% respectively) as well as low false positive; and they significantly outperform the state-of-the-art techniques in terms of performance overhead without losing the detection accuracy.

Dynamic Runtime Detection System for Return-oriented Programming Attack

ROPNN: Detection of ROP Payloads Using Deep Neural Networks

A Dynamic Detection Method Against ROP and JOP

Efficient Detection Of The Return-Oriented Programming Malicious Code

DROP: Detecting Return-Oriented Programming Malicious Code

ROP Defense Using Trie Graph for System Security.

ROPSentry: Runtime Defense Against ROP Attacks Using Hardware Performance Counters.

Program Attack and Protection Based on Return-Oriented Programming

ROPocop - Dynamic Mitigation of Code-Reuse Attacks

Return-Oriented Rootkit Without Returns (on the X86)

The never ending war in the stack and the reincarnation of ROP attacks

DeepReturn: A Deep Neural Network Can Learn How to Detect Previously-Unseen ROP Payloads Without Using Any Heuristics

Automatic Construction of Jump-Oriented Programming Shellcode (on the X86)

A Dynamic Detective Method Against ROP Attack on ARM Platform

Packed, printable, and polymorphic return-oriented programming

deRop: removing return-oriented programming from malware

Securing c programs by dynamic type checking

Runtime Code Reuse Attacks: A Dynamic Framework Bypassing Fine-Grained Address Space Layout Randomization.

Defending ROP Attacks Using Basic Block Level Randomization

Loop-Oriented Programming: A New Code Reuse Attack to Bypass Modern Defenses

A-R Exploit: an Automatic Rop Exploit Based on Long Sequence