Abstract:Return-Oriented Programming (ROP) is one of the most common techniques to exploit software vulnerabilities. However, existing defense techniques can be defeated by attackers, or suffer from high performance overhead. In this paper, we propose a defense framework, named ROPSentry, to detect ROP attacks at runtime. It is built on the observation that ROP exploits usually trigger different hardware events than normal programs generated by compilers. Hence, we leverage hardware performance counters to track such hardware events and analyze behavioral patterns of ROP attacks. ROPSentry has two approaches. The ROP-only defense approach detects ROP attacks via capturing the patterns of ROP exploits, where we propose to sample the hardware performance counters at mispredicted return events instead of at every microinstruction for a low performance overhead. To further reduce performance overhead, we propose a self-adaptive defense approach to dynamically switch between low and high sampling rates. It detects the patterns of spraying attacks (i.e., one common ROP payload delivery technique) at a low sampling rate, and then switches to a high sampling rate for detecting the patterns of ROP exploits. Our evaluation on 11 real-world ROP exploits, 50 synthetically generated ROP exploits and 1000 benign websites has shown that, the ROP-only and self-adaptive approaches are effective in detecting ROP attacks with low performance overhead (11% and 1% respectively) as well as low false positive; and they significantly outperform the state-of-the-art techniques in terms of performance overhead without losing the detection accuracy.

A Dynamic Detection Method Against ROP and JOP

ROPNN: Detection of ROP Payloads Using Deep Neural Networks

Dynamic Runtime Detection System for Return-oriented Programming Attack

A Dynamic Detective Method Against ROP Attack on ARM Platform

ROP Defense Using Trie Graph for System Security.

DROP: Detecting Return-Oriented Programming Malicious Code

Efficient Detection Of The Return-Oriented Programming Malicious Code

ROPocop - Dynamic Mitigation of Code-Reuse Attacks

Program Attack and Protection Based on Return-Oriented Programming

ROPSentry: Runtime Defense Against ROP Attacks Using Hardware Performance Counters.

The never ending war in the stack and the reincarnation of ROP attacks

Automatic Construction of Jump-Oriented Programming Shellcode (on the X86)

deRop: removing return-oriented programming from malware

DeepReturn: A Deep Neural Network Can Learn How to Detect Previously-Unseen ROP Payloads Without Using Any Heuristics

Return-Oriented Rootkit Without Returns (on the X86)

Packed, printable, and polymorphic return-oriented programming

A-R Exploit: an Automatic Rop Exploit Based on Long Sequence

RIM: A Method to Defend from JIT Spraying Attack

Dynamical System Theory for the Detection of Anomalous Behavior in Computer Programs

Loop-Oriented Programming: A New Code Reuse Attack to Bypass Modern Defenses

Implicit-Flow-Sensitive Method for Detection of Trojan-Spy Programs