Method, apparatus and system for detecting return-oriented programming attacks

Abstract

Methods, devices, and systems for detecting return-oriented programming (ROP) exploits are disclosed. A method includes executing an unintended sequence of code snippets in a processing circuit, each code snippet including at least one executable instruction including a control transfer instruction. One or more of the code snippets may include a modified control transfer instruction different from an originally intended control transfer instruction and at least one code snippet of the plurality may be a non-cached code snippet not found in a cache memory. The method also includes developing an instruction loading profile by monitoring instruction fetches relative to cache misses, where the cache misses are fetched instructions absent from the cache memory on the instruction fetch.

Description

technical field [0001] One feature relates generally to detecting malicious code in software systems, and more particularly to methods and apparatus for detecting return-oriented programming attacks in software systems. Background technique [0002] Computing systems that execute software are experiencing an increasing number of attacks from attackers, commonly referred to as hackers. These attackers have discovered ways to insert malicious code into a computing system and then cause the computing system to execute the malicious code. Malicious code can perform many different actions, such as causing a computing system to run slower than normal, monitoring activity on a computing system, causing a computing system to transmit or receive information that a user may not intend to transmit, destroying data in persistent and non-persistent memory, and crash the computing system. [0003] An attack mechanism, sometimes referred to as a return-oriented programming (ROP) attack, ...

AI Technical Summary

Problems solved by technology

This type of attack is successful because code and data addresses are predictable in most systems

Images