Return-oriented programming protection

Abstract

A method for ROP attack protection for a plurality of ECUs, the method comprising: receiving data addressed to one of a plurality of ECUs; determining to which of the plurality of ECUs the received data is addressed; responsive to a unique model associated with the determined ECU, analyzing the received data to identify control flow instructions addressed to one or more predetermined addresses; responsive to the analyzing, generating a statistical analysis of the identified control flow instructions; and responsive to the generated statistical analysis, outputting a signal indicative of a likelihood of an attack.

Description

[0001] Cross-reference to related applications

[0002] This application claims priority to U.S. Provisional Patent Application S / N 62 / 814,009, filed March 5, 2019, entitled “RETURN-ORIENTED PROGRAMMING PROTECTION,” the entire contents of which are incorporated herein by reference. Technical Field

[0003] This invention relates generally to the field of security devices, and more specifically to systems and methods for protecting against return-oriented programming (ROP) attacks. Background Technology

[0004] ROP (Recursive Open Programming) is a computer security exploit that allows attackers to execute malicious code even in the presence of security defenses such as executable space protection and code signing. Through ROP, an attacker gains control of the control flow instruction stack and hijacks program control. The attacker can then execute carefully selected sequences of machine instructions already present in the device's memory. These sequences are called "instruction gadgets." Each instruction gadget typically ends with a return instruction and is located in a subroutine of an existing program and / or in shared library code. These instruction gadgets are chained together, allowing the attacker to perform arbitrary operations, even on devices with defenses that can prevent simpler attacks.

[0005] One example of a method to defend against ROP attacks is Address Space Layout Randomization (ASLR). In ASLR, components are randomly moved to different addresses in virtual memory each time the program runs. Many methods to protect against ROP attacks require tweaking the binary by modifying different opcodes within the binary. Unfortunately, in some cases, the binary cannot be modified due to security or warranty issues. Summary of the Invention

[0006] Therefore, the main objective of this invention is to overcome at least some of the disadvantages in the prior art. In some embodiments, this is provided by a method for protecting against back-to-the-board (ROP) attacks for multiple electronic control units (ECUs), the method comprising: receiving data destined for one of the multiple ECUs; determining which of the multiple ECUs the received data is destined for; responding to a unique model associated with the determined ECU; analyzing the received data to identify control flow instructions addressed to one or more predetermined addresses; generating a statistical analysis of the identified control flow instructions in response to the analysis; detecting the presence of a ROP attack in response to the generated statistical analysis; and outputting a signal indicating the presence of the detected ROP attack.

[0007] In one implementation, each of one or more predetermined addresses contains code for a corresponding instruction fragment. In another implementation, the generated statistical analysis includes the number of identified control flow instructions within a predetermined window of received data, and the presence of a ROP attack is detected in response to the number of identified control flow instructions within the predetermined window exceeding a predetermined window value.

[0008] In one implementation, the detection of a ROP attack further responds to a corresponding unique model. In another implementation, the generated statistical analysis includes the number of identified control flow instructions within the identified control flow instruction chain, and the presence of a ROP attack is detected in response to the number of identified control flow instructions within the chain exceeding a predetermined chain value.

[0009] In one implementation, the output signal controls the domain control unit (DCU) to prevent additional data from being transmitted to multiple ECUs.

[0010] In one independent embodiment, a back-to-the-board (ROP) attack protection system is provided, comprising: a processor; and a memory storing a plurality of unique models, each unique model associated with a corresponding electronic control unit (ECU) among a plurality of electronic control units (ECUs), wherein the processor is configured to: receive data destined for one of the ECUs; determine which of the ECUs the received data is destined for; analyze the received data in response to the corresponding unique model associated with the determined ECU to identify control flow instructions addressed to one or more predetermined addresses; generate statistical analysis of the identified control flow instructions in response to the analysis; detect the presence of a ROP attack in response to the generated statistical analysis; and output a signal indicating the presence of the detected ROP attack.

[0011] In one implementation, each of one or more predetermined addresses contains code for a corresponding instruction fragment. In another implementation, the generated statistical analysis includes the number of identified control flow instructions within a predetermined window of received data, and the presence of a ROP attack is detected in response to the number of identified control flow instructions within the predetermined window exceeding a predetermined window value.

[0012] In one implementation, the detection of the presence of a ROP attack further responds to a corresponding unique model. In another implementation, the generated statistical analysis includes the number of identified control flow instructions within the identified control flow instruction chain, and the presence of a ROP attack is detected in response to the number of identified control flow instructions within the identified control flow instruction chain exceeding a predetermined chain value.

[0013] In one implementation, the output signal controls the domain control unit (DCU) to prevent additional data from being transmitted to multiple ECUs.

[0014] Additional features and advantages of the invention will become apparent from the following figures and description. Attached Figure Description

[0015] To better understand the various embodiments of the present invention and to illustrate how the various embodiments can be implemented, reference will now be made to the accompanying drawings by way of example only, in which the same reference numerals always denote corresponding elements or sections.

[0016] Referring now specifically to the accompanying drawings, it is emphasized that the details shown are merely exemplary and for the purpose of illustrative discussion of preferred embodiments of the invention, and are presented to provide a description considered most useful and readily understood regarding the principles and concepts of the invention. In this respect, no attempt is made to show the structural details of the invention in more detail than necessary for a basic understanding of the invention; the description taken in conjunction with the drawings will make it apparent to those skilled in the art how various forms of the invention can be implemented in practice. In the drawings:

[0017] Figures 1A to 1D The illustrations show various advanced schematic diagrams of ROP attack protection devices according to certain embodiments.

[0018] Figure 1E A high-level flowchart illustrating the operation method of an inspection procedure according to certain embodiments is shown;

[0019] Figure 2 A high-level flowchart of a first implementation of a method for adding an ECU model to an AUTOSAR project is shown;

[0020] Figure 3A high-level flowchart of a second implementation of a method for adding an ECU model to an AUTOSAR project is shown;

[0021] Figure 4 A high-level flowchart illustrating the method for adding an ECU model to a Linux project is shown; and

[0022] Figure 5 A high-level flowchart of a ROP attack protection method according to certain implementations is shown. Detailed Implementation

[0023] Before detailing at least one embodiment of the present invention, it should be understood that the application of the invention is not limited to the details of the construction and arrangement of the components set forth in the following description or illustrated in the accompanying drawings. The invention can be applied to other embodiments practiced or performed in various ways. Furthermore, it should be understood that the wording and terminology used herein are for descriptive purposes and should not be considered limiting.

[0024] Figure 1A The illustration shows a high-level schematic diagram of an automotive communication network 10, including a ROP attack protection system 20. Figure 1B The diagram illustrates a high-level schematic of the ROP Attack Protection System 20, and... Figure 1C A high-level schematic diagram illustrating an implementation of the processor 30 of the ROP attack protection system 20 is shown. The automotive communication network 10 includes: the ROP attack protection system 20; a domain controller unit (DCU) 40; and multiple controller area network (CAN) bus networks 50. Each CAN bus network 50 includes: a CAN bus 60; and multiple ECUs 70 coupled to the CAN bus 60. In one embodiment, the ROP attack protection system 20 is implemented as part of the DCU 40. The ROP attack protection system 20 includes: a processor 30; and a memory 80. The processor 30 includes a check program 35. The check program 35 includes: a data receiving function 90; an ECU determination function 100; a control flow command identification function 110; an analysis function 120; an attack detection function 130; and an output function 140. Multiple ECU models 150 are stored in the memory 80. In a non-limiting embodiment, the processor 30 is configured to operate in response to computer-readable instructions stored in the memory 80. In one embodiment, the DCU 40 and ECUs 70 operate according to the Automotive Open Systems Architecture (AUTOSAR). In another embodiment, DCU 40 and ECU 70 operate on a Linux system. Each CAN bus network 50 communicates with a corresponding output of DCU 40, and the inputs of DCU 40 communicate with an Ethernet network. In one embodiment, memory 80 includes a portion of system memory.

[0025] As used herein, the term "control flow instruction" refers to an instruction that controls program flow to access a memory address. In a non-limiting implementation, a control flow instruction includes any of the following: a call; a branch; or a jump.

[0026] Figure 1D An example of an ECU model 150 for a specific ECU in ECU 70 is illustrated. Specifically, for each address indicator of a predetermined data size, the data associated with the address indicator is marked with a flag indicating the presence or absence of an instruction segment in the target address space. Preferably, the predetermined data size is 4 bytes, i.e., a double word (DWORD). Specifically, in one illustrated embodiment, a "1" is stored associated with the address indicator if the target address space reflected by the address indicator contains an instruction segment, and a "0" is stored associated with the address indicator if the target address space reflected by the address indicator does not contain an instruction segment. The term instruction segment, as used herein, is intended to refer to a sequence of instructions that ends with a return instruction and includes no more than a predetermined number of instructions, as known to those skilled in the art. In a non-limiting embodiment, the predetermined number of instructions is 5. In another embodiment, the ECU models 150 are grouped together in a single array. The ECU models 150 are pre-generated by scanning a corresponding binary file and identifying each instruction segment in the binary file and the corresponding address in the system memory containing the instruction segment code, as known to those skilled in the art at the time of this invention.

[0027] In one implementation, each ECU model 150 includes information relating to an acceptable chain of instruction fragments for the corresponding ECU 70. Specifically, the chain of instruction fragments comprises multiple instruction fragments, wherein each instruction fragment in the chain initiates a control flow command to the address of another instruction fragment in the chain. Alternatively, instruction fragments within the chain may initiate control flow commands to addresses within a predetermined distance of the address of another instruction fragment in the chain. The permissible chain of instruction fragments is determined by the binary file of the corresponding ECU 70.

[0028] In the AUTOSAR configuration, ECU 70 operates without ASLR, so the address of the instruction segment will not change unless ECU 70 is updated. In the case of a system where ECU 70 operates with ASLR, the address of each ECU model 150 is updated according to the new address from ASLR.

[0029] In one implementation, the data receiving function 90, the ECU determination function 100, the control flow command recognition function 110, the analysis function 120, the attack detection function 130, and the output function 140 each include a corresponding code segment in the inspection program 35.

[0030] In operation, DCU 40 receives Ethernet packets, and data reception function 90 receives the data packets in processor 30 of ROP attack protection system 20. In one embodiment where DCU 40 operates according to AUTOSAR, checker 35 is implemented as a callback function configured to be invoked when the driver of DCU 40 completes receiving packets. Specifically, in one embodiment, the callback is implemented when the driver's receiver flag is set. In another embodiment where DCU 40 operates on a Linux system and checker 35 is a shared object as described below, the shared checker 35 is invoked using the LD-PRELOAD command. After completing its operation, checker 35 calls the source code to continue normal operation.

[0031] The ECU determination function 100 analyzes received data packets to determine whether the received data packets are destined for one of the ECUs 70. Additionally, the ECU determination function determines which ECU 70 is the destination of the data packet. In one embodiment, the ECU determination function 100 determines the destination of the data packet in response to a predetermined routing model. The predetermined routing model is generated in response to the configuration file of the DCU 40. Specifically, the configuration file of the DCU 40 defines the routing strategy for received signals, i.e., where each signal will be routed. Therefore, the routing model contains a unique identifier for each ECU 70, and the ECU determination function 100 identifies which unique identifier is contained in the data packet, i.e., which ECU 70 is the destination of the data packet. In one embodiment, the destination of the data packet is determined in response to the CAN ID of the data packet. In another embodiment, the destination of the data packet is determined in response to the Ethernet IP of the data packet. In one embodiment, only data packets destined for a specific ECU 70 are analyzed.

[0032] The control flow instruction identification function 110 analyzes the data in the payload of the data packet in response to the ECU model 150 of the ECU 70 as the destination of the data packet to identify control flow instructions containing memory addresses of instruction fragments. Specifically, as described above, in one embodiment, each ECU model 150 sets a flag for each DWORD indicating whether the DWORD contains an instruction fragment. In one embodiment, the control flow instruction identification function 110 compares the destination of each control flow instruction in the payload with the address of the corresponding ECU model 150 to determine whether the flag of the corresponding address space is set to 1 or 0. In another embodiment, the control flow instruction identification function 110 searches the payload of control flow instructions to address the space containing the instruction fragment. It should be noted that different ECUs 70 may use the same address number due to the use of different memories. Therefore, the instruction fragment containing the address is identified by both the address number and the identification of the destination of the ECU 70.

[0033] Analysis function 120 generates statistical analysis of control flow instructions for instruction segments identified by identification function 110. Specifically, in one embodiment, analysis function 120 tracks the number of control flow instructions addressing instruction segments within a predetermined window in the data packet. Specifically, a window of a predetermined size is defined and used to scan the data packet to determine the amount of control flow instructions addressing instruction segments within that window throughout the entire data packet. In yet another embodiment, the window is a moving window, i.e., the window starts from the beginning of the data and increments by a predetermined step size. Optionally, the predetermined step size is 1 byte. In a non-limiting embodiment, the window size is 20 bytes.

[0034] In another embodiment, the window is initialized when a control flow instruction addressing an instruction segment is detected. Specifically, upon detection of a control flow instruction addressing an instruction segment, the window is configured such that it begins at the detected control flow instruction addressing the instruction segment, and the number of additional control flow instructions addressing the instruction segments within the window is counted. After the window completes, a next window is set up upon detection of the next control flow instruction addressing an instruction segment.

[0035] In one implementation, the generated statistical analysis includes the number of control flow instructions addressing instruction segments within the control flow instruction chain addressing instruction segments. As described above, the instruction segment chain comprises several instruction segments, wherein each instruction segment in the chain initiates a control flow instruction address to an address of another instruction segment in the chain or an address within a predetermined distance of the address of another instruction segment in the chain. In another implementation, the generated statistical analysis includes both: the number of control flow instructions addressing instruction segments within the control flow instruction chain addressing instruction segments; and the number of control flow instructions addressing instruction segments within a predetermined window.

[0036] The attack detection function 130 detects the presence of a ROP attack in response to statistical analysis generated by the analysis function 120. Specifically, in an embodiment where the statistical analysis includes the number of instruction fragments invoked within a predetermined window, the attack detection function 130 compares the number of invoked instruction fragments with a predetermined window value. If the number of invoked instruction fragments exceeds the predetermined window value, a ROP attack is identified.

[0037] In an implementation where statistical analysis includes the number of control flow instructions addressing instruction segments within a control flow instruction chain addressing instruction segments, the attack detection function 130 compares the number of control flow instructions within the chain with a predetermined chain value. If the number of instruction segments invoked within the chain exceeds the predetermined chain value, a ROP attack is identified. In one implementation, the predetermined chain value is determined in response to a corresponding ECU model 150; that is, a corresponding predetermined chain value exists for each ECU 70. In another implementation, the control flow instruction chain addressing instruction segments is compared with information about permissible instruction segment chains stored in the corresponding ECU model 150, and the comparison with the predetermined chain value is performed only for chains detected as not stored as permissible chains. Therefore, in such an implementation, the detection of the presence of a ROP attack is in response to a corresponding unique ECU model 150.

[0038] In one embodiment, the attack detection function 130 detects the presence of a ROP attack in response to a predetermined function of both the number of control flow instructions addressing an instruction segment within a predetermined window and the number of control flow instructions within one or more instruction segment chains. In another embodiment, different predetermined functions are provided in each unique ECU model 150. Optionally, each predetermined function is determined in response to information associated with the permissible instruction segment chains in the corresponding ECU 70. Optionally, each predetermined function is determined in response to the type of the corresponding ECU 70, such that a first type of ECU 70 has a first predetermined function associated with it to reduce the number of false alarms, and a second type of ECU 70 has a second predetermined function associated with it to reduce the number of undetected ROP attacks while allowing for more false alarms. Thus, in such an embodiment, the detection of the presence of a ROP attack is responsive to the corresponding unique ECU model 150. Similarly, in one embodiment, each corresponding predetermined window value and each corresponding predetermined chain value are responsive to the type of the corresponding ECU 70.

[0039] In response to a detected ROP attack, output function 140 outputs a signal indicating the presence of a ROP attack. In one embodiment, in response to the output signal, DCU 40 blocks further data transmission to the CAN bus network 50. In another embodiment, each data packet is transmitted to the appropriate CAN bus network only after the data packet has been analyzed and only if no signal indicating the presence of a ROP attack is found. In another embodiment, the above analysis of the data packets is performed in parallel with the transmission of data packets from DCU 40 to the destination ECU 70. In yet another embodiment, the output signal is transmitted to the controller.

[0040] The advanced flowchart of the operation method of inspection procedure 35 is in Figure 1E As shown in the diagram. In stage 1000, the window within the data of the received data packet is initialized. In stage 1010, the control flow instructions within the window are analyzed to determine whether the control flow instructions address an address containing an instruction fragment. If a control flow instruction addressing an instruction fragment is identified, in stage 1020, a flag is checked to determine whether the control flow instruction is the first instruction fragment to be identified in the current window. If it is determined that the control flow instruction is the first instruction fragment to be identified, a counter is started in stage 1030 and the counter is advanced in stage 1040. If it is determined that the control flow instruction is not the first instruction fragment to be identified in the current window, stage 1040 is executed and the counter is advanced.

[0041] In stage 1050, the window from stage 1000 is analyzed to determine whether the window has passed, i.e., whether the end of the window has been reached. If the predetermined window has passed, in stage 1060, the value in the counter from stage 1030 is compared with the predetermined window value. If the value in the counter is greater than the predetermined window value, a signal indicating the presence of a ROP attack is output in stage 1070. If stage 1060 determines that the value in the counter is not greater than the predetermined window value, stage 1000 is executed again, and the window is moved by a predetermined step size, optionally exceeding one byte. Optionally, if an attack is detected and the signal from stage 1070 is output, stage 1000 is also executed again.

[0042] If, in stage 1050, the window of stage 1000 has not yet passed, stage 1010 is executed again. Stages 1000 to 1070 are repeated until the end of the data packet is reached. In one implementation, stages 1000 to 1070 are repeated until the end of the data packet is reached or until a ROP attack is detected.

[0043] Advantageously, the ROP attack protection system 20, optionally located within the DCU 40, can verify packets targeting remote ECU 70 without requiring a separate protection system for each ECU 70. As described above, this verification is performed in one embodiment of detecting ROP attacks based on the exploitation of instruction fragments; however, the systems and methods described above and below are not limited to identifying only instruction fragments.

[0044] Figure 2 A high-level flowchart illustrating a first embodiment of a method for adding an ECU model 150 to an AUTOSAR project is shown. In stage 2000, a checker 35 of the ROP attack protection system 20 is linked to the end of the AUTOSAR project using a linker script. In stage 2010, the ECU's binary file is scanned to identify instruction fragments. In stage 2020, in response to the instruction fragment identification in stage 2010, an array of structures is generated, each structure containing the ECU model 150 for the corresponding ECU 70. In stage 2030, the instruction fragment structure array is added to the source code of the checker 35. If the instruction fragment structure array already exists in the source code of the checker 35, the new structure array from stage 2010 is used to update the structure array. In stage 2040, the source code of the checker 35, including the updated instruction fragment structure array, is compiled and linked. Since the checker 35 is linked to the end of the AUTOSAR project, the updated instruction fragment structure array is now part of the project.

[0045] Figure 3A high-level flowchart illustrating a second embodiment of the method for adding ECU model 150 to an AUTOSAR project is shown. In stage 2100, the checker 35 of the ROP attack protection system 20 is linked to the AUTOSAR project using a linker script. In stage 2110, the ECU's binary file is scanned to identify instruction fragments. In stage 2120, in response to the instruction fragment identification in stage 2110, an array of structures is generated, each structure containing the ECU model 150 for the corresponding ECU 70. In stage 2130, the array of structures from stage 2120 is added to the data portion of the checker 35. If the instruction fragment structure array is already included in the data portion of the checker 35, the new structure array is used to update the instruction fragment structure array.

[0046] Figure 4 A high-level flowchart illustrating the method of adding ECU model 150 to a LINUX project is shown. In stage 3000, the ECU's binary file is scanned to identify instruction fragments. In stage 3010, in response to the instruction fragment identification in stage 3000, an array of structures is generated, each structure containing the ECU model 150 for the corresponding ECU 70. In stage 3020, the instruction fragment structure array is added to the source code of the ROP attack protection system 20. If the instruction fragment structure array already exists in the source code of the ROP attack protection system 20, the structure array is updated using the new structure array from stage 3010. In stage 3030, the source code of the ROP attack protection system 20, including the updated instruction fragment structure array, is compiled to create a shared object. In stage 3040, the shared object from stage 3030 is loaded into the LINUX project. In an alternative implementation, the ROP attack protection system 20 runs independently without being loaded into the LINUX project. Specifically, the LINUX system provides libraries that allow viewing network data traffic.

[0047] Figure 5 A high-level flowchart of a ROP attack protection method according to certain embodiments is shown. In stage 4000, data destined for one of a plurality of ECUs is received. In stage 4010, the destination of the data in stage 4000 is determined, i.e., which of the plurality of ECUs the data is destined for. In stage 4020, in response to a unique model associated with the destination ECU of stage 4010, the received data is analyzed to identify one or more control flow instructions at predetermined addresses in the system memory. In one embodiment, as described above, each predetermined address in the system memory contains an instruction fragment; however, this is not intended to limit the scope in any way. In another embodiment, each predetermined address in the system memory contains code of a predetermined type other than an instruction fragment.

[0048] In stage 4030, in response to the identified control flow instructions from stage 4020, a statistical analysis of the identified control flow instructions is generated. In one embodiment, the statistical analysis includes the number of identified control flow instructions to a predetermined address within a predetermined window of received data. In another embodiment, the statistical analysis includes the number of identified control flow instructions within a chain of identified control flow instructions. In stage 4040, in response to the statistical analysis from stage 4030, the presence of a ROP attack is detected. In one embodiment, a ROP attack is detected in response to the number of identified control flow instructions to a predetermined address within a predetermined window being greater than a predetermined window value. In another embodiment, a ROP attack is detected in response to the number of identified control flow instructions within a chain of identified control flow instructions being greater than a predetermined chain value. In one embodiment, the detection of a ROP attack further responds to the unique model of the corresponding ECU. In another embodiment as described above, a predetermined function of both the predetermined chain value, the predetermined window value, and / or the number of identified control flow instructions within the window and the number of identified control flow instructions within the chain responds to information in the unique model of the corresponding ECU.

[0049] In stage 4050, in response to the detected attack in stage 4040, a signal indicating the presence of a ROP attack is output. In optional stage 4060, in response to the output signal of stage 4050, the DCU is controlled to prevent the transmission of data to multiple ECUs in stage 4000.

[0050] It should be understood that, for clarity, certain features of the invention described in the context of individual embodiments may also be provided in combination in a single embodiment. Conversely, for brevity, various features of the invention described in the context of individual embodiments may also be provided individually or in any suitable sub-combination.

[0051] Unless otherwise specified, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains. Although similar or equivalent methods to those described herein may be used in the practice or testing of this invention, suitable methods are described herein.

[0052] All publications, patent applications, patents, and other references mentioned herein are incorporated herein by reference in their entirety. In case of conflict, the patent specification including the definitions shall prevail. Furthermore, materials, methods, and examples are illustrative only and not restrictive.

[0053] It will be understood by those skilled in the art that the present invention is not limited to what has been specifically shown and described above. Rather, the scope of the invention is defined by the appended claims and includes combinations and sub-combinations of the various features described above, as well as variations and modifications that would occur to those skilled in the art upon reading the foregoing description.

Claims

1. A method for protecting against Return-Oriented Programming (ROP) attacks on multiple Electronic Control Units (ECUs), the method comprising: Receive data destined for one of the plurality of ECUs; Determine which of the plurality of ECUs the received data was destined for; In response to a unique model associated with a determined ECU, the received data is analyzed to identify control flow instructions addressed to one or more predetermined addresses. The unique model is one of a plurality of unique models, each of which is associated with a corresponding ECU among a plurality of ECUs. The unique model is pre-generated by scanning a corresponding binary file and identifying each instruction fragment in the binary file and the corresponding address in the system memory containing the instruction fragment code. In response to the analysis, statistical analysis of the identified control flow instructions is generated; In response to the generated statistical analysis, the presence of ROP attacks is detected; as well as An output signal is provided that indicates the presence of a detected ROP attack.

2. The ROP attack protection method according to claim 1, wherein, Each of the one or more predetermined addresses contains code for a corresponding instruction fragment.

3. The ROP attack protection method according to claim 1, wherein, The generated statistical analysis includes the number of identified control flow instructions within a predetermined window of the received data, and the detection of the presence of a ROP attack is performed in response to the number of identified control flow instructions within the predetermined window exceeding a predetermined window value.

4. The ROP attack protection method according to claim 1, wherein, The detection of the presence of ROP attacks further responds to the corresponding unique model.

5. The ROP attack protection method according to claim 1, wherein, The generated statistical analysis includes the number of identified control flow instructions within the chain of identified control flow instructions, and the detection of the presence of a ROP attack is performed in response to the number of identified control flow instructions within the chain exceeding a predetermined chain value.

6. The ROP attack protection method according to claim 1, wherein, The output signal control domain control unit prevents additional data from being transmitted to the plurality of ECUs.

7. A Return-to-Op (ROP) attack protection system, the system comprising: processor; as well as The memory stores multiple unique models, each associated with a corresponding one of multiple electronic control units (ECUs). These unique models are pre-generated by scanning corresponding binary files and identifying each instruction segment within the binary files and its corresponding address in the system memory containing the instruction segment code. The processor is configured as follows: Receive data destined for one of the plurality of ECUs; Determine which of the plurality of ECUs the received data was destined for; In response to a corresponding unique model associated with the identified ECU, the received data is analyzed to identify control flow commands addressed to one or more predetermined addresses; In response to the analysis, statistical analysis of the identified control flow instructions is generated; In response to the generated statistical analysis, the presence of ROP attacks is detected; and An output signal is provided that indicates the presence of a detected ROP attack.

8. The ROP attack protection system according to claim 7, wherein, Each of the one or more predetermined addresses contains code for a corresponding instruction fragment.

9. The ROP attack protection system according to claim 7, wherein, The generated statistical analysis includes the number of identified control flow instructions within a predetermined window of the received data, and the detection of the presence of a ROP attack is performed in response to the number of identified control flow instructions within the predetermined window exceeding a predetermined window value.

10. The ROP attack protection system according to claim 7, wherein, The detection of the presence of ROP attacks further responds to the corresponding unique model.

11. The ROP attack protection system according to claim 7, wherein, The generated statistical analysis includes the number of identified control flow instructions within the chain of identified control flow instructions, and the detection of the presence of a ROP attack is performed in response to the number of identified control flow instructions within the chain exceeding a predetermined chain value.

12. The ROP attack protection system according to claim 7, wherein, The output signal control domain control unit (DCU) prevents additional data from being transmitted to the plurality of ECUs.

Images