Method and device for detecting a rop attack based on hardware characteristics

Abstract

The present application relates to a ROP attack detection method and device based on hardware characteristics, comprising the following: obtaining hardware event records of instruction data according to a preset sampling period T; in any sampling period, based on the hardware event records, calculating a first index and a second index; if the first index is less than a first threshold value, directly determining that there is no ROP attack in the sampling period, if the first index is not less than the first threshold value, if the second index is not less than a second threshold value, marking the sampling period as a suspected ROP attack period; if the number of continuously appearing return branch prediction failures recorded in the LBR stack in the adjacent two suspected ROP attack periods is greater than a third threshold value, it is judged that the two suspected ROP attack periods do not exist ROP attack, if not greater than the third threshold value, there is ROP attack. The method proposed in the present application not only has a small performance cost, but also can detect many more advanced ROP attacks that cannot be detected by many other methods.

Description

Technical Field

[0001] This invention relates to the field of information security technology, and in particular to a method and apparatus for detecting ROP attacks based on hardware characteristics. Background Technology

[0002] With the rapid development of information technology, information security has become increasingly important. Attackers are beginning to use more sophisticated attack methods to bypass existing defense mechanisms to achieve their goals. For example, attackers may use existing code snippets in a program to construct code chains that they can exploit; this type of attack is called code reuse attack. Return-Oriented Programming (ROP) is one of the most common types of code reuse attacks. ROP attacks utilize code snippets from the program itself and link these code snippets using the `ret` instruction to bypass some security mechanisms provided by the system, such as the Data Execution Prevention (DEP) mechanism provided by Windows. ROP attacks are widely prevalent across multiple platforms (Windows, Linux, Android).

[0003] Existing detection methods, such as control flow integrity checks, require statically obtaining the destination addresses of possible indirect jumps and then rewriting the binary file to perform the detection. Without the aid of additional information such as source code and symbol tables, it is impossible to accurately disassemble the binary file, making it very difficult to precisely obtain the destination addresses of all indirect jumps. Furthermore, the need to detect all indirect branch transfers incurs significant performance overhead. Moreover, existing detection methods are not very effective at detecting some advanced ROP attacks that can bypass coarse-grained control flow integrity checks, such as call-preceded ROP attacks with gadgets. Summary of the Invention

[0004] The purpose of this invention is to at least address one of the shortcomings of the prior art by providing a method and apparatus for detecting ROP attacks based on hardware characteristics.

[0005] To achieve the above objectives, the present invention adopts the following technical solution:

[0006] Specifically, a hardware-based ROP attack detection method is proposed, including the following:

[0007] Hardware event records that acquire instruction data according to a preset sampling period T include the number of executed call instructions, the number of return instructions, the total number of branch prediction failures, and the number of conditional branch prediction failures in the instruction data.

[0008] In any sampling period, based on its hardware event records, the first indicator and the second indicator are calculated. The first indicator is the number of return instructions minus the number of call instructions, and the second indicator is the total number of branch prediction failures minus the number of conditional branch prediction failures.

[0009] If the first indicator is less than the first threshold, it is directly determined that there is no ROP attack in the sampling period. If the first indicator is not less than the first threshold, it is determined whether the second indicator is not less than the second threshold. If the second indicator is not less than the second threshold, the sampling period is marked as a suspected ROP attack period.

[0010] Obtain the number of consecutive return branch prediction failures recorded in the LBR stack during two adjacent suspected ROP attack cycles;

[0011] If the number of consecutive return branch prediction failures exceeds the third threshold, it is determined that there is no ROP attack in the two suspected ROP attack cycles; if it does not exceed the third threshold, it is determined that there is a ROP attack in the two suspected ROP attack cycles.

[0012] Furthermore, specifically, every 100 instructions, four hardware events—the executed call instruction, return instruction, the total number of branch prediction failures, and the number of conditional branch prediction failures—are recorded by creating a file descriptor using the function perf_event_open().

[0013] Furthermore, specifically, the first threshold is 10, and the second threshold is 12.

[0014] Furthermore, the method for obtaining the number of consecutively occurring return branch prediction failures recorded in the LBR stack during two adjacent suspected ROP attack cycles includes,

[0015] The prediction status of the current return branch is identified by obtaining the 63rd bit of MSR_LASTBRANCH_n_FROM_IP in the LBR stack. When the value of this bit is 1, it means that the return branch prediction has failed, and when the value is 0, it means that the return branch prediction has not failed.

[0016] Furthermore, the method also includes, for sampling periods not marked as suspected ROP attack periods where the first indicator is not less than the first threshold and the second indicator is less than the second threshold, uniformly dividing them into multiple combined periods according to the order of sampling time, assuming that each combined period has N sampling periods of length NT, and denoting the i-th combined period as {Cycle}. i 1. Cycle i 2, ..., Cycle i N}, where Cycle iN represents the second index value of the Nth sampling period in the i-th combination period. Based on the changes in the second index values ​​of adjacent combination periods, abnormal combination periods are identified, and the sampling periods in the abnormal combination periods are marked as suspected ROP attack periods.

[0017] Furthermore, specifically, abnormal combination periods are identified based on the changes in the second indicator value of adjacent combination periods, including:

[0018] Step 110: Predefine the loop variable and initialize i = 1, then proceed to step 120;

[0019] Step 120: Obtain the i-th combination period as the i-th dataset to be analyzed, and proceed to step 130;

[0020] Step 130: Determine if i is equal to 1. If yes, increment the value of i by 1 and proceed to step 120. Otherwise, proceed to step 140.

[0021] Step 140: Perform anomaly analysis based on the i-th dataset to be analyzed and the (i-1)-th dataset to be analyzed, obtain the anomaly analysis results, and proceed to step 150;

[0022] Step 150: If the anomaly analysis result of the i-th dataset to be analyzed is that there is an anomaly, then mark the anomaly and proceed to step 160; otherwise, proceed directly to step 160.

[0023] Step 160: Determine if i is equal to N. If it is equal to N, output the dataset to be analyzed for all anomaly markers, i.e., the combination period of the anomalies. If it is not equal to N, increment the value of i by 1 and proceed to step 120.

[0024] Furthermore, specifically, anomaly analysis is performed based on the i-th dataset to be analyzed and the (i-1)-th dataset to be analyzed, yielding the anomaly analysis results, including:

[0025] Let the (i-1)th dataset to be analyzed be {Cycle} i-1 1. Cycle i-1 2, ..., Cycle i-1 N}, Cycle i-1 j represents the j-th element in the (i-1)-th dataset to be analyzed, and the value of j ranges from [1, N].

[0026] Using the (i-1)th dataset to be analyzed {Cycle} i-1 1. Cycle i-1 2, ..., Cycle i-1 Any element Cycle in N} i-1 Using the element index j as the x-coordinate, Cyclei-1 Using the value of j as the ordinate, we obtain N data points in a two-dimensional coordinate system.

[0027] The change characterization curve of the (i-1)th dataset to be analyzed is obtained by processing these N data points in the two-dimensional coordinate system through a fitting algorithm. This curve is denoted as change characterization curve i-1.

[0028] Let the i-th dataset to be analyzed be {Cycle} i 1. Cycle i 2, ..., Cycle i N}, Cycle i j represents the j-th element in the i-th dataset to be analyzed;

[0029] Using the i-th dataset to be analyzed {Cycle} i 1. Cycle i 2, ..., Cycle i Any element Cycle in N} i Using the element index j as the x-coordinate, Cycle i The value of j is used as the y-coordinate to obtain N data points located in a two-dimensional coordinate system;

[0030] Calculate the nearest distance values ​​from each of the N data points to the change characterization curve i-1, and integrate them to obtain the nearest distance value sequence {Cycle} corresponding to the i-th dataset to be analyzed. i zj1, Cycle i zj2, ..., Cycle i zjN},Cycle i _zjj represents the j-th element in the nearest distance value sequence corresponding to the i-th dataset to be analyzed;

[0031] Traverse {Cycle i zj1, Cycle i zj2, ..., Cycle i Count the number M of elements in zjN that exceed the fourth threshold;

[0032] Determine if the value of M is greater than the fifth threshold. If it is greater than the fifth threshold, mark the i-th dataset to be analyzed as having an anomaly. If it is not greater than the fifth threshold, determine that the i-th dataset to be analyzed does not have an anomaly.

[0033] This invention also proposes a device for ROP attack detection based on hardware characteristics, comprising the following:

[0034] The first data acquisition module is used to acquire hardware event records of instruction data according to a preset sampling period T. The hardware events include the number of executed call instructions, the number of return instructions, the total number of branch prediction failures, and the number of conditional branch prediction failures in the instruction data.

[0035] The indicator calculation module is used to calculate a first indicator and a second indicator based on its hardware event records in any sampling period. The first indicator is the number of return instructions minus the number of call instructions, and the second indicator is the total number of branch prediction failures minus the number of conditional branch prediction failures.

[0036] The first judgment module is used to directly determine that there is no ROP attack in the sampling period if the first indicator is less than the first threshold, and to determine whether the second indicator is not less than the second threshold if the first indicator is not less than the first threshold. If the second indicator is not less than the second threshold, the sampling period is marked as a suspected ROP attack period.

[0037] The second data acquisition module is used to acquire the number of consecutively occurring return branch prediction failures recorded in the LBR stack during two adjacent suspected ROP attack cycles.

[0038] The second judgment module is used to determine whether there is a ROP attack in the two suspected ROP attack cycles if the number of consecutive return branch prediction failures is greater than the third threshold, and whether there is a ROP attack in the two suspected ROP attack cycles if the number is not greater than the third threshold.

[0039] The beneficial effects of this invention are as follows:

[0040] This invention proposes a hardware-based method and apparatus for detecting ROP attacks. First, based on the characteristics of ROP attacks, performance events related to ROP attacks are extracted. Then, the values ​​of performance counters corresponding to these events are read, and normal programs and ROP attacks are classified and processed based on these performance events. Simultaneously, this application combines a performance monitoring unit with a Last Branch Record (LBR) mechanism to reduce false positives. Experimental results show that the proposed method has good detection performance. Furthermore, compared with other methods, the proposed method not only has a lower performance cost but can also detect many more advanced ROP attacks that other methods cannot detect. Attached Figure Description

[0041] The above and other features of this disclosure will become more apparent from the detailed description of the embodiments illustrated in conjunction with the accompanying drawings. In the accompanying drawings, the same reference numerals denote the same or similar elements. Obviously, the drawings described below are merely some embodiments of this disclosure. For those skilled in the art, other drawings can be obtained from these drawings without any creative effort. In the drawings:

[0042] Figure 1 The diagram shows a flowchart of the ROP attack detection method based on hardware characteristics according to the present invention.

[0043] Figure 2 The figure shown is the ROC curve of the hardware-based ROP attack detection method of this invention during the evaluation process.

[0044] Figure 3 The image shows the contents of the LBR stack when the present invention is applied. Detailed Implementation

[0045] The following will provide a clear and complete description of the concept, specific structure, and technical effects of the present invention in conjunction with embodiments and accompanying drawings, so as to fully understand the purpose, solution, and effects of the present invention. It should be noted that, unless otherwise specified, the embodiments and features described in this application can be combined with each other. The same reference numerals used throughout the accompanying drawings indicate the same or similar parts.

[0046] Example 1, referring to Figure 1 This invention proposes a ROP attack detection method based on hardware characteristics, including the following:

[0047] Step 110: Obtain hardware event records of instruction data according to a preset sampling period T. The hardware events include the number of executed call instructions, the number of return instructions, the total number of branch prediction failures, and the number of conditional branch prediction failures in the instruction data.

[0048] Step 120: In any sampling period, based on its hardware event records, calculate the first indicator and the second indicator, wherein the first indicator is the number of return instructions minus the number of call instructions, and the second indicator is the total number of branch prediction failures minus the number of conditional branch prediction failures.

[0049] Step 130: If the first indicator is less than the first threshold, it is directly determined that there is no ROP attack in the sampling period. If the first indicator is not less than the first threshold, it is determined whether the second indicator is not less than the second threshold. If the second indicator is not less than the second threshold, the sampling period is marked as a suspected ROP attack period.

[0050] Step 140: Obtain the number of consecutive return branch prediction failures recorded in the LBR stack during two adjacent suspected ROP attack cycles.

[0051] Step 150: If the number of consecutive return branch prediction failures is greater than the third threshold, it is determined that there is no ROP attack in the two suspected ROP attack cycles. If it is not greater than the third threshold, it is determined that there is a ROP attack in the two suspected ROP attack cycles.

[0052] In this embodiment 1, firstly, based on the characteristics of ROP attacks, some performance events related to ROP attacks are extracted. Then, the values ​​of the performance counters corresponding to these events are read, and normal programs and ROP attacks are classified and processed based on performance events. Simultaneously, this application combines a performance monitoring unit with a Last Branch Record (LBR) mechanism to reduce false alarms. Experimental results show that the method proposed in this application has good detection performance. Furthermore, compared with other methods, the method proposed in this application not only has a lower performance cost but can also detect many more advanced ROP attacks that other methods cannot detect.

[0053] Specifically, the performance monitoring unit provided by the processor is used to record performance events related to ROP attacks. The PMU has two operating modes: counting mode and sampling mode. The mode used in this invention is the sampling mode of the PMU, which requires reading the value of the performance event counter related to ROP attacks every certain number of instructions.

[0054] The performance counter value can be read every N instructions (sampling frequency). When N is 1, the performance counter value is read once for every instruction executed. When N is 1000, the performance event counter value is read once every 1000 instructions. The setting of N is closely related to the detection of ROP attacks. If the value of N is too large, there will be a large number of false positives in the detection results. Conversely, if the value of N is too small, there will be a large performance cost. Therefore, it is crucial to choose the appropriate value of N.

[0055] Assume that the sampling frequency used in this application is every N instructions. The number of Gadget chains used in the ROP attack and the number of instructions contained in each Gadget are closely related to the sampling frequency. This application studies common ROP attacks to obtain the characteristics of common ROP attack chains. That is, to determine the difference between the ROP attack and the number of Gadget chains in a normal program and the number of instructions used in each Gadget in the ROP attack. Assume that the number of Gadget chains in a normal program is n, satisfying maxrop < n < minrop, where minrop is the minimum number of Gadgets that the ROP attack has at least, and maxrop is the maximum number of Gadgets in a normal program.

[0056] To determine the number of instructions used in each Gadget and the value of minrop, this application analyzed some actual ROP attacks. It was found that in most applications, the number of instructions contained in the Gadgets used in the ROP attack is 6, and it contains at least 17 Gadgets and at most 30 Gadgets. Therefore, the value of minrop selected in this application is 16.

[0057] To determine maxrop, this application used the ROPgadget-master[i] tool to construct ROP attacks on 200 application programs (such as svn, bzip2, netstat, etc.) in the folders / bin and / usr / bin. It can be found that 98% of these applications have less than 10 Gadgets, and only 2% have more than 10 Gadgets. Therefore, the value of maxrop selected in this application is 10.

[0058] Thus, the value of n should be between 11 and 16. To be able to detect some ROP attacks with fewer Gadgets, the value of n used in this application is 12. Through the above analysis, this application assumes that the ROP attack has the following characteristics:

[0059] The ROP attack contains at least 12 Gadgets;

[0060] The number of instructions contained in each Gadget is at least 6;

[0061] Most of these Gadgets end with the ret instruction.

[0062] Based on the characteristics of ROP attacks identified above, it can be observed that ROP attacks generally consist of only 100-200 instructions, therefore a sampling frequency of 100-200 instructions is optimal. If the sampling frequency is every 200 instructions, certain characteristics of the program itself can affect the detection of ROP attacks. Furthermore, sampling every 200 instructions does not significantly reduce the performance overhead associated with ROP detection. To improve the accuracy of ROP detection, this application uses a sampling frequency of every 100 instructions.

[0063] In a preferred embodiment of the present invention, specifically, every 100 instructions, four hardware events—the executed call instruction, return instruction, total number of branch prediction failures, and number of conditional branch prediction failures—are recorded by creating a file descriptor using the function perf_event_open().

[0064] In this preferred embodiment, a file descriptor is created using the function perf_event_open() to allow logging of hardware events.

[0065] perf_event_open also provides two event monitoring modes: counting mode and sampling mode. In counting mode, the value of an event is read out through the read function. In sampling mode, the value of an event is periodically written to a pre-specified buffer through the mmap function. The writing period is determined by the sampling frequency.

[0066] The following is a description of each parameter of this function:

[0067] The parameters pid and cpu specify which processes and CPUs are being monitored, mainly falling into the following categories:

[0068] pid==0&&cpu==-1: Monitor the current process on any CPU.

[0069] pid==0&&cpu>=0: Monitor the current process on the specified CPU.

[0070] pid>0&&cpu==-1: Monitor the specified process on any CPU.

[0071] pid>0&&cpu>=0: Monitor the specified process on the specified CPU.

[0072] pid==-1&&cpu>=0: Monitor all processes on the specified CPU.

[0073] pid==-1&&cpu==-1: Illegal parameter.

[0074] The parameter group_fd allows the creation of event groups, which means that multiple events can be recorded simultaneously. Each event group will have a group leader, which is set first by setting group_fd=-1.

[0075] The parameter flags can be 0 or have the following values:

[0076] PERF_FLAG_FD_CLOEXEC: Enables the close-on-exec flag.

[0077] PERF_FLAG_FD_NO_GROPU: Ignore the group_fd parameter

[0078] PERF_FLAG_FD_OUTPUT: Output of performance events in redirected sampling mode, ignoring pre-specified buffers.

[0079] The configuration of each member in this application is shown in Table 1. PERF_SAMPLE_IP indicates recording the EIP value when a performance event occurs, and PERF_SAMPLE_READ indicates reading the value of the performance event counter. In the Type field, PERF_TYPE_HARDWARE indicates recording hardware events, and PERF_TYPE_RAW indicates recording native events. In the config field, entries starting with 'r' indicate native events, and the rest indicate hardware events. r2c4, r8c4, and r1c5 indicate recording the number of call instructions executed, the number of ret instructions executed, and the number of conditional branch prediction failures, respectively. ':u' indicates that performance events are only recorded when the CPU is running in user mode.

[0080]

[0081]

[0082] Table 1

[0083] In a preferred embodiment of the present invention, the first threshold is 10 and the second threshold is 12.

[0084] As a preferred embodiment of the present invention, the method for obtaining the number of consecutively occurring return branch prediction failures recorded in the LBR stack during two adjacent suspected ROP attack cycles includes,

[0085] The prediction status of the current return branch is identified by obtaining the 63rd bit of MSR_LASTBRANCH_n_FROM_IP in the LBR stack. When the value of this bit is 1, it means that the return branch prediction has failed, and when the value is 0, it means that the return branch prediction has not failed.

[0086] In this preferred embodiment, since some normal applications may exhibit characteristics similar to ROP attacks under certain circumstances, the present invention may generate false positives. To reduce false positives, the present invention combines the performance monitoring unit and the LBR stack to decrease the number of false positives.

[0087] The LBR stack can be used to record all types of branch transitions during program execution, as well as combinations of one or more different branches. For example, it can record call branches, ret branches, and conditional branches separately, or record call and ret branches simultaneously.

[0088] This invention primarily considers ROP attacks constructed using ret branches, therefore, this invention only needs to record ret branch transitions. Since this invention only needs to record return branch transitions, it is necessary to use the MSR_LBR_SELECT register to filter out other types of branch transitions. That is, in Branch Type, only the RET bit is 0, indicating that all bits of other types of branches are 1. Similarly, this invention only needs to record return branch transitions in user mode, so the CPL of the MSR_LBR_SELECT register is set to EQ=1 to filter out return branch transitions running in kernel mode.

[0089] The libpfm library makes it easy to record the contents of the LBR stack. Simply specify the event type to be recorded (including PERF_SAMPLE_BRANCH_STACK) in `sample_type`, set the branch to be recorded to PERF_SAMPLE_BRANCH_ANY_RETURN, and use a sampling frequency of 100 instructions.

[0090] In a normal program, the destination address of a return instruction is typically the address of the instruction following the call instruction. However, in a ROP attack, the return instruction executed does not have a corresponding call instruction. Unlike kBouncer, this invention does not require detecting whether the destination address of the return address is the address used in the LBR stack starting from the Nehalem microarchitecture.

[0091] MSR_LASTBRANCH_n_FROM_IP has a special bit that records the prediction status of the current return branch. Bit 63 of MSR_LASTBRANCH_n_FROM_IP identifies the prediction status of the current return branch; a value of 1 indicates that the branch prediction failed, and a value of 0 indicates that no branch prediction failed. Therefore, LBR records the prediction status of the current branch while recording branch transitions. We use this branch prediction status to eliminate some false alarms mentioned above. Even if an attacker uses call-preceded gadgets to construct a ROP attack, the method in this invention can still detect it. Furthermore, when a ROP attack occurs, the execution process of the attack can be traced back based on the contents of the LBR stack.

[0092] In a ROP attack, the `return` instruction executed has no corresponding `call` instruction; that is, all `return` instructions executed in a ROP attack will result in branch prediction failure. Therefore, the presence of a ROP attack can be further determined based on the prediction of the `return` branch. The criterion is: if a ROP attack exists, the number of consecutive `return` branch prediction failures will exceed a threshold. Even if a PMU record meets the criteria for a ROP attack, if there are `return` instructions that do not fail prediction among these numerous branch prediction failures, a ROP attack can be ruled out. In Acroread, records (IIP: 0x000000b67d9d10 5 9 10 4, IIP: 0x000000085705ea 1 7 10 4) indicate a ROP attack, resulting in a false positive. When combined with the LBR stack, the contents of the LBR stack corresponding to this record are as follows... Figure 3 As shown, FROM represents the source address of the return branch, TO represents the destination address of the return branch, and MISPRED indicates whether the return branch is predicted to fail ('Y' if it is, 'N' otherwise). Record A executes 9 return instructions, so the LBR stack has 9 corresponding records. Record B executes 7 return instructions, so the LBR stack has 7 records. Call-preceded attacks are used to detect ROP attacks because existing advanced ROP attacks can bypass this mechanism.

[0093] Aggregating these two instructions yields (12, 10), where 12 represents the total number of failed branch predictions minus the number of failed conditional branch predictions, and 10 represents the total number of return instructions minus the number of call instructions. In this case, the probability of this record being identified as a ROP attack is 0.7. However, when considering the contents of the LBR stack, it is found that if a ROP attack exists, the return instructions executed in the ROP attack should be distributed in the first few records of the LBR stack in A and the last few records of the LBR stack in B. That is, the return instructions at these positions in A and B should result in branch prediction failures, but... Figure 3 The contents of the LBR stack do not meet the condition, so it is determined to be a false alarm.

[0094] To reduce false positives, this invention uses the number of consecutive failed return branch predictions as a feature of the decision tree. When aggregating two records, based on the characteristics of the LBR stack, for the previous branch, the number of consecutive failed return branch predictions needs to be obtained starting from the top of the stack; for the next record, the number needs to be obtained starting from the bottom of the stack. Furthermore, while a return branch may appear multiple times consecutively in a normal program, in a ROP attack, the same gadgets cannot appear consecutively. Therefore, this invention also uses the number of consecutively appearing identical gadgets as a feature.

[0095] When ROP attacks are detected in the combination of PMU and LBR, the resulting ROC curve is as follows: Figure 2 As shown, the AUC score at this time is 0.97, which means that the detection rate of the method in this invention is 97% when combined with the LBR stack. It can be seen that the accuracy of ROP attack detection is greatly improved and false alarms are reduced when combined with the LBR stack.

[0096] In summary, the ROP attack detection mechanism proposed in this invention, when combined with LBR, can effectively detect ROP attacks with a performance cost of only 6%. Furthermore, compared to other methods, the method in this invention does not rely on certain characteristics of ROP attacks, making it applicable to most ROP attacks that use ret links.

[0097] In a preferred embodiment of the present invention, the method further includes, for sampling periods that are not marked as suspected ROP attack periods and whose first indicator is not less than a first threshold and whose second indicator is less than a second threshold, dividing them evenly into multiple combined periods according to the order of sampling time, assuming that each combined period has N sampling periods of length NT, and denoting the i-th combined period as {Cycle}. i 1. Cycle i2, ..., Cycle i N}, where Cycle i N represents the second index value of the Nth sampling period in the i-th combination period. Based on the changes in the second index values ​​of adjacent combination periods, abnormal combination periods are identified, and the sampling periods in the abnormal combination periods are marked as suspected ROP attack periods.

[0098] In a preferred embodiment of the present invention, specifically, abnormal combination periods are identified based on the changes in the second indicator values ​​of adjacent combination periods, including...

[0099] Step 110: Predefine the loop variable and initialize i = 1, then proceed to step 120;

[0100] Step 120: Obtain the i-th combination period as the i-th dataset to be analyzed, and proceed to step 130;

[0101] Step 130: Determine if i is equal to 1. If yes, increment the value of i by 1 and proceed to step 120. Otherwise, proceed to step 140.

[0102] Step 140: Perform anomaly analysis based on the i-th dataset to be analyzed and the (i-1)-th dataset to be analyzed, obtain the anomaly analysis results, and proceed to step 150;

[0103] Step 150: If the anomaly analysis result of the i-th dataset to be analyzed is that there is an anomaly, then mark the anomaly and proceed to step 160; otherwise, proceed directly to step 160.

[0104] Step 160: Determine if i is equal to N. If it is equal to N, output the dataset to be analyzed for all anomaly markers, i.e., the combination period of the anomalies. If it is not equal to N, increment the value of i by 1 and proceed to step 120.

[0105] In a preferred embodiment of the present invention, specifically, anomaly analysis is performed based on the i-th dataset to be analyzed and the (i-1)-th dataset to be analyzed to obtain anomaly analysis results, including:

[0106] Let the (i-1)th dataset to be analyzed be {Cycle} i-1 1. Cycle i-1 2, ..., Cycle i-1 N}, Cycle i-1 j represents the j-th element in the (i-1)-th dataset to be analyzed, and the value of j ranges from [1, N].

[0107] Using the (i-1)th dataset to be analyzed {Cycle} i-1 1. Cycle i-1 2, ..., Cyclei-1 Any element Cycle in N} i-1 Using the element index j as the x-coordinate, Cycle i-1 Using the value of j as the ordinate, we obtain N data points in a two-dimensional coordinate system.

[0108] The change characterization curve of the (i-1)th dataset to be analyzed is obtained by processing these N data points in the two-dimensional coordinate system through a fitting algorithm. This curve is denoted as change characterization curve i-1.

[0109] Let the i-th dataset to be analyzed be {Cycle} i 1. Cycle i 2, ..., Cycle i N}, Cycle i j represents the j-th element in the i-th dataset to be analyzed;

[0110] Using the i-th dataset to be analyzed {Cycle} i 1. Cycle i 2, ..., Cycle i Any element Cycle in N} i Using the element index j as the x-coordinate, Cycle i The value of j is used as the y-coordinate to obtain N data points located in a two-dimensional coordinate system;

[0111] Calculate the nearest distance values ​​from each of the N data points to the change characterization curve i-1, and integrate them to obtain the nearest distance value sequence {Cycle} corresponding to the i-th dataset to be analyzed. i zj1, Cycle i zj2, ..., Cycle i zjN},Cycle i _zjj represents the j-th element in the nearest distance value sequence corresponding to the i-th dataset to be analyzed;

[0112] Traverse {Cycle i zj1, Cycle i zj2, ..., Cycle i Count the number M of elements in zjN that exceed the fourth threshold;

[0113] Determine if the value of M is greater than the fifth threshold. If it is greater than the fifth threshold, mark the i-th dataset to be analyzed as having an anomaly. If it is not greater than the fifth threshold, determine that the i-th dataset to be analyzed does not have an anomaly.

[0114] In this preferred embodiment, considering that the second indicator, namely the total number of failed branch predictions minus the number of failed conditional branch predictions, should not change much within a certain range, if the second indicator shows the above-mentioned abnormal changes, then these sampling periods (i.e. all sampling periods contained in the dataset to be analyzed that has abnormal changes) will also be analyzed as suspected ROP attack periods to ensure accurate ROP attack detection.

[0115] Example 2: The present invention also proposes a device for ROP attack detection based on hardware characteristics, comprising the following:

[0116] The first data acquisition module is used to acquire hardware event records of instruction data according to a preset sampling period T. The hardware events include the number of executed call instructions, the number of return instructions, the total number of branch prediction failures, and the number of conditional branch prediction failures in the instruction data.

[0117] The indicator calculation module is used to calculate a first indicator and a second indicator based on its hardware event records in any sampling period. The first indicator is the number of return instructions minus the number of call instructions, and the second indicator is the total number of branch prediction failures minus the number of conditional branch prediction failures.

[0118] The first judgment module is used to directly determine that there is no ROP attack in the sampling period if the first indicator is less than the first threshold, and to determine whether the second indicator is not less than the second threshold if the first indicator is not less than the first threshold. If the second indicator is not less than the second threshold, the sampling period is marked as a suspected ROP attack period.

[0119] The second data acquisition module is used to acquire the number of consecutively occurring return branch prediction failures recorded in the LBR stack during two adjacent suspected ROP attack cycles.

[0120] The second judgment module is used to determine whether there is a ROP attack in the two suspected ROP attack cycles if the number of consecutive return branch prediction failures is greater than the third threshold, and whether there is a ROP attack in the two suspected ROP attack cycles if the number is not greater than the third threshold.

[0121] Furthermore, the functional modules in the various embodiments of the present invention can be integrated into one processing module, or each module can exist physically separately, or two or more modules can be integrated into one module. The integrated modules described above can be implemented in hardware or as software functional modules.

[0122] If the integrated module is implemented as a software functional module and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, all or part of the processes in the above embodiments of the present invention can also be implemented by a computer program instructing related hardware. The computer program can be stored in a computer-readable storage medium, and when executed by a processor, it can implement the steps of the various method embodiments described above. The computer program includes computer program code, which can be in the form of source code, object code, executable files, or certain intermediate forms. The computer-readable medium can include: any entity or system capable of carrying the computer program code, recording media, USB flash drives, portable hard drives, magnetic disks, optical disks, computer memory, read-only memory (ROM), random access memory (RAM), electrical carrier signals, telecommunication signals, and software distribution media, etc.

[0123] Although the description of the invention has been quite detailed and particularly of several described embodiments, it is not intended to limit it to any of these details or embodiments or any particular embodiment, but should be considered as providing a broad possible interpretation of the claims by referring to the appended claims and taking into account the prior art, thereby effectively covering the intended scope of the invention. Furthermore, the invention has been described above with respect to embodiments foreseeable by the inventors in order to provide a useful description, and non-substantial modifications to the invention that have not yet been foreseen may still represent equivalent modifications.

[0124] The above description is merely a preferred embodiment of the present invention. The present invention is not limited to the above-described embodiments. Any embodiment that achieves the technical effects of the present invention using the same means should fall within the protection scope of the present invention. Within the protection scope of the present invention, various modifications and variations can be made to the technical solutions and / or implementation methods.

Claims

1. A method for detecting a ROP attack based on hardware characteristics, characterized in that, The method comprises the following steps: acquiring hardware event records of instruction data according to a preset sampling period T, the hardware events including the number of executed call instructions, the number of return instructions, the total number of branch prediction failures, and the number of conditional branch prediction failures in the instruction data; in any sampling period, calculating a first index and a second index based on the hardware event records thereof, wherein the first index is the number of return instructions minus the number of call instructions, and the second index is the total number of branch prediction failures minus the number of conditional branch prediction failures; if the first index is less than a first threshold value, directly determining that there is no ROP attack in the sampling period, if the first index is not less than the first threshold value, determining whether the second index is not less than a second threshold value, if the second index is not less than the second threshold value, marking the sampling period as a suspected ROP attack period; acquiring the number of continuously occurring return branch prediction failures recorded in the LBR stack in adjacent two suspected ROP attack periods; if the number of continuously occurring return branch prediction failures is greater than a third threshold value, determining that there is no ROP attack in the two suspected ROP attack periods, if the number of continuously occurring return branch prediction failures is not greater than the third threshold value, determining that there is an ROP attack in the two suspected ROP attack periods; The method further comprises, for the sampling period not labeled as the suspected ROP attack period with the first index not less than the first threshold value and the second index less than the second threshold value, uniformly dividing the sampling period into a plurality of combination periods in the order of sampling time, assuming N sampling periods in each combination period, i.e., the length is NT, and recording the i th combination period as } wherein The second index value of the N th sampling period in the i th combination period is represented as, based on the change of the second index value of the adjacent combination period, finding out the abnormal combination period, and labeling the sampling period in the abnormal combination period as the suspected ROP attack period.

2. The hardware characteristic based ROP attack detection method of claim 1, wherein, Specifically, every 100 instructions, the four hardware events of executed call instructions, return instructions, the total number of branch prediction failures, and the number of conditional branch prediction failures are recorded by creating a file descriptor through the function perf_event_open().

3. The hardware characteristic based ROP attack detection method of claim 1, wherein, Specifically, the first threshold value is 10, and the second threshold value is 12.

4. The hardware characteristic based ROP attack detection method of claim 1, wherein, The method for acquiring the number of continuously occurring return branch prediction failures recorded in the LBR stack in adjacent two suspected ROP attack periods comprises: by acquiring the 63rd bit in the MSR_LASTBRANCH_n_FROM_IP in the LBR stack to identify the prediction of the current return branch, when the bit value is 1, it indicates that the return branch prediction fails, and when the bit value is 0, it indicates that the return branch prediction does not fail.

5. The hardware characteristic based ROP attack detection method of claim 1, wherein, Specifically, the abnormal combination period is found based on the change of the second index value of the adjacent combination period, comprising: Step 110, predefining a loop variable and initializing i=1, and going to step 120; Step 120, acquiring the i-th combination period as the i-th data set to be analyzed, and going to step 130; Step 130, determining whether i is equal to 1, if yes, increasing the value of i by 1 and going to step 120, if no, going to step 140; Step 140, performing change anomaly analysis based on the i-th data set to be analyzed and the i-1-th data set to be analyzed, obtaining a change anomaly analysis result, and going to step 150; Step 150, if the change anomaly analysis result of the i-th data set to be analyzed is abnormal, performing an abnormality marking and going to step 160, if not, directly going to step 160; Step 160, determining whether i is equal to N, if yes, outputting all the abnormality marked data sets to be analyzed, i.e., the abnormal combination period, if not, increasing the value of i by 1 and going to step 120.

6. The hardware feature based ROP attack detection method of claim 5, wherein, Specifically, based on the i-th to be analyzed data set and the i-1-th to be analyzed data set, change anomaly analysis is performed to obtain a change anomaly analysis result, Comprising, Let the i-1th data set to be analyzed be denoted as }, denotes the jth element in the i-1th data set to be analyzed, and j has a value range of [1, N]; Using the (i-1)th dataset to be analyzed { any element in} The element number j is used as the x-coordinate. Using the numerical value as the ordinate, we obtain N data points in a two-dimensional coordinate system; The N data points in the two-dimensional coordinate system are processed by a fitting algorithm to obtain a change representation curve of the i-1-th to be analyzed data set, denoted as change representation curve i-1. Let the i-th data set to be analyzed be denoted as }, denotes the j-th element in the i-th data set to be analyzed; Using the i-th dataset to be analyzed { any element in} The element number j is used as the x-coordinate. The value is used as the y-coordinate to obtain N data points located in a two-dimensional coordinate system; The N data points are respectively calculated to the nearest distance value of the change representation curve i-1 and integrated to obtain the nearest distance value sequence corresponding to the i-th data set to be analyzed N}, Indicates the j-th element in the nearest distance value sequence corresponding to the i-th data set to be analyzed traverse N}, count the number M of elements that exceed a fourth threshold Determine whether the value of M is greater than the fifth threshold value, if it is greater than the fifth threshold value, mark that the i-th to be analyzed data set has change anomaly, if it is not greater than the fifth threshold value, determine that the i-th to be analyzed data set does not have change anomaly.

7. An apparatus for hardware characteristic based ROP attack detection, the apparatus comprising: The device comprises the steps of the method of any one of claims 1-6 The following: The first data acquisition module is configured to acquire hardware event records of instruction data according to a preset sampling period T, and the hardware events include the number of call instructions, the number of return instructions, the total number of branch prediction failures, and the number of conditional branch prediction failures in the instruction data; The index calculation module is configured to calculate a first index and a second index based on the hardware event records in any sampling period, wherein the first index is the number of return instructions minus the number of call instructions, and the second index is the total number of branch prediction failures minus the number of conditional branch prediction failures; The first judgment module is configured to directly determine that there is no ROP attack in the sampling period if the first index is less than a first threshold value, and to determine whether the second index is not less than a second threshold value if the first index is not less than the first threshold value, and to mark the sampling period as a suspected ROP attack period if the second index is not less than the second threshold value; The second data acquisition module is configured to acquire the number of continuously occurring return branch prediction failures recorded in the LBR stack in adjacent two suspected ROP attack periods; The second judgment module is configured to determine that there is no ROP attack in the two suspected ROP attack periods if the number of continuously occurring return branch prediction failures is greater than a third threshold value, and to determine that there is ROP attack in the two suspected ROP attack periods if the number of continuously occurring return branch prediction failures is not greater than the third threshold value.

Images