Hardware Branch Counters for Code Reuse Attack Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional anti-malware methods for detecting code-reuse attacks, such as ROP and JOP exploits, place a heavy computational burden on host systems, negatively impacting user experience and efficiency.
Innovation Solution
A processor with branch and inter-branch instruction counters that trigger a switch event when specific thresholds are exceeded, allowing for targeted execution of an event handler routine to analyze potential malware activity, reducing the need for frequent stack analyses.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional anti-malware methods are used to detect code-reuse attacks, then detection capability is improved, but computational burden increases
Solution Approach 1:
The patent replaces software-based malware detection mechanisms with hardware-based branch counting mechanisms. The processor hardware directly counts branch instructions and inter-branch instructions using dedicated counters, eliminating the need for software to perform complex analysis of instruction sequences. This hardware substitution reduces computational burden while maintaining detection capability.
Solution Approach 2:
The processor performs self-monitoring of its own instruction execution patterns through hardware counters that automatically track branch instructions and inter-branch instructions. This self-service approach allows the processor to detect code-reuse attacks without requiring external software analysis, thereby reducing the computational burden on the system while maintaining reliable detection.
2Measurement precision
If frequent stack analyses are performed to detect code-reuse attacks, then detection precision is improved, but user experience deteriorates
Solution Approach 1:
The hardware counters continuously and preliminarily count branch instructions and inter-branch instructions during normal processor execution. This preliminary action prepares detection data in real-time without interrupting user operations, so when a code-reuse attack pattern is detected, the system can immediately respond with precise detection already in place, avoiding the need for frequent disruptive stack analyses that would degrade user experience.
Data Source
AI summary
Described systems and methods allow protecting a host computer system from malware, such as return-oriented programming (ROP) and jump-oriented programming (JOP) exploits. In some embodiments, a processor of the host system is endowed with two counters configured to store a count of branch instructions and a count of inter-branch instructions, respectively, occurring within a stream of instructions fetched by the processor for execution. Exemplary counted branch instructions include indirect JMP, indirect CALL, and RET on x86 platforms, while inter-branch instructions consist of instructions executed between two consecutive counted branch instructions. The processor may be further configured to generate a processor event, such as an exception, when a value stored in a counter exceeds a predetermined threshold. Such events may be used as triggers for launching a malware analysis to determine whether the host system is subject to a code reuse attack.