Control Flow Graph Monitoring for Unobserved Transition Enforcement
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing control flow integrity (CFI) validation techniques require source code modification and/or binary re-instrumentation, incur performance penalties, and provide limited accuracy, making them inefficient in detecting sophisticated code reuse attacks like ROP, JOP, and COP.
Innovation Solution
A hardware-assisted control flow directed graph (CFDG) monitoring system that leverages CPU telemetry to learn and enforce legitimate control flow transitions, detecting invalid transfers and preventing malicious code execution in real-time across bare metal, virtual machines, and containerized workloads.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If existing CFI validation techniques are used to detect code reuse attacks, then detection capability is improved, but computational burden increases and performance is degraded
Solution Approach 1:
The patent replaces software-based CFI validation mechanisms with hardware-based monitoring using CPU telemetry and performance counters. The control flow monitoring is shifted from software execution to hardware enforcement, eliminating the computational burden of runtime validation while maintaining detection accuracy. The hardware automatically tracks control flow transfers and enforces policy without requiring extensive software processing.
Solution Approach 2:
The system uses the CPU's own telemetry and performance counter infrastructure to perform control flow monitoring. Instead of adding external monitoring overhead, the solution leverages existing hardware resources that the CPU already generates and maintains, allowing self-monitoring without additional computational cost to the host system.
2Reliability
If source code modification and binary re-instrumentation are applied to insert runtime CFI checks, then control flow validation is improved, but device complexity and ease of operation deteriorate
Solution Approach 1:
The patent eliminates the need for source code modification and binary re-instrumentation by replacing software-based validation with hardware-based monitoring. The CPU's telemetry infrastructure automatically captures control flow information, removing all complexity associated with inserting and managing runtime checks in the application code.
Solution Approach 2:
The solution uses the CPU's existing telemetry and performance counter infrastructure for multiple purposes - both for standard performance monitoring and for control flow validation. This multi-functional use of hardware resources eliminates the need for separate validation infrastructure, reducing overall system complexity.
3Measurement precision
If existing CFI techniques are used to monitor control flow, then detection accuracy is limited, but if more comprehensive monitoring is implemented, then computational cost increases
Solution Approach 1:
The patent achieves comprehensive control flow monitoring with minimal computational cost by substituting software analysis with hardware-based telemetry collection. The CPU automatically generates detailed control flow information through its performance counters and telemetry infrastructure, providing high detection accuracy without requiring computationally intensive software processing.
Data Source
AI summary
Techniques and systems described herein relate to monitoring executions of computer instructions on computing devices based on learning and generating a control flow directed graph. The techniques and systems include determining a learned control flow diagram for a process on a computing system and monitoring execution of the process on the computing system using the control flow diagram. An unobserved transition is determined based on the learned control flow diagram and the unobserved transition is classified as safe or unsafe based on a monitoring component analysis. An action is performed based on the safety classification and the learned control flow diagram.