Hardware Branch Counter for Code Reuse Attack Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional anti-malware methods for code reuse attacks, such as ROP and JOP exploits, place a heavy computational burden on host systems, impacting user experience and are not effectively detected by existing techniques.
Innovation Solution
A hardware-based solution utilizing a branch counter register, configuration register, and counter control unit to monitor branch instructions and trigger a switch event when a predetermined threshold is exceeded, allowing the processor to switch from executing a process to an event handler routine, thereby detecting potential malware attacks with reduced computational costs.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional anti-malware methods are used to detect code reuse attacks, then detection capability is improved, but computational burden on host system increases
Solution Approach 1:
The patent replaces software-based anti-malware methods with a hardware-based detection mechanism. The hardware processor includes a branch counter register and counter control unit that automatically monitor branch instructions and trigger events when thresholds are exceeded, eliminating the need for continuous software analysis and reducing computational burden on the host system.
Solution Approach 2:
The hardware processor performs self-monitoring of its own execution flow through the branch counter register and counter control unit. The system automatically detects suspicious branch instruction patterns and triggers appropriate responses without requiring external software intervention, making the detection mechanism self-sufficient and reducing overall system computational load.
2Measurement precision
If continuous monitoring of all instructions is performed, then detection precision is improved, but system performance deteriorates
Solution Approach 1:
The patent extracts only the critical monitoring function from continuous instruction analysis. Instead of monitoring all instructions, the hardware processor specifically monitors branch instructions through the branch counter register, extracting only the essential information needed for detection while ignoring non-critical instructions, thus maintaining detection precision while improving system performance.
Solution Approach 2:
The patent applies partial monitoring by focusing only on branch instructions rather than all instructions. The counter control unit monitors branch instruction patterns up to a predetermined threshold, providing sufficient detection capability for code reuse attacks without the excessive computational cost of analyzing every instruction in detail.
3Productivity
If hardware-based detection mechanism is implemented, then computational overhead is reduced, but device complexity increases
Solution Approach 1:
The patent merges the detection functionality into the existing hardware processor structure. The branch counter register and counter control unit are integrated with the processor's existing instruction execution units, combining monitoring and detection functions with the normal execution flow rather than adding separate standalone hardware components, thus reducing overall system complexity.
Solution Approach 2:
The hardware processor components serve multiple functions: the branch counter register monitors branch instructions for security detection while also being part of the normal instruction execution pipeline. The counter control unit handles both detection threshold comparison and event triggering, making the hardware structure multi-functional and reducing the need for separate dedicated security hardware.
Data Source
AI summary
Described systems and methods allow protecting a host computer system from malicious software, such as return-oriented programming (ROP) and jump-oriented programming (JOP) exploits. In some embodiments, a processor of the host system is endowed with two counters storing a count of branch instructions and a count of inter-branch instructions, respectively, occurring within a sequence of instructions. Exemplary counted branch instructions include indirect JMP, indirect CALL, and RET on x86 platforms, while inter-branch instructions consist of instructions executed between two consecutive counted branch instructions. The processor may be further configured to generate a processor event, such as an exception, when a value stored in a counter exceeds a predetermined threshold, and/or when a branch instruction redirects execution to a critical OS function. Such events may be used as triggers for launching a malware analysis to determine whether the host system is subject to a code reuse attack.