Hardware CFI Monitoring Using CPU Telemetry for Code Reuse Attacks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing control flow integrity (CFI) validation techniques require source code modification and/or binary re-instrumentation, incur performance penalties, and provide limited accuracy, making them inefficient in detecting sophisticated code reuse attacks like ROP, JOP, and COP.
Innovation Solution
A hardware-assisted control flow directed graph (CFDG) monitoring system that leverages CPU telemetry to learn and enforce legitimate control flow paths, detecting invalid transfers and preventing malicious code execution in real-time across various computing environments, including bare metal, virtual machines, and containers.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If existing CFI validation techniques are used, then control flow integrity can be validated, but source code modification and binary re-instrumentation are required, increasing device complexity
Solution Approach 1:
The patent introduces a hardware intermediary component (performance monitoring unit or similar hardware module) that mediates between the CPU execution and the CFI validation logic. This hardware intermediary captures control transfer information directly from CPU registers and memory without requiring modifications to source code or binary, thereby maintaining reliability while reducing device complexity
Solution Approach 2:
The patent replaces the software-based CFI validation mechanism (which requires code modification and re-instrumentation) with a hardware-based validation system. This substitution eliminates the need for mechanical/software interventions in the code, achieving the same validation goal through hardware-level monitoring and comparison
2Reliability
If existing CFI validation techniques are used, then control flow validation can be performed, but performance penalties are incurred
Solution Approach 1:
The patent performs preliminary action by pre-computing and storing valid control flow transfer targets in a data structure (such as a hash table or lookup table) during system initialization or code analysis phase. During runtime, the hardware simply performs fast lookup comparisons rather than complex validation computations, significantly improving productivity while maintaining validation reliability
Solution Approach 2:
The patent creates a copy of the expected control flow information in a hardware-accessible data structure that mirrors the legitimate control flow paths. This copied information is then rapidly compared against actual control transfers using simple hardware operations, avoiding the performance penalty of complex runtime validation while ensuring integrity
3Reliability
If existing CFI validation techniques are used, then some control flow validation is provided, but accuracy is limited due to limited history
Solution Approach 1:
The patent adds another dimension to control flow validation by incorporating context information from multiple sources including call stack state, register values, and memory contents into the validation process. This multi-dimensional validation approach significantly improves detection accuracy by considering the full execution context rather than isolated control transfers
Data Source
AI summary
Techniques and systems described herein relate to monitoring executions of computer instructions on computing devices based on learning and generating a control flow directed graph. The techniques and systems include receiving a report of a first anomaly based on real-time control flow graph diagram monitoring of an application at a first system and receiving a second report of a second anomaly from a second system. An exploit report may be generated by providing the first report and the second report to a machine learning model trained to output information related to an exploit based on input reports, and subsequently to provide the output information to a cloud-based reporting tool.