Indirect Control Flow Malicious Code Detection via Address Prediction
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing virtualized systems are vulnerable to malicious code attacks, particularly through indirect control-flow instructions, which can lead to costly dynamic checks and performance penalties.
Innovation Solution
A method is introduced to analyze indirect control-flow instructions by comparing generated memory addresses to predicted addresses, evaluating program code when mis-predictions occur, and invoking software handlers to prevent malicious execution, leveraging hardware support for mis-predicted control flow and enhanced compiler/linker/loader software.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If dynamic checks are performed on indirect control-flow instructions to detect malicious code, then security is improved, but system performance deteriorates due to costly checks
Solution Approach 1:
The system performs preliminary actions by predicting control-flow destinations before execution and establishing expected memory address ranges in advance. This allows the system to have security checks ready before malicious code can execute, eliminating the need for costly dynamic checks during runtime while maintaining security.
Solution Approach 2:
The patent introduces an intermediary mechanism (prediction-based validation layer) between the indirect control-flow instruction and the execution engine. This intermediary uses predicted values and memory address range validation to filter out malicious code without requiring expensive dynamic checks, thus resolving the contradiction between security and performance.
2Measurement precision
If comprehensive validation of indirect control-flow targets is implemented, then detection precision is improved, but computation resource consumption increases
Solution Approach 1:
The system applies partial validation by focusing checks only on the critical aspect (memory address range validity) rather than comprehensive validation of all possible code attributes. This partial action approach maintains high detection precision while minimizing computation resource consumption by avoiding unnecessary validation steps.
Solution Approach 2:
The validation mechanism serves itself by using the program's own predicted control-flow information and existing memory address structures to perform validation. This self-service approach eliminates the need for external computational resources, achieving high detection precision without increasing overall system resource consumption.
Data Source
AI summary
In a system where an indirect control flow instruction requires a CPU to consult a first memory address, in addition to what is encoded in the instruction itself, for program execution, a method is provided to determine if the first memory address contains a valid or plausible value. The first memory address is compared to an expected or predicted memory address. A difference between the expected or predicted memory address and the first memory address causes an evaluation of any program code about to be executed. The evaluation of code determines whether or not a malicious attack is occurring, or being attempted, that might affect proper operation of the system or program.