Learned Control Flow Directed Graphs for Program Disassembly
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing control flow integrity (CFI) validation techniques require source code modification and/or binary re-instrumentation, incur performance penalties, and provide limited accuracy, making them inefficient against code reuse malware like ROP, JOP, and COP exploits.
Innovation Solution
A hardware-assisted control flow directed graph (CFDG) monitoring system that observes and enforces legitimate control flow transitions using CPU telemetry, generating a learned CFDG during an observation phase and enforcing it during a monitoring phase to detect and prevent invalid transfers.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If existing CFI validation techniques are used to detect control flow hijacking attacks, then detection capability is provided, but source code modification and binary re-instrumentation are required, increasing device complexity and ease of operation difficulty
Solution Approach 1:
The patent introduces a hardware intermediary component (performance monitoring unit or similar hardware module) that mediates between the CPU execution and the CFI validation logic. This hardware intermediary automatically captures control flow information and performs validation without requiring software modification, thus resolving the contradiction between detection capability and device complexity
Solution Approach 2:
The patent replaces the software-based CFI validation mechanism (which requires source code modification and binary instrumentation) with a hardware-based validation mechanism. This substitution eliminates the need for mechanical/software intervention in the code, reducing device complexity while maintaining detection capability
2Reliability
If existing CFI validation techniques are used to ensure control flow integrity, then security validation is provided, but performance penalty is incurred, reducing productivity
Solution Approach 1:
The patent performs control flow validation in advance by establishing expected control flow paths during a learning phase before actual execution. During runtime, the hardware simply checks whether actual control flow transfers match the pre-established paths, eliminating the need for complex runtime validation logic and thus avoiding performance penalties
Solution Approach 2:
The hardware-based system performs self-validation by automatically comparing actual control flow transfers against the learned control flow graph without requiring external software intervention or complex validation routines, thereby maintaining high productivity while ensuring control flow integrity
3Reliability
If existing CFI validation techniques are used to protect against control flow attacks, then security validation is provided, but history limitation reduces measurement precision and detection accuracy
Solution Approach 1:
The patent implements a sliding window mechanism that maintains a partial history of control flow transfers within a fixed window size. This partial history is sufficient to detect control flow hijacking attacks while avoiding the performance overhead of maintaining complete execution history, thus resolving the contradiction between security validation and measurement precision
Data Source
AI summary
Techniques and systems described herein relate to monitoring executions of computer instructions on computing devices based on learning and generating a control flow directed graph. The techniques and systems include determining a learned control flow directed graph for executable code of an application by observing executions of transitions during an observation period and determining destinations of indirect transfers based on the learned control flow directed graph. Next a disassembly of the executable code is determined based on the learned control flow directed graph, the destinations of the transfers, and the executable code.