ROP Chain Detection via Offset Dictionary Preprocessing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing static approaches for detecting Return-Oriented Programming (ROP) chains lack accuracy due to over-detection, as they focus solely on byte string features without considering the link among ROP chains, leading to incidental detection of non-ROP chains as malicious.
Innovation Solution
An attack code detection apparatus that includes a preprocessing unit to analyze library files and generate an offset dictionary of ROP gadgets and stack pointer increments, and a detecting unit to verify the validity of ROP chains in unknown data series, ensuring correct linking and reducing over-detection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If static detection focuses solely on byte string features, then detection speed is improved, but detection accuracy deteriorates due to over-detection of non-ROP chains
Solution Approach 1:
The detection process is segmented into two distinct phases: (1) preprocessing phase where library files are analyzed to extract ROP gadget addresses and build an offset dictionary, and (2) detection phase where the unknown data series is verified against the pre-built dictionary. This segmentation allows the system to maintain high detection speed through pre-computation while achieving high accuracy through structured verification of ROP chain linkages.
Solution Approach 2:
The system performs preliminary analysis of library files to identify all possible ROP gadgets and their offsets before actual detection occurs. The offset dictionary is built in advance, containing ROP gadget addresses and their corresponding stack pointer increments. During detection, the system only needs to verify if the extracted chains match the pre-computed patterns, significantly improving detection speed while maintaining accuracy.
2Measurement precision
If verification of ROP chain linking is performed, then detection accuracy is improved, but device complexity increases
Solution Approach 1:
The offset dictionary serves as an intermediary data structure that simplifies the verification process. Instead of directly analyzing the complex linkages between ROP gadgets in the unknown data series, the system uses the pre-built offset dictionary as a reference to verify chains. This intermediary structure reduces the computational complexity of verification while maintaining high detection accuracy.
Solution Approach 2:
The system creates a simplified copy of the ROP chain structure in the offset dictionary during preprocessing, storing only the essential information (gadget addresses and offsets) needed for verification. This copied representation allows for fast comparison and validation during detection without requiring the full complexity of the original library file structures.
Data Source
AI summary
An attack code detection apparatus includes a preprocessing unit that analyzes in advance a library file for learning used in an ROP (Return Oriented Programming) chain, and obtains sets including the addresses of ROP gadgets, which represent pieces of code in the library file, and increment values of the stack pointer at the time of execution of the ROP gadgets; and a detecting unit that refers to the obtaining result of the preprocessing unit, that verifies, regarding an unknown data series representing the examination target, whether or not the ROP chain is valid in which the ROP gadgets are correctly linked, and that detects whether or not the unknown data series representing the examination target is a malicious data series.