Hardware-Software ROP Malware Detection via Binary Translation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for detecting Return Oriented Programming (ROP) exploits are either inefficient due to high performance overhead or prone to false positives, and existing solutions like Address Space Layout Randomization (ASLR) can be bypassed, leaving a need for a reliable and low-overhead detection mechanism.
Innovation Solution
A combined hardware-software solution utilizing heuristic hardware-based events to trigger binary translation (BT) code analysis, which provides opcode-level execution runtime analysis to accurately detect ROP attacks with zero false positives and low overhead, leveraging processor features like Performance Monitoring Units (PMUs) and Last Branch Recording to monitor branch anomalies.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If ASLR is used to randomize code location, then detection difficulty increases, but it can be bypassed through information leakage attacks
Solution Approach 1:
The patent replaces software-based detection mechanisms with hardware-based detection using processor performance monitoring units and branch recording mechanisms. This hardware substitution provides more reliable and efficient detection of ROP attacks by directly monitoring processor execution flow at the hardware level, making it harder for attackers to bypass through software-level obfuscation techniques.
Solution Approach 2:
The patent introduces an intermediary analysis layer that sits between the hardware monitoring components and the detection logic. This intermediary layer processes raw hardware events, filters out false positives, and presents refined detection data to the security system, thereby improving reliability while managing complexity through abstraction.
2Reliability
If compiler support with OS modification is used to track return instructions, then gadget chaining is prevented, but heavy performance penalty is incurred
Solution Approach 1:
The patent replaces software-based control flow tracking (which requires compiler and OS modifications) with hardware-based tracking using processor performance monitoring units. This substitution eliminates the need for extensive software modifications and reduces performance overhead by leveraging dedicated hardware circuits that can track control flow events with minimal impact on execution speed.
Solution Approach 2:
The patent extracts the control flow tracking function from the software layer (compiler and OS) and places it in the hardware layer. By separating this function into dedicated hardware components, the system achieves accurate tracking without the performance penalties associated with software-based implementation, as hardware operations execute in parallel with normal program execution.
3Reliability
If memory page invalidation is used to detect control flow changes, then ROP attacks are detected, but noticeable overhead is introduced
Solution Approach 1:
The patent replaces the software-based memory page invalidation technique with hardware-based branch recording and performance monitoring. This substitution enables continuous monitoring of control flow events without the need to invalidate memory pages, as the hardware components can track branch instructions and return addresses directly from processor signals, providing detection capability without the performance overhead of memory operations.
4Measurement precision
If binary translation with opcode-level analysis is used, then detection accuracy improves, but computational overhead increases
Solution Approach 1:
The patent replaces software-based binary translation with hardware-based opcode analysis using performance monitoring units and branch recording mechanisms. This substitution provides precise detection of control flow events at the instruction level without the computational overhead of translating and analyzing binary code in software, as hardware components can monitor and record execution events in real-time with minimal performance impact.
Data Source
AI summary
A combination of hardware monitoring and binary translation software allow detection of return-oriented programming (ROP) exploits with low overhead and low false positive rates. Embodiments may use various forms of hardware to detect ROP exploits and indicate the presence of an anomaly to a device driver, which may collect data and pass the indication of the anomaly to the binary translation software to instrument the application code and determine whether an ROP exploit has been detected. Upon detection of the ROP exploit, the binary translation software may indicate the ROP exploit to an anti-malware software, which may take further remedial action as desired.