An Effective Approach of Detecting Return-Oriented-Programming Attacks
Yue Wu · Journal of Chinese Computer Systems · 2013
Return-Oriented-Programming(ROP) attacks can bypass traditional defenses such as DEP and W ⊕ X.Current detection techniques have high false positives w hich are unable to accurately distinguish attacks from normal instruction execution.ROP attacks need to invoke system calls to achieve attacking goal,before w hich registers must be set to correct values;also each x86 instruction corresponds to one or more gadgets.Bases on such characteristics,a new ROP attack defense technique on binary level w as proposed: it intercepts return instructions,from w hich counts the number of gadgets,then check w hether registers have been changed to correct values just before invoking system call.It does not rely on heuristics and provides accurate detection of ROP attacks by stack smashing.Prototype system is implemented w ith dynamic binary instrumentation tool,and w e evaluated the system w ith normal programs and ROP attacks.Experiment results show it causes low false positives and negatives w hile makes little overhead.