BeCFI: detecting hidden control flow with performance monitoring counters. (2016)

• Record Type: Journal Article
• Authors: Zhou, HongWei; Shi, WenChang; Yuan, JinHui; Li, FuLin
• Is Part Of: International journal of high performance computing and networking. Volume 9:Number 5/6(2016)
• Page Start: 470
• Page End: 479
• Publication Date: 2016
• Subjects: control flow integrity -- CFI -- operating systems -- kernel rootkits -- branch instructions -- performance monitoring counters -- PMCs -- high performance computing -- security; High performance computing -- Periodicals; Computer networks -- Periodicals; High performance computing; Periodicals; 004.05
• Languages: English
• ISSNs: 1740-0562

Abstract

Most of existing control flow integrity efforts target keeping intended control flow in good integrity. However, they fail to expose hidden control flow that may be introduced by the execution of rootkits, ROP gadgets, etc. To overcome the challenge, we propose an innovative approach BeCFI to detect hidden control flow based on cross-view principle. Since modern processors are capable of observing the execution of all branch instructions, BeCFI obtains the hardware view with the support of performance monitoring counters (PMCs). To obtain software view, we build a software-based counter by compiler-patching and binary-overwriting, and monitor the execution of branch instructions with software-based counters. If a control transfer only appears in hardware view, BeCFI considers that it is hidden control transfer. We have developed a prototype system on Intel x86 Linux kernel. Our evaluations show BeCFI is capable of detecting the hidden control flow introduced by kernel rootkits and ROP attacks. Furthermore our performance tests demonstrate that BeCFI incurs an acceptable overhead.