An online approach to defeating ROP attacks∗. (5th September 2018)

• Record Type: Journal Article
• Authors: Tian, Donghai; Jia, Xiaoqi; Zhang, Zhaolong; Zhan, Li; Hu, Changzhen; Xue, Jingfeng
• Other Names: Żółkiewski Sławomir guestEditor.; Chybowski Leszek guestEditor.; Wen Sheng guestEditor.; Castiglione Aniello guestEditor.; Wang Tian guestEditor.; Alam Bhuiyan Md Zakirul guestEditor.
• Is Part Of: Concurrency and computation. Volume 31:Number 22(2019)
• Page Start: n/a
• Page End: n/a
• Publication Date: 2018-09-05
• Subjects: on‐the‐fly -- protection -- return‐oriented programming; Parallel processing (Electronic computers) -- Periodicals; Parallel computers -- Periodicals; 004.35
• DOI: 10.1002/cpe.4775
• Languages: English
• ISSNs: 1532-0626

Abstract

Summary: Return‐Oriented Programming (ROP) attacks become very popular in recent years as these attacks can bypass traditional defense mechanisms such as data execution prevention (DEP) effectively. Previous solutions suffer from limitations in that: 1) some methods need to modify the target programs; 2) some methods introduce considerable performance cost; 3) some methods rely on the special hardware; and 4), most of existing methods could not provide an online protection for the target processes. In this paper, we present OnRop, an on‐the‐fly ROP attack protection system by using the commodity hardware features and OS internal facilities. Our system is compatible with the existing programs, and its protection layer can be added on demand. The experiments show that OnRop can detect ROP attacks effectively with moderate performance cost.