基于用户输入分析的返回导向编程攻击检测

DETECTING RETURN-ORIENTED PROGRAMMING ATTACKS BASED ON USER INPUT ANALYSIS

返回导向编程攻击,通过将程序中现有的二进制代码片段进行有机的组合,能有效地生成恶意代码攻击程序,而现有的攻击检测技术不能很好地对这类攻击进行检测。介绍返回导向编程攻击,分析并指出返回栈的成功构造是使得这种攻击成功的关键事实。基于这个事实,设计并实现了一个返回导向编程攻击的检测系统B re。tB ret的检测原理和攻击者利用的代码片段是正交的,从而可以很好地防御基于"更新-加载-跳转"指令序列的返回导向编程攻击。在对B ret的攻击检测能力和性能评测中,B ret展示了高效的检测能力,几乎不产生误报和漏报,同时,使用B ret保护的程序产生了非常小的性能开销。

Return-oriented programming attack,which fits together the pieces of existing binary code in program in an organic way to effectively form malicious code attack program,nullifies many existing attacks detection approaches in checking such attacks.In this paper we are to introduce the return-oriented programming attacks,analyse and point out a key fact that the successful construction of the return stack achieves such attacks.Based on this fact,we design and implement the Bret,which is a detection system against the return-oriented programming attack.The detection theory of Bret is in orthogonal to the pieces of code which the attackers uses,therefore it works good in defensing the ＂update-load-branch＂ instruction sequence-based return-oriented programming attack.On evaluation on attacks detection capability and performance of Bret,it represents high detection capability with few false alarm and missing.Meanwhile,the performance overhead of the programs protected by Bret is very small.