Methods, devices, and systems for detecting return-oriented programming exploits

摘要

Methods, devices, and systems for detecting return-oriented programming (ROP) exploits are disclosed. A system includes a processor, a main memory, and a cache memory. A cache monitor develops an instruction loading profile by monitoring accesses to cached instructions found in the cache memory and misses to instructions not currently in the cache memory. A remedial action unit terminates execution of one or more of the valid code sequences if the instruction loading profile is indicative of execution of an ROP exploit involving one or more valid code sequences. The instruction loading profile may be a hit/miss ratio derived from monitoring cache hits relative to cache misses. The ROP exploits may include code snippets that each include an executable instruction and a return instruction from valid code sequences.

主权项

1. A method operational in a processing circuit including cache memory, comprising:
loading at least portions of an executable code sequence in the cache memory; performing instruction fetches of the executable code sequence from the cache memory; detecting one or more instruction fetch cache misses in response to the instruction fetches, where an individual instruction fetch cache miss represents a fetched instruction absent from the cache memory for a corresponding instruction fetch of the executable code sequence; and monitoring the instruction fetches relative to the one or more instruction fetch cache misses in order to dynamically detect anomalous instruction fetch cache miss activity.