SIGDROP：使用硬件性能计数器的基于签名的ROP检测
SIGDROP: Signature-based ROP Detection using Hardware Performance Counters
摘要：
面向返回的编程（ROP）是一种用于系统妥协的软件漏洞。通过从现有代码片段链接短指令序列，ROP可以绕过静态代码完整性检查方法和不可执行的页面保护。现有的防御要么需要访问源代码或二进制文件，定制的编译器或硬件修改，要么遭受高性能和存储开销。在这项工作中，我们提出了SIGDROP，一种低成本的ROP检测方法，它使用ROP攻击固有的低级别属性。具体来说，我们观察特定的硬件事件时，ROP攻击发生在程序执行过程中的特殊模式。这种基于硬件事件的模式形成签名以在运行时标记ROP攻击。SIGDROP利用硬件性能计数器（已经存在于商用处理器中）来有效地捕获和提取签名。我们的评估表明，SIGDROP可以有效地检测ROP攻击与可接受的性能开销和可忽略的存储开销。
英文摘要：
Return-Oriented Programming (ROP) is a software exploit for system compromise. By chaining short instruction sequences from existing code pieces, ROP can bypass static code-integrity checking approaches and non-executable page protections. Existing defenses either require access to source code or binary, a customized compiler or hardware modifications, or suffer from high performance and storage overhead. In this work, we propose SIGDROP, a low-cost approach for ROP detection which uses low-level properties inherent to ROP attacks. Specifically, we observe special patterns of certain hardware events when a ROP attack occurs during program execution. Such hardware event-based patterns form signatures to flag ROP attacks at runtime. SIGDROP leverages Hardware Performance Counters, which are already present in commodity processors, to efficiently capture and extract the signatures. Our evaluation demonstrates that SIGDROP can effectively detect ROP attacks with acceptable performance overhead and negligible storage overhead.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
