Hardware heuristic-driven binary translation-based execution analysis for return-oriented programming malware detection
A combination of hardware monitoring and binary translation software allow detection of return-oriented programming (ROP) exploits with low overhead and low false positive rates. Embodiments may use various forms of hardware to detect ROP exploits and indicate the presence of an anomaly to a device driver, which may collect data and pass the indication of the anomaly to the binary translation software to instrument the application code and determine whether an ROP exploit has been detected. Upon detection of the ROP exploit, the binary translation software may indicate the ROP exploit to an anti-malware software, which may take further remedial action as desired.
1. At least one storage device or storage disk, comprising instructions that, when executed, cause one or more processors to at least:
configure hardware circuitry to monitor for code flow anomalies regardless of whether a known safe operating condition is present, the hardware circuitry to output an indication in response to detecting a threshold number of the code flow anomalies;
in response to the indication from the hardware circuity:
generate an interrupt; and
determine whether the interrupt occurs outside the known safe operating condition; and
in response to the interrupt occurring outside the known safe operating condition:
cause a device driver to collect information corresponding to the code flow anomalies;
provide the collected information corresponding to the code flow anomalies to a binary translator to cause the binary translator to binary translate a portion of an application corresponding to the code flow anomalies; and
detect a return-oriented programming exploit responsive to the binary translation.
2. The storage device or storage disk of claim 1 , wherein the instructions, when executed, cause the one or more processors to notify anti-malware software of the return-oriented programming exploit.
3. The storage device or storage disk of claim 1 , wherein the instructions, when executed, cause the one or more processors to configure a hardware performance monitoring unit to detect mispredicted branches.
4. The storage device or storage disk of claim 1 , wherein the instructions, when executed, cause the one or more processors to configure the hardware circuitry by configuring a hardware return-oriented programming heuristic unit of the hardware circuitry to detect the code flow anomalies.
5. The storage device or storage disk of claim 1 , wherein the instructions, when executed, cause the one or more processors to:
analyze branch history information corresponding to the code flow anomalies;
perform forward instruction analysis; and
ignore code flow anomalies that do not indicate the return-oriented programming exploit.
6. The storage device or storage disk of claim 1 , wherein the instructions, when executed, cause the one or more processors to take an anti-malware action responsive to a determination that the return-oriented programming exploit has occurred.
7. A programmable device to detect malware exploits, the device comprising:
a code flow anomaly detector to monitor for code flow anomalies regardless of whether a known safe operating condition is present, the code flow anomaly detector implemented by hardware;
a binary translator; and
a device driver to:
configure the code flow anomaly detector; and
in response to an interrupt from the code flow anomaly detector occurring outside the known safe operating condition and indicating occurrences of a threshold number of code flow anomalies, collect information corresponding to at least one of the code flow anomalies, and provide the collected information to the binary translator, the binary translator to perform binary translation of an application corresponding to at least one of the code flow anomalies; and
detect a return-oriented programming exploit responsive to the binary translation.
8. The programmable device of claim 7 , wherein the interrupt indicates a possible return-oriented programming exploit.
9. The programmable device of claim 7 , further including anti-malware software responsive to the return-oriented programming exploit detected by the binary translator to take corrective action.
10. The programmable device of claim 7 , wherein the code flow anomaly detector includes:
performance monitoring hardware to detect mispredicted branches; and
last branch record hardware to capture information regarding branches.
11. The programmable device of claim 7 , wherein the code flow anomaly detector includes heuristic-based hardware to detect return-oriented programming code flow anomalies.
12. The programmable device of claim 7 , wherein the binary translator is to suspend the application corresponding to at least one of the code flow anomalies responsive to detection of the return-oriented programming exploit.
13. The programmable device of claim 7 , wherein the binary translator is to detect the return-oriented programming exploit based on:
analysis of a branch history corresponding to detection of the code flow anomalies; and
forward instruction analysis of code of the application associated with the code flow anomalies.
14. A method of detecting malware exploits, the method comprising:
attempting to detect code flow anomalies with a code flow anomaly detector regardless of whether a known safe operating condition is present;
generating a code flow anomaly indication with the code flow anomaly detector responsive to a threshold number of the code flow anomalies;
generating an interrupt in response to the code flow anomaly indication;
in response to the interrupt occurring outside the known safe operating condition:
collecting, with a device driver, information corresponding to at least one of the code flow anomalies;
providing the collected information to a binary translator;
performing, with the binary translator, binary translation of a portion of an application corresponding to the code flow anomaly indication; and
detecting, by executing an instruction with a processor, a return-oriented programming exploit responsive to the binary translation.
15. The method of claim 14 , wherein the attempting to detect the code flow anomalies includes attempting to detect mispredicted branches.
16. The method of claim 15 , wherein the attempting to detect the code flow anomalies further includes attempting to detect an imbalance between call and return instructions.
17. The method of claim 14 , further including:
suspending the application; and
notifying anti-malware software of the detected return-oriented programming exploit.
18. The method of claim 14 , wherein the performing of the binary translation includes analyzing a branch history of the application.
19. The method of claim 14 , wherein the performing of the binary translation includes performing instruction-level forward analysis of the application.
20. The method of claim 14 , further including configuring, with the device driver, the code flow anomaly detector.
21. The method of claim 14 , wherein the indication includes the interrupt generated by the code flow anomaly detector.
22. The method of claim 14 , further including taking an anti-malware action responsive to detecting the return-oriented programming exploit.