Hardware heuristic-driven binary translation-based execution analysis for return-oriented programming malware detection
A combination of hardware monitoring and binary translation software allow detection of return-oriented programming (ROP) exploits with low overhead and low false positive rates. Embodiments may use various forms of hardware to detect ROP exploits and indicate the presence of an anomaly to a device driver, which may collect data and pass the indication of the anomaly to the binary translation software to instrument the application code and determine whether an ROP exploit has been detected. Upon detection of the ROP exploit, the binary translation software may indicate the ROP exploit to an anti-malware software, which may take further remedial action as desired.
1. A programmable device to detect a malware exploit in an application, the programmable device comprising:
hardware circuitry to:
monitor for return related instructions and call related instructions regardless of whether a known safe operating condition is present;
determine a first number of ones of the return related instructions;
determine a second number of ones of the call related instructions;
determine a difference between the second number and the first number;
in response to the difference satisfying a threshold, detect a mispredicted branch;
in response to a detection of the mispredicted branch, record a mispredict indicator in an entry of a last branch record stack; and
generate an interrupt; and
a device driver to identify a translated version of original binary in the application based on binary translation of the application in response to the interrupt.
2. The programmable device of claim 1 , wherein the interrupt is to indicate a possible return-oriented programming exploit.
3. The programmable device of claim 1 , wherein the hardware circuitry includes heuristic-based circuitry to determine the difference.
4. The programmable device of claim 1 , wherein the device driver is to suspend the application in response to a detection of a return-oriented programming exploit.
5. The programmable device of claim 1 , further including anti-malware software to take corrective action in response to a detection of a return-oriented programming exploit based on the translated version of the original binary.
6. The programmable device of claim 1 , wherein the device driver is to provide collected information to enable a binary translator to perform the binary translation, the collected information including at least one of (1) a context of the application including register states of the application or (2) last branch record history corresponding to the application.
7. At least one storage device or storage disk comprising instructions that, when executed, cause one or more processors to at least:
monitor for code flow anomalies regardless of whether a known safe operating condition is present;
record a misprediction indicator in a register of a plurality of registers of the one or more processors based on a detection of a mismatch of an expected program code flow and one or more of the code flow anomalies;
in response to the mismatch, generate an interrupt;
in response to the interrupt:
cause a binary translator to binary translate at least a portion of an application corresponding to the one or more of the code flow anomalies; and
initiate anti-malware software to combat a return-oriented programming exploit detected in the binary translation.
8. The at least one storage device or storage disk of claim 7 , wherein the instructions, when executed, cause the one or more processors to notify the anti-malware software of the return-oriented programming exploit.
9. The at least one storage device or storage disk of claim 7 , wherein the instructions, when executed, cause the one or more processors to configure a hardware performance monitor circuit to detect mispredicted branches.
10. The at least one storage device or storage disk of claim 7 , wherein the instructions, when executed, cause the one or more processors to configure a hardware return-oriented program heuristic circuit to detect the code flow anomalies.
11. The at least one storage device or storage disk of claim 7 , wherein the instructions, when executed, cause the one or more processors to:
analyze branch history information corresponding to the code flow anomalies;
perform forward instruction analysis; and
ignore code flow anomalies that do not indicate the return-oriented programming exploit based on an output of the forward instruction analysis.
12. The at least one storage device or storage disk of claim 7 , wherein the instructions, when executed, cause the one or more processors to inspect the return-oriented programming exploit to determine an action to combat the return-oriented programming exploit.
13. The at least one storage device or storage disk of claim 7 , wherein the instructions, when executed, cause the one or more processors to:
identify frequently executed execution paths;
identify ones of the identified execution paths as trusted execution paths;
remove security checks for ones of the trusted execution paths; and
determine that the code flow anomalies are not associated with ones of trusted execution paths.
14. A programmable device for detecting malware, the programmable device comprising:
means for monitoring for code flow anomalies regardless of whether a known safe operating condition is present, the means for monitoring to:
detect a mispredicted branch in response to detection of a threshold number of the code flow anomalies; and
record a mispredict indicator in an entry of a last branch record stack; and
means for processing to:
in response to an interrupt based on the mispredict indicator:
binary translate at least a portion of an application corresponding to the code flow anomalies; and
detect a return-oriented programming exploit based on the binary translation.
15. The programmable device of claim 14 , wherein the interrupt is to indicate a possible return-oriented programming exploit.
16. The programmable device of claim 14 , wherein the means for processing is to notify anti-malware software of the return-oriented programming exploit.
17. The programmable device of claim 14 , wherein the means for processing is to configure the means for monitoring to detect the mispredicted branch based on a comparison of an expected program code flow with the code flow anomalies, the code flow anomalies extracted from the last branch record stack.
18. The programmable device of claim 14 , wherein the means for processing is to configure a hardware return-oriented programming heuristic circuit of the means for monitoring to detect the code flow anomalies.
19. The programmable device of claim 14 , wherein the means for processing is to:
analyze branch history information corresponding to the code flow anomalies;
perform forward instruction analysis; and
ignore code flow anomalies that do not indicate the return-oriented programming exploit based on the forward instruction analysis.
20. The programmable device of claim 14 , wherein the means for processing is to cause anti-malware software to take an anti-malware action in response to the return-oriented programming exploit.
21. The programmable device of claim 14 , wherein the means for processing is to provide collected information to a binary translator to perform the binary translation, the collected information including at least one of (1) a context of the application including register states of the application or (2) last branch record history corresponding to the application.
22. At least one storage device or storage disk comprising instructions that, when executed, cause one or more processors to at least:
record a misprediction indicator in a register of a plurality of registers of the one or more processors based on a detection of a mismatch of an expected program code flow and one or more code flow anomalies;
in response to the mismatch, generate an interrupt;
in response to the interrupt occurring during a known safe operating condition, cause a device driver to list an address range in a trusted list, the address range associated with the interrupt;
conduct instruction level execution analysis to retrieve an indication of a target address from the trusted list;
execute a branch instruction associated with the target address; and
in response to the interrupt:
cause a binary translator to binary translate at least a portion of an application corresponding to the one or more code flow anomalies; and
initiate anti-malware software to combat a return-oriented programming exploit detected in the binary translation.
23. The at least one storage device or storage disk of claim 22 , wherein the known safe condition includes the application or the address range to be in an approved list, a safe list, or a trusted list approved list.