Mitigating rop attacks

Patent metadata

Field	Value
Publication number	US-2017091449-A1
Application number	US-201615132739-A
Country	US
Kind code	A1
Filing date	Apr 19, 2016
Priority date	Sep 30, 2015
Publication date	Mar 30, 2017
Grant date	—

Abstract

Mitigating return-oriented programming attacks. From program code and associated components needed by the program code for execution, machine language instruction sequences that may be combined and executed as malicious code are selected. A predetermined number of additional copies of each of the selected machine language instruction sequences are made, and the additional copies are marked as non-executable. The machine language instruction sequences and the non-executable copies are distributed in memory. If a process attempts to execute a machine language instruction sequence that has been marked non-executable, the computer may initiate protective action.

First claim

What is claimed is:

1 . A computer-implemented method for return-oriented programming (ROP) mitigation, the method comprising:
receiving, by a computer, program code for execution and associated components needed by the program code for execution; loading, by the computer, the program code and associated components into memory; selecting, by the computer, a predetermined number of sequences of machine language instructions from the loaded program code and/or the associated components, which terminate in a return instruction, by performing one or more of:
identifying a predetermined number of machine language instruction sequences that are equivalent to a conditional statement “if-then-else . . . return” and extracting the code in the else clause, including the return instruction;
selecting sequences of machine language instructions corresponding to machine language instructions in known malicious code sequences and/or in known toolkits for assembling malicious code sequences;
for each selected machine language instruction sequence:
rearranging, by the computer, memory blocks containing the selected machine language instruction sequence, using address space layout randomization (ASLR);
estimating, by the computer, an expected time required to locate the selected machine language instruction sequence by inspecting the rearranged memory blocks; and
repeating the rearranging at the expiration of the expected time.

Assignees

• IBM

Inventors

• Boehm Omer Y
• Farchi Eitan D
• Margalit Oded
• Shajrawi Yousef
• Vinov Michael

Classifications

• G06N99/005

  Physics · mapped topic

• G06F21/55 Primary

  Detecting local intrusion or implementing counter-measures · CPC title

• G06F21/52 Primary

  during program execution, e.g. stack integrity {; Preventing unwanted data erasure; Buffer overflow} · CPC title

• G06N20/00

  Machine learning · CPC title

• G06F21/60

  Protecting data · CPC title