Using hardware performance counters for detecting control hijacking attacks

Abstract

Control Hijacking Attack (CHA) is one of the significant ways to exploit the buffer related vulnerability. New code reuse techniques used for the control hijacking attack can circumvent existing security measures. For example, the latest attacks such as Return Oriented Programming use fragments of the existing code base to create an attack. Since this code is already existing code in the system, the Data Execution Prevention methods cannot prevent the execution of this reorganised code. Existing software-based Control Flow Integrity can prevent this attack, but the algorithm and overhead are enormous. Hardware Performance Counters provide support for hardware level detection methods for against control hijacking attack. We proposed a detection method based on the supervision of Hardware Performance Counters (HPCs), and which is a lightweight detection for CHA to solve the monitoring restrictions of other software and hardware security measures, which has a small running overhead. This detection method supports faster information collection, shorter response times, and lower system consumption compared to software level detection. Simulation tests on Gem5 prove that this detection method can be used to detect CHAs

More information

Identifiers

ORCID for Mark Zwolinski: orcid.org/0000-0002-2230-625X

Catalogue record

Export record