Searching for just a few words should be enough to get started. If you need to make more complex queries, use the tips below to guide you.
Article type: Research Article
Authors: Li, Xushenga | Hu, Zhishengb | Wang, Haizhoua | Fu, Yiweic | Chen, Pingd | Zhu, Minghuie | Liu, Penga; *
Affiliations: [a] College of Information Sciences and Technology, Pennsylvania State University, PA, USA. E-mails: xul200@psu.edu, hjw5074@psu.edu, pliu@ist.psu.edu | [b] Baidu Security, CA, USA. E-mail: zhishenghu@baidu.com | [c] GE Research, NY, USA. E-mail: yiweifu1@gmail.com | [d] JD.com American Technologies Corporation, CA, USA. E-mail: ping.chen@jd.com | [e] School of Electrical Engineering and Computer Science, Pennsylvania State University, PA, USA. E-mail: muz16@psu.edu
Correspondence: [*] Corresponding author. E-mail: pliu@ist.psu.edu.
Abstract: Return-oriented programming (ROP) is a code reuse attack that chains short snippets of existing code to perform arbitrary operations on target machines. Existing detection methods against ROP exhibit unsatisfactory detection accuracy and/or have high runtime overhead. In this paper, we present DeepReturn, which innovatively combines address space layout guided disassembly and deep neural networks to detect ROP payloads. The disassembler treats application input data as code pointers and aims to find any potential gadget chains, which are then classified by a deep neural network as benign or malicious. Our experiments show that DeepReturn has high detection rate (99.3%) and a very low false positive rate (0.01%). DeepReturn successfully detects all of the 100 real-world ROP exploits that are collected in-the-wild, created manually or created by ROP exploit generation tools. DeepReturn is non-intrusive and does not incur any runtime overhead to the protected program.
Keywords: Return-oriented programming, intrusion detection system, disassembly, convolutional neural network
DOI: 10.3233/JCS-191368
Journal: Journal of Computer Security, vol. 28, no. 5, pp. 499-523, 2020
IOS Press, Inc.
6751 Tepper Drive
Clifton, VA 20124
USA
Tel: +1 703 830 6300
Fax: +1 703 830 2300
sales@iospress.com
For editorial issues, like the status of your submitted paper or proposals, write to editorial@iospress.nl
IOS Press
Nieuwe Hemweg 6B
1013 BG Amsterdam
The Netherlands
Tel: +31 20 688 3355
Fax: +31 20 687 0091
info@iospress.nl
For editorial issues, permissions, book requests, submissions and proceedings, contact the Amsterdam office info@iospress.nl
Inspirees International (China Office)
Ciyunsi Beili 207(CapitaLand), Bld 1, 7-901
100025, Beijing
China
Free service line: 400 661 8717
Fax: +86 10 8446 7947
china@iospress.cn
For editorial issues, like the status of your submitted paper or proposals, write to editorial@iospress.nl
如果您在出版方面需要帮助或有任何建, 件至: editorial@iospress.nl