Geodesic
About detection of code reuse attacks
Modelirovanie i analiz informacionnyh sistem, Tome 26 (2019) no. 2, pp. 213-228

Voir la notice de l'article provenant de la source Math-Net.Ru

When exploiting software vulnerabilities such as buffer overflows, code reuse techniques are often used today. Such attacks allow you to bypass the protection against the execution of code in the stack, which is implemented at the software and hardware level in modern information systems. At the heart of these attacks lies the detection, in the vulnerable program of suitable areas, of executable code — gadgets — and chaining these gadgets into chains. The article proposes a way to protect applications from attacks that use code reuse. For this purpose, features that distinguish the chains of gadgets from typical chains of legal basic blocks of the program are highlighted. The appearance of an atypical chain of the base block during program execution may indicate the execution of a malicious code. An algorithm for identifying atypical chains has been developed. A feature of the algorithm is that it is focused on identifying all currently known techniques of re-execution of the code. The developed algorithm is based on a modified QEMU virtualization system. One of the hallmarks of the chain of gadgets is the execution at the end of the chain of instructions of the processor used to call the function of the operating system. For the Linux operating system based on the x86/64 architecture, experiments have been conducted showing the importance of this feature in detecting the execution of the malicious code.
Mots-clés : code reuse
Keywords: software vulnerability. 
@article{MAIS_2019_26_2_a2,
     author = {Yu. V. Kosolapov},
     title = {About detection of code reuse attacks},
     journal = {Modelirovanie i analiz informacionnyh sistem},
     pages = {213--228},
     publisher = {mathdoc},
     volume = {26},
     number = {2},
     year = {2019},
     language = {ru},
     url = {http://geodesic.mathdoc.fr/item/MAIS_2019_26_2_a2/}
}
TY  - JOUR
AU  - Yu. V. Kosolapov
TI  - About detection of code reuse attacks
JO  - Modelirovanie i analiz informacionnyh sistem
PY  - 2019
SP  - 213
EP  - 228
VL  - 26
IS  - 2
PB  - mathdoc
UR  - http://geodesic.mathdoc.fr/item/MAIS_2019_26_2_a2/
LA  - ru
ID  - MAIS_2019_26_2_a2
ER  - 
%0 Journal Article
%A Yu. V. Kosolapov
%T About detection of code reuse attacks
%J Modelirovanie i analiz informacionnyh sistem
%D 2019
%P 213-228
%V 26
%N 2
%I mathdoc
%U http://geodesic.mathdoc.fr/item/MAIS_2019_26_2_a2/
%G ru
%F MAIS_2019_26_2_a2
Yu. V. Kosolapov. About detection of code reuse attacks. Modelirovanie i analiz informacionnyh sistem, Tome 26 (2019) no. 2, pp. 213-228. http://geodesic.mathdoc.fr/item/MAIS_2019_26_2_a2/