Title: BeCFI: detecting hidden control flow with performance monitoring counters

Authors: HongWei Zhou; WenChang Shi; JinHui Yuan; FuLin Li

Addresses: Information Engineering University, Zhengzhou, China; Key Laboratory of Data Engineering and Knowledge Engineering, Ministry of Education, Renmin University of China, Beijing, China ' School of Information, Renmin University of China, Beijing, China; Key Laboratory of Data Engineering and Knowledge Engineering, Ministry of Education, Renmin University of China, Beijing, China ' Institute of Electronic Technology, Information Engineering University, Zhengzhou, China ' Institute of Electronic Technology, Information Engineering University, Zhengzhou, China

Abstract: Most of existing control flow integrity efforts target keeping intended control flow in good integrity. However, they fail to expose hidden control flow that may be introduced by the execution of rootkits, ROP gadgets, etc. To overcome the challenge, we propose an innovative approach BeCFI to detect hidden control flow based on cross-view principle. Since modern processors are capable of observing the execution of all branch instructions, BeCFI obtains the hardware view with the support of performance monitoring counters (PMCs). To obtain software view, we build a software-based counter by compiler-patching and binary-overwriting, and monitor the execution of branch instructions with software-based counters. If a control transfer only appears in hardware view, BeCFI considers that it is hidden control transfer. We have developed a prototype system on Intel x86 Linux kernel. Our evaluations show BeCFI is capable of detecting the hidden control flow introduced by kernel rootkits and ROP attacks. Furthermore our performance tests demonstrate that BeCFI incurs an acceptable overhead.

Keywords: control flow integrity; CFI; operating systems; kernel rootkits; branch instructions; performance monitoring counters; PMCs; high performance computing; security.

DOI: 10.1504/IJHPCN.2016.080420

International Journal of High Performance Computing and Networking, 2016 Vol.9 No.5/6, pp.470 - 479

Received: 23 Jul 2014
Accepted: 03 Dec 2014
Published online: 22 Nov 2016 *

Full-text access for editors Full-text access for subscribers Purchase this article Comment on this article