Runtime execution monitoring (REM) to detect and prevent malicious code execution

摘要: Many computer security threats involve execution of unauthorized foreign code on the victim computer. Viruses, network and email worms, Trojan horses, backdoor programs used in denial service attacks are a few examples. In this paper, we present an architectural technique, which call runtime monitoring (REM), to detect program flow anomalies associated with such malicious code. The key idea REM is verification at hash block (similar basic block) level. This achieved by pre-computing keyed hashes (HMACs) for each during installation, then verifying these values execution. By integrity level, can monitor instructions whose behavior typically exploited code, as branch, call, return instructions. Performance degradation averages 6.4% our benchmark programs, be reduced under 5% increasing size L1 instruction cache.