Enforcing system-wide control flow integrity for exploit detection and diagnosis

摘要: Modern malware like Stuxnet is complex and exploits multiple vulnerabilites in not only the user level processes but also OS kernel to compromise a system. A main trait of such manipulation control flow. There pressing need diagnose exploits. Existing solutions that monitor flow either have large overhead or high false positives negatives, hence making their deployment impractical. In this paper, we present Total-CFI, an efficient practical tool built on software emulator, capable exploit detection by enforcing system-wide Control Flow Integrity (CFI). Total-CFI performs punctual guest view reconstruction identify key semantics processes, code modules threads. It incorporates novel thread stack identification algorithm identifies boundaries for different threads Furthermore, enforces CFI policy - combination whitelist based shadow call approaches indirect flows detect We provide proof-of-concept implementation DECAF, top Qemu. tested 25 commonly used programs 7 recent real world Windows found 0 negatives respectively. The boot time was be no more than 64.1% average memory 7.46KB per loaded module, it feasible hardware integration.