Identification of Return-Oriented Programming Attacks Using RISC-V Instruction Trace Data

Abstract

An increasing number of embedded systems include dedicated neural hardware. To benefit from this specialized hardware, deep learning techniques to discover malware on embedded systems are needed. This effort evaluated candidate machine learning detection techniques for distinguishing exploited from nonexploited RISC-V program behavior using execution traces. We first developed a dataset of execution traces containing Return Oriented Programming (ROP) exploitation on the RISC-V Instruction Set Architecture (ISA) and then developed several deep learning bidirectional Long Short-Term Memory (LSTM) models capable of distinguishing exploited traces from non-exploited traces, each using subsets of features from the execution traces. An objective of this effort was to evaluate which features (instruction addresses and immediate values) from an execution trace are application-specific, which features (opcodes and operands) are application-agnostic, and how these subsets of features affect model performance. Applicationagnostic features allow a model to generalize its detection capability to detecting ROP in previously unseen applications. The model using opcode and operand sequences obtained 98.21% cross validation accuracy and 97.94% test accuracy. In contrast, a model using address values obtained 92.79% cross validation accuracy with 99.59% test set accuracy. This research also analyzed whether ROPs exploitation significantly affects branch prediction; experimental evidence suggests that it does. Thus, branch prediction behavior could be a valuable feature in detecting ROPs exploits.

Memory Integrity Techniques for Memory-Unsafe Languages: A Survey

“…Like DeepCheck, HeNet [122] is a CFI technique that leverages IPT to analyze the execution state of a program, but adopts a hierarchical ensemble of DNNs to enhance ROP detection accuracy. More recently, Koranek et al [123] developed specialized LSTM models to analyze RISC-V ISA execution traces and determine whether they were subject to ROP exploitation.…”

Ret-gadgets in RISC-V-based Binaries Resulting in Traps for Hijackers

“…A recent study by Koranek et al (2022) also focused on ROP on RISC-V to proffer solutions towards detection of ROP on RISC-V by using deep learning (DL) models to distinguish features from execution trace. Koranek et al analysed branch patterns in ROP as valuable information towards ROP detection.…”

“…In addition to this, the existing protections have not reasonably considered vulnerability of RISC-V-based binaries. Apart from the knowledge of underlying dangers of ROP on RISC-V, recent study by Koranek et al (2022) also presents models that were developed with focus on ROP gadgets as valuable resource for ML towards detection of possible ROP. Understanding of the behaviour of gadgets would be useful in this regard.…”

Anomaly Behaviour tracing of CHERI-RISC V using Hardware-Software Co-design

“…Authors in [1] conducted a thorough investigation to detect a fault using a counter-based built-in self-test strategy in a Rocket RISC-V microprocessor prototyped on FPGA. This study [2] created a dataset of execution traces containing Return Oriented Programming (ROP) exploitation on the RISC-V Instruction Set Architecture and used deep learning AI models like long shortterm memory (LSTM) to distinguish exploited traces from non-exploited traces to detect ROP attacks. The authors in [3] proposed a methodology to perform real-time monitoring of software that kept track of hardware performance counters executing on embedded processors in cyber-physical systems.…”