Identification of Return-Oriented Programming Attacks Using RISC-V Instruction Trace Data
Identification of Return-Oriented Programming Attacks Using RISC-V Instruction Trace Data
复制标题
使用 RISC-V 指令跟踪数据识别面向返回的编程攻击
作者：
Daniel F. Koranek;S. Graham;B. Borghetti;Wayne C. Henry
越来越多的嵌入式系统包括专用的神经硬件。为了从这种专业的硬件中受益，需要深入学习技术来发现嵌入式系统上的恶意软件。这项工作评估了候选机器学习检测技术，用于使用执行轨迹区分被利用的RISC-V程序行为。我们首先在RISC-V指令集架构（ISA）上开发了一个包含返回的编程（ROP）剥削的执行轨迹数据集，然后开发了几个深度学习双向长期短期内存（LSTM）模型 - 探索轨迹，每种轨迹都使用执行跟踪中的功能子集。这项工作的一个目的是评估执行跟踪中哪些功能（指令地址和直接值）是应用程序特定的，哪些功能（操作编码和操作数）是应用程序 - 敏捷的，以及这些功能的这些子集如何影响模型性能。应用程序不可静力的功能允许模型概括其检测能力，以检测以前看不见的应用程序中的ROP。使用OpCode和Operand序列的模型获得了98.21％的交叉验证精度和97.94％的测试精度。相反，使用地址值获得的模型获得了92.79％的交叉验证精度，其测试集精度为99.59％。这项研究还分析了ROP剥削是否显着影响分支的预测。实验证据表明确实如此。因此，分支预测行为可能是检测ROP利用的有价值特征。
An increasing number of embedded systems include dedicated neural hardware. To benefit from this specialized hardware, deep learning techniques to discover malware on embedded systems are needed. This effort evaluated candidate machine learning detection techniques for distinguishing exploited from non-exploited RISC-V program behavior using execution traces. We first developed a dataset of execution traces containing Return Oriented Programming (ROP) exploitation on the RISC-V Instruction Set Architecture (ISA) and then developed several deep learning bidirectional Long Short-Term Memory (LSTM) models capable of distinguishing exploited traces from non-exploited traces, each using subsets of features from the execution traces. An objective of this effort was to evaluate which features (instruction addresses and immediate values) from an execution trace are application-specific, which features (opcodes and operands) are application-agnostic, and how these subsets of features affect model performance. Application-agnostic features allow a model to generalize its detection capability to detecting ROP in previously unseen applications. The model using opcode and operand sequences obtained 98.21% cross validation accuracy and 97.94% test accuracy. In contrast, a model using address values obtained 92.79% cross validation accuracy with 99.59% test set accuracy. This research also analyzed whether ROP exploitation significantly affects branch prediction; experimental evidence suggests that it does. Thus, branch prediction behavior could be a valuable feature in detecting ROP exploits.