HDROP: Detecting ROP Attacks Using Performance Monitoring Counters

Combining short instruction sequences originated only from existing code pieces, Return Oriented Programming (ROP) attacks can bypass the code-integrity effort model. To defeat this kind of attacks, current approaches check every instruction executed on a processor, which results in heavy performance overheads. In this paper, we propose an innovative approach, called HDROP, to detecting the attacks. It utilizes the observation that ROP attacks often make branch predictor in modern processors fail to determine the accurate branch destination. With the support of PMC (Performance Monitoring Counters) that is capable of counting performance events, we catch the abnormal increase in branch mis-prediction and detect the existence of ROP attacks. In HDROP, each basic unit being checked consists of hundreds of instructions rather than a single one, which effectively avoids significant performance overheads. The prototype system we developed on commodity hardware shows that HDROP succeeds in detecting ROP attacks, and the performance tests demonstrate that our approach has acceptably lower overheads.