RNN을 이용한 코드 재사용 공격 탐지 방법 연구 = Detecting code reuse attack using RNN

다국어 초록 (Multilingual Abstract)

A code reuse attack is an attack technique that can execute arbitrary code without injecting code directly into the stack by combining executable code fragments existing in program memory and executing them continuously. ROP(Return-Oriented Programming) attack is typical type of code reuse attack and serveral defense techniques have been proposed to deal with this. However, since existing methods use Rule-based method to detect attacks based on specific rules, there is a limitation that ROP attacks that do not correspond to previously defined rules can not be detected. In this paper, we introduce a method to detect ROP attack by learning command pattern used in ROP attack code using RNN(Recurrent Neural Network). We also show that the proposed method effectively detects ROP attacks by measuring False Positive Ratio, False Negative Ratio, and Accuracy for normal code and ROP attack code discrimination.

참고문헌 (Reference)

1 H.Shacham, "The Geometry of Innocent Flesh on the Bone: Return-into-libc without Function Calls (on the x86)" 552-556, 2007

2 K. Yao, "Spoken Language Understanding Using Long Short-Term Memory Neural Network" 2014

3 P.Bania, "Security Mitigations for Return-Oriented Programming Attacks"

4 M. Kayaalp, "Scrap: Architecture for signature-based protection from code reuse attacks" 2013

5 K. Yao, "Recurrent Conditional Random Field For Language Understanding" 2014

6 CK. Luk, "Pin: Building customized program analysis tools with dynamic instrumentation" 190-200, 2005

7 S. Hochreiter, "Long Short-Term Memory" 1997

8 K. Cho, "Learning phrase representations using RNN encoder-decoder for statistical machine translation" 1724-1734, 2014

9 K. Onarlioglu, "G-free: Defeating return-oriented programming through gadget-less binaries" 49-58, 2010

10 J. Li, "Defeating return-oriented rootkits with return-less kernels" 2010

11 Microsoft, "Data Execution Prevention(DEP)"

12 P. Chen, "DROP: Detecting return-oriented programming malicious code" LNCS 5905 : 163-177, 2009

13 P. J. Werbos, "Backpropagation through time: what it does and how to do it" 1990