[Paper Review] SIGDROP: Signature-based ROP Detection using Hardware Performance Counters

Xueyang Wang, Jerry Backer|arXiv (Cornell University)|Sep 9, 2016

Security and Verification in Computing15 references19 citations

TL;DR

SIGDROP is a low-overhead, hardware-based ROP detection mechanism that leverages commodity processor Hardware Performance Counters (HPCs) to detect return-oriented programming (ROP) attacks by identifying unique patterns in hardware event counts—specifically, high return misprediction rates and frequent short gadget sequences. It achieves effective ROP detection with only 4.67% average performance overhead and negligible storage costs, without requiring source code, binary modifications, or hardware changes.

ABSTRACT

Return-Oriented Programming (ROP) is a software exploit for system compromise. By chaining short instruction sequences from existing code pieces, ROP can bypass static code-integrity checking approaches and non-executable page protections. Existing defenses either require access to source code or binary, a customized compiler or hardware modifications, or suffer from high performance and storage overhead. In this work, we propose SIGDROP, a low-cost approach for ROP detection which uses low-level properties inherent to ROP attacks. Specifically, we observe special patterns of certain hardware events when a ROP attack occurs during program execution. Such hardware event-based patterns form signatures to flag ROP attacks at runtime. SIGDROP leverages Hardware Performance Counters, which are already present in commodity processors, to efficiently capture and extract the signatures. Our evaluation demonstrates that SIGDROP can effectively detect ROP attacks with acceptable performance overhead and negligible storage overhead.

Motivation & Objective

• To address the limitations of existing ROP detection mechanisms, such as high performance and storage overhead, reliance on source code, or need for hardware modifications.
• To identify low-level, inherent runtime properties of ROP attacks that can be exploited for detection without modifying software or hardware.
• To design a portable, efficient, and practical ROP detection solution that works across commodity platforms including embedded systems.
• To minimize performance and storage overhead while maintaining strong detection accuracy for ROP payloads.
• To enable runtime detection of ROP attacks using only existing hardware features—specifically, Hardware Performance Counters—without binary instrumentation or custom compiler support.

Proposed method

• SIGDROP monitors specific hardware performance counters (HPCs) related to return instruction execution and branch prediction events during program execution.
• It extracts runtime signatures based on the frequency of return mispredictions and the distribution of instruction counts per gadget in short, chained sequences.
• The system uses threshold-based detection: if the number of return mispredictions per monitoring interval exceeds a predefined threshold $T_M$, or if the number of short gadgets per interval exceeds $T_I$, a potential ROP attack is flagged.
• The detection logic is based on two intrinsic properties of ROP: (1) a high frequency of short gadgets (few instructions per gadget), and (2) frequent return mispredictions due to incorrect return target prediction.
• SIGDROP operates at runtime without modifying the binary or source code, relying solely on HPC sampling and threshold comparison.
• It is implemented as a lightweight runtime module on Linux, interfacing with the kernel to collect HPC data and notify a trusted module upon signature match.

Experimental results

Research questions

• RQ1 Can ROP attacks be reliably detected using only low-level hardware performance counter events without source code or binary instrumentation?
• RQ2 What specific hardware event patterns are consistently present during ROP execution that can serve as a runtime signature for detection?
• RQ3 Can a signature-based detection mechanism using commodity HPCs achieve low performance and storage overhead while maintaining high detection accuracy?
• RQ4 How does the performance overhead of SIGDROP compare to existing CFI and binary instrumentation-based ROP detection solutions?
• RQ5 To what extent is SIGDROP portable across different processor architectures (e.g., Intel, AMD, ARM) without requiring hardware or software modifications?

Key findings

• SIGDROP detects ROP attacks with high accuracy by identifying characteristic patterns in hardware performance counter events, particularly return mispredictions and short gadget sequences.
• The average performance overhead of SIGDROP is only 4.67% across integer SPEC CPU 2006 benchmarks, significantly lower than ROPDefender’s 2.17x overhead.
• The storage overhead is negligible—only 3 bytes per monitored process are needed to store event counts and thresholds, with each threshold requiring just one byte.
• SIGDROP is fully portable across commodity platforms, including desktops, laptops, and embedded systems, due to its reliance on widely available HPCs.
• The approach does not require source code, binary rewriting, or hardware modifications, making it practical for real-world deployment on existing systems.
• The detection mechanism is robust against information leakage and JIT ROP attacks, as it relies on intrinsic runtime behavior rather than memory layout assumptions.