微信服务号

微信订阅号

2025年4月3日 13:05 星期四
首页 > 过刊浏览>2023年第34卷第1期 >489-508. DOI:10.13328/j.cnki.jos.006436
PDF HTML阅读 XML下载 导出引用 引用提醒
进程控制流完整性保护技术综述
作者:
作者简介:

张正(1993－), 男, 博士生, 主要研究领域为系统安全;薛静锋(1975－), 男, 博士, 教授, 博士生导师, 主要研究领域为网络安全, 数据安全, 软件安全, 软件测试;张静慈(1991－), 女, 博士生, 主要研究领域为网络安全;陈田(1995－), 男, 博士生, 主要研究领域为系统安全;谭毓安(1972－), 男, 博士, 教授, 博士生导师, CCF高级会员, 主要研究领域为Android安全, 深度学习及对抗, 物联网与嵌入式系统, 数据存储安全;李元章(1978－), 男, 博士, 副教授, CCF专业会员, 主要研究领域为信息安全, 嵌入式技术.;张全新(1974－), 男, 博士, 副教授, 主要研究领域为深度学习及其对抗技术, 计算机视觉安全, 信息安全.

通讯作者:

张全新,E-mail:zhangqx@bit.edu.cn

基金项目:

国家自然科学基金(U1936218, 62072037); 之江实验室开放课题(2020LE0AB02)


Survey on Control-flow Integrity Techniques
Author:
  • 摘要
    • | |
  • 访问统计
    • |
  • 参考文献 [113]
    • |
  • 相似文献 [20]
    • |
  • 引证文献
    • | |
  • 文章评论
    摘要:

    控制流劫持攻击利用程序内存漏洞获取程序的控制权, 进而控制程序执行恶意代码, 对系统安全造成极大的威胁. 为了应对控制流劫持攻击, 研究人员提出了一系列的防御手段. 控制流完整性是一种运行时防御方法, 通过阻止进程控制流的非法转移, 来确保控制流始终处于程序要求的范围之内. 近年来, 越来越多的研究致力于解决控制流完整性的相关问题, 例如提出新的控制流完整性方案、新的控制流完整性方案评估方法等. 首先阐述了控制流完整性的基本原理, 然后对现有控制流完整性方案进行了分类, 并分别进行了分析, 同时介绍了现有针对控制流完整性方案的评估方法与评价指标. 最后, 对控制流完整性的未来工作进行了展望, 以期对未来的控制流完整性研究提供参考.

    Abstract:

    Control-flow hijacking attacks exploit memory corruption vulnerabilities to grab control of the program, and then hijack the program to execute malicious code, which brings a great threat to system security. In order to prevent control-flow hijacking attacks, researchers have presented a series of defense methods. Control-flow integrity is a runtime defense method that prevents illegal transfer of process control-flow to ensure that control-flow is always within the range required by the program. In recent years, more and more research works are devoted to solving related problems of control-flow integrity, such as presenting new control-flow integrity schemes, new control-flow integrity scheme evaluation methods, etc. This study explains the basic principles of control flow integrity, and then classifies existing control flow integrity schemes. The existing evaluation methods and evaluation indicators of the control-flow integrity scheme are introduced at the same time. Finally, the thoughts on potential future work on control-flow integrity is summarized, which, hopefully, will provide an outlook of the research direction in the future.

    参考文献
    [1] 司徒凌云, 王林章, 李宣东, 刘杨. 基于应用视角的缓冲区溢出检测技术与工具. 软件学报, 2019, 30(6):1721-1741. http://www.jos.org.cn/1000-9825/5491.htm
    Situ LY, Wang LZ, Li XD, Liu Y. Buffer overflow detection techniques and tools based on application perspective. Ruan Jian Xue Bao/Journal of Software, 2019, 30(6):1721-1741 (in Chinese with English abstract). http://www.jos.org.cn/1000-9825/5491.htm
    [2] 王丰峰, 张涛, 徐伟光, 孙蒙. 进程控制流劫持攻击与防御技术综述. 网络与信息安全学报, 2019, 5(6):10-20.[doi:10.11959/j.issn.2096-109x.2019058]
    Wang FF, Zhang T, Xu WG, Sun M. Overview of control-flow hijacking attack and defense techniques for process. Chinese Journal of Network and Information Security, 2019, 5(6):10-20 (in Chinese with English abstract).[doi:10.11959/j.issn.2096-109x.2019058]
    [3] Microsoft. Data Execution Prevention (DEP). 2006. https://web.archive.org/web/20140911011045/http://support.microsoft.com/kb/875352/en-us
    [4] Team P. PaX address space layout randomization (ASLR). 2003. http://pax.grsecurity.net/docs/aslr.txt
    [5] Cowan C, Pu C, Maier D, Hintony H, Walpole J, Bakke P, Beattie S, Grier A, Wagle P, Zhang Q. StackGuard:Automatic adaptive detection and prevention of buffer-overflow attacks. In:Proc. of the 7th Conf. on USENIX Security Symp. San Antonio:ACM, 1998. 5.
    [6] Ray D, Ligatti J. Defining code-injection attacks. ACM SIGPLAN Notices, 2012, 47(1):179-190.[doi:10.1145/2103621.2103678]
    [7] Shacham H. The geometry of innocent flesh on the bone:Return-into-libc without function calls (on the x86). In:Proc. of the 14th ACM Conf. on Computer and Communications Security. Alexandria:Association for Computing Machinery, 2007. 552-561.
    [8] Roemer R, Buchanan E, Shacham H, Savage S. Return-oriented programming:Systems, languages, and applications. ACM Transactions on Information and System Security, 2012, 15(1):2.[doi:10.1145/2133375.2133377]
    [9] Bletsch T, Jiang XX, Freeh VW, Liang ZK. Jump-oriented programming:A new class of code-reuse attack. In:Proc. of the 6th ACM Symp. on Information, Computer and Communications Security. Hong Kong:Association for Computing Machinery, 2011. 30-40.
    [10] Snow KZ, Monrose F, Davi L, Dmitrienko A, Liebchen C, Sadeghi AR. Just-in-time code reuse:On the effectiveness of fine-grained address space layout randomization. In:Proc. of the 2013 IEEE Symp. on Security and Privacy. Berkeley:IEEE, 2013. 574-588.
    [11] Abadi M, Budiu M, Erlingsson Ú, Ligatti J. Control-flow integrity. In:Proc. of the 12th ACM Conf. on Computer and Communications Security. Alexandria:ACM, 2005. 340-353.
    [12] Burow N, Carr SA, Nash J, Larsen P, Franz M, Brunthaler S, Payer M. Control-flow integrity:Precision, security, and performance. ACM Computing Surveys, 2018, 50(1):16.[doi:10.1145/3054924]
    [13] de Clercq R, Verbauwhede I. A survey of hardware-based control flow integrity (CFI). arXiv:1706.07257, 2017.
    [14] 武成岗, 李建军. 控制流完整性的发展历程. 中国教育网络, 2016, (4):52-55.[doi:10.3969/j.issn.1672-9781.2016.04.031]
    Wu CG, Li JJ. Evolution of control flow integrity. China Education Network, 2016, (4):52-55 (in Chinese with English abstract).[doi:10.3969/j.issn.1672-9781.2016.04.031]
    [15] van der Veen V, Andriesse D, Göktaş E, Gras B, Sambuc L, Slowinska A, Bos H, Giuffrida C. Practical context-sensitive CFI. In:Proc. of the 22nd ACM SIGSAC Conf. on Computer and Communications Security. Denver:ACM, 2015. 927-940.
    [16] Wang Z, Jiang XX. Hypersafe:A lightweight approach to provide lifetime hypervisor control-flow integrity. In:Proc. of the 2010 IEEE Symp. on Security and Privacy. Oakland:IEEE, 2010. 380-395.
    [17] Niu B, Tan G. Monitor integrity protection with space efficiency and separate compilation. In:Proc. of the 2013 ACM SIGSAC Conf. on Computer & Communications Security. Berlin:ACM, 2013. 199-210.
    [18] Niu B, Tan G. Modular control-flow integrity. In:Proc. of the 35th ACM SIGPLAN Conf. on Programming Language Design and Implementation. New York:ACM, 2014. 577-587.
    [19] Tice C, Roeder T, Collingbourne P, Checkoway S, Erlingsson Ú, Lozano L, Pike G. Enforcing forward-edge control-flow integrity in GCC & LLVM. In:Proc. of the 23rd USENIX Security Symp. San Diego:USENIX, 2014. 941-955.
    [20] Criswell J, Dautenhahn N, Adve V. KCoFI:Complete control-flow integrity for commodity operating system kernels. In:Proc. of the 2014 IEEE Symp. on Security and Privacy. Berkeley:IEEE, 2014. 292-307.
    [21] Niu B, Tan G. RockJIT:Securing just-in-time compilation using modular control-flow integrity. In:Proc. of the 2014 ACM SIGSAC Conf. on Computer and Communications Security. Scottsdale:ACM, 2014. 1317-1328.
    [22] Zhang C, Niknami M, Chen KZ, Song CY, Chen ZF, Song D. JITScope:Protecting Web users from control-flow hijacking attacks. In:Proc. of the 2015 IEEE Conf. on Computer Communications (INFOCOM). Hong Kong:IEEE, 2015. 567-575.
    [23] Niu B, Tan G. Per-input control-flow integrity. In:Proc. of the 22nd ACM SIGSAC Conf. on Computer and Communications Security. Denver:ACM, 2015. 914-926.
    [24] Li JK, Tong XM, Zhang FW, Ma JF. Fine-CFI:Fine-grained control-flow integrity for operating system kernels. IEEE Transactions on Information Forensics and Security, 2018, 13(6):1535-1550.[doi:10.1109/TIFS.2018.2797932]
    [25] Jang H, Park MC, Lee DH. IBV-CFI:Efficient fine-grained control-flow integrity preserving CFG precision. Computers & Security, 2020, 94:101828.
    [26] Davi L, Dmitrienko A, Egele M, Fischer T, Holz T, Hund R, Nürnberger S, Sadeghi AR. MoCFI:A framework to mitigate control-flow attacks on smartphones. In:Proc. of the NDSS Symp. 2012. NDSS, 2012. 27-40.
    [27] Zhang C, Wei T, Chen ZF, Duan L, Szekeres L, McCamant S, Song D, Zou W. Practical control flow integrity and randomization for binary executables. In:Proc. of the 2013 IEEE Symp. on Security and Privacy. Berkeley:IEEE, 2013. 559-573.
    [28] Zhang MW, Sekar R. Control flow integrity for COTS binaries. In:Proc. of the 22nd USENIX Security Symp. Washington:USENIX, 2013. 337-352.
    [29] Wang MH, Yin H, Bhaskar AV, Su PR, Feng DG. Binary code continent:Finer-grained control flow integrity for stripped binaries. In:Proc. of the 31st Annual Computer Security Applications Conf. Los Angeles:ACM, 2015. 331-340.
    [30] Mohan V, Larsen P, Brunthaler S, Hamlen KW, Franz M. Opaque control-flow integrity. In:Proc. of the NDSS Symp. 2015. San Dicgo:NDSS, 2015. 27-30.
    [31] Payer M, Barresi A, Gross TR. Fine-grained control-flow integrity through binary hardening. In:Proc. of the 12th Int'l Conf. on Detection of Intrusions and Malware, and Vulnerability Assessment. Milan:Springer, 2015. 144-164.
    [32] van der Veen V, Göktas E, Contag M, Pawoloski A, Chen X, Rawat S, Bos H, Holz T, Athanasopoulos E, Giuffrida C. A tough call:Mitigating advanced code-reuse attacks at the binary level. In:Proc. of the 2016 IEEE Symp. on Security and Privacy (SP). San Jose:IEEE, 2016. 934-953.
    [33] Muntean P, Fischer M, Tan G, Lin ZQ, Grossklags J, Eckert C. τCFI:Type-assisted control flow integrity for x86-64 binaries. In:Proc. of the 21st Int'l Symp. on Research in Attacks, Intrusions, and Defenses. Heraklion:Springer, 2018. 423-444.
    [34] Walls RJ, Brown NF, Le Baron T, Shue CA, Okhravi H, Ward BC. Control-flow integrity for real-time embedded systems. In:Proc. of the 31st Euromicro Conf. on Real-time Systems (ECRTS 2019). Dagstuhl:Schloss Dagstuhl-Leibniz-Zentrum fuer Informatik, 2019. 2.
    [35] Xia YB, Liu YT, Chen HB, Zang BY. CFIMon:Detecting violation of control flow integrity using performance counters. In:Proc. of the IEEE/IFIP Int'l Conf. on Dependable Systems and Networks (DSN 2012). Boston:IEEE, 2012. 1-12.
    [36] Pappas V, Polychronakis M, Keromytis AD. Transparent ROP exploit mitigation using indirect branch tracing. In:Proc. of the 22nd USENIX Security Symp. Washington:USENIX, 2013. 447-462.
    [37] Cheng YQ, Zhou ZW, Yu M, Ding XH, Deng RH. ROPecker:A generic and practical approach for defending against ROP attack. In:Proc. of the 2014 NDSS Symp. San Diego:NDSS, 2014.
    [38] Yuan PH, Zeng QK, Ding XH. Hardware-assisted fine-grained code-reuse attack detection. In:Proc. of the 18th Int'l Symp. on Research in Attacks, Intrusions, and Defenses. Kyoto:Springer, 2015. 66-85.
    [39] Gu YF, Zhao QC, Zhang YQ, Lin ZQ. PT-CFI:Transparent backward-edge control flow violation detection using intel processor trace. In:Proc. of the 7th ACM on Conf. on Data and Application Security and Privacy. Scottsdale:ACM, 2017. 173-184.
    [40] Hu H, Qian CX, Yagemann C, Chung SPH, Harris WR, Kim T, Lee W. Enforcing unique code target property for control-flow integrity. In:Proc. of the 2018 ACM SIGSAC Conf. on Computer and Communications Security. Toronto:ACM, 2018. 1470-1486.
    [41] Zhang JL, Qi BH, Qin Z, Qu G. HCIC:Hardware-assisted control-flow integrity checking. IEEE Internet of Things Journal, 2019, 6(1):458-471.[doi:10.1109/JIOT.2018.2866164]
    [42] Liljestrand H, Nyman T, Wang K, Perez CC, Ekberg JE, Asokan N. PAC it up:Towards pointer integrity using ARM pointer authentication. In:Proc. of the 28th USENIX Security Symp. Santa Clara:USENIX Association, 2019. 177-194.
    [43] Li JF, Chen LW, Shi G, Chen K, Meng D. ABCFI:Fast and lightweight fine-grained hardware-assisted control-flow integrity. IEEE Transactions on Computer-Aided Design of Integrated Circuits and Systems, 2020, 39(11):3165-3176.[doi:10.1109/TCAD.2020.3012640]
    [44] Koruyeh EM, Shirazi SHA, Khasawneh KN, Song CY, Abu-Ghazaleh N. SpecCFI:Mitigating spectre attacks using CFI informed speculation. In:Proc. of the 2020 IEEE Symp. on Security and Privacy (SP). San Francisco:IEEE, 2020. 39-53.
    [45] Feng L, Huang J, Hu J, Reddy A. FastCFI:Real-time control-flow integrity using FPGA without code instrumentation. ACM Transactions on Design Automation of Electronic Systems, 2021, 26(5):39.[doi:10.1145/3458471]
    [46] Ding R, Qian CX, Song CY, Harris B, Kim T, Lee W. Efficient protection of path-sensitive control security. In:Proc. of the 26th USENIX Conf. on Security Symp. Vancouver:ACM, 2017. 131-148.
    [47] Khandaker MR, Liu WQ, Naser A, Wang Z, Yang J. Origin-sensitive control flow integrity. In:Proc. of the 28th USENIX Security Symp. Santa Clara:USENIX, 2019. 195-211.
    [48] Khandaker M, Naser A, Liu WQ, Wang Z, Zhou YJ, Cheng YQ. Adaptive call-site sensitive control flow integrity. In:Proc. of the 2019 IEEE European Symp. on Security and Privacy (EuroS&P). Stockholm:IEEE, 2019. 95-110.
    [49] Wang Y, Li QB, Chen ZF, Zhang P, Zhang GM, Shi ZH. BCI-CFI:A context-sensitive control-flow integrity method based on branch correlation integrity. Information and Software Technology, 2021, 136:106572.[doi:10.1016/j.infsof.2021.106572]
    [50] Abadi M, Budiu M, Erlingsson Ú, Ligatti J. Control-flow integrity principles, implementations, and applications. ACM Transactions on Information and System Security, 2009, 13(1):4.[doi:10.1145/1609956.1609960]
    [51] Chiueh TC, Hsu FH. RAD:A compile-time solution to buffer overflow attacks. In:Proc. of the 21st Int'l Conf. on Distributed Computing Systems. Mesa:IEEE, 2001. 409-417.
    [52] The LLVM compiler infrastructure. 2010. http://llvm.org
    [53] Conti M, Crane S, Davi L, Franz M, Larsen P, Negro M, Liebchen C, Qunaibit M, Sadeghi AR. Losing control:On the effectiveness of control-flow integrity under stack attacks. In:Proc. of the 22nd ACM SIGSAC Conf. on Computer and Communications Security. Denver:ACM, 2015. 952-963.
    [54] Criswell J, Geoffray N, Adve VS. Memory safety for low-level software/hardware interactions. In:Proc. of the 18th USENIX Security Symp. Montreal:USENIX, 2009. 83-100.
    [55] Criswell J, Lenharth A, Dhurjati D, Adve V. Secure virtual architecture:A safe execution environment for commodity operating systems. In:Proc. of the 21st ACM SIGOPS Symp. on Operating Systems Principles. Washington:ACM, 2007. 351-366.
    [56] 陈志锋, 李清宝, 张平, 王烨. 面向Linux的内核级代码复用攻击检测技术. 软件学报, 2017, 28(7):1732-1745. http://www.jos.org.cn/1000-9825/5058.htm
    Chen ZF, Li QB, Zhang P, Wang Y. Kernel code reuse attack detection technique for linux. Ruan Jian Xue Bao/Journal of Software, 2017, 28(7):1732-1745 (in Chinese with English abstract). http://www.jos.org.cn/1000-9825/5058.htm
    [57] Blazakis D. Interpreter exploitation. In:Proc. of the 4th USENIX Workshop on Offensive Technologies (WOOT 2010). Washington:USENIX, 2010.
    [58] Yee B, Sehr D, Dardyk G, Chen JB, Muth R, Ormandy T, Okasaka S, Narula N, Fullagar N. Native client:A sandbox for portable, untrusted x86 native code. In:Proc. of the 30th IEEE Symp. on Security and Privacy. Oakland:IEEE, 2009. 79-93.
    [59] Ansel J, Marchenko P, Erlingsson U, Taylor E, Chen B, Schuff DL, Sehr D, Biffle CL, Yee B. Language-independent sandboxing of just-in-time compilation and self-modifying code. In:Proc. of the 32nd ACM SIGPLAN Conf. on Programming Language Design and Implementation. San Jose:ACM, 2011. 355-366.
    [60] Wahbe R, Lucco S, Anderson TE, Graham SL. Efficient software-based fault isolation. In:Proc. of the 14th ACM Symp. on Operating Systems Principles. Asheville:ACM, 1994. 203-216.
    [61] Erlingsson Ú, Abadi M, Vrable M, Budiu M, Necula GC. XFI:Software guards for system address spaces. In:Proc. of the 7th USENIX Symp. on Operating Systems Design and Implementation. USENIX, 2006. 75-88.
    [62] Schuster F, Tendyck T, Liebchen C, Davi L, Sadeghi AR, Holz T. Counterfeit object-oriented programming:On the difficulty of preventing code reuse attacks in C++ applications. In:Proc. of the 2015 IEEE Symp. on Security and Privacy. San Jose:IEEE, 2015. 745-762.
    [63] 李威威, 马越, 王俊杰, 高伟毅, 杨秋松, 李明树. 基于硬件分支信息的ROP攻击检测方法. 软件学报, 2020, 31(11):3588-3602. http://www.jos.org.cn/1000-9825/5829.htm
    Li WW, Ma Y, Wang JJ, Gao WY, Yang QS, Li MS. ROP attack detection approach based on hardware branch information. Ruan Jian Xue Bao/Journal of Software, 2020, 31(11):3588-3602 (in Chinese with English abstract). http://www.jos.org.cn/1000-9825/5829.htm
    [64] 王心然, 刘宇涛, 陈海波. 基于IPT硬件的内核模块ROP透明保护机制. 软件学报, 2018, 29(5):1333-1347. http://www.jos.org.cn/1000-9825/5496.htm
    Wang XR, Liu YT, Chen HB. Transparent protection of kernel module against ROP with intel processor trace. Ruan Jian Xue Bao/Journal of Software, 2018, 29(5):1333-1347 (in Chinese with English abstract). http://www.jos.org.cn/1000-9825/5496.htm
    [65] Qiu PF, Lyu YQ, Zhai D, Wang DS, Zhang JL, Wang XW, Qu G. Physical unclonable functions-based linear encryption against code reuse attacks. In:Proc. of the 53rd ACM/EDAC/IEEE Design Automation Conf. (DAC). Austin:IEEE, 2016. 75.
    [66] Mashtizadeh AJ, Bittau A, Boneh D, Mazières D. CCFI:Cryptographically enforced control flow integrity. In:Proc. of the 22nd ACM SIGSAC Conf. on Computer and Communications Security. Denver:ACM, 2015. 941-951.
    [67] Qiu PF, Lyu YQ, Zhang JL, Wang DS, Qu G. Control flow integrity based on lightweight encryption architecture. IEEE Transactions on Computer-Aided Design of Integrated Circuits and Systems, 2018, 37(7):1358-1369.[doi:10.1109/TCAD.2017.2748000]
    [68] Davi L, Koeberl P, Sadeghi AR. Hardware-assisted fine-grained control-flow integrity:Towards efficient protection of embedded systems against software exploitation. In:Proc. of the 51st ACM/EDAC/IEEE Design Automation Conf. (DAC). San Francisco:IEEE, 2014. 1-6.
    [69] Davi L, Hanreich M, Paul D, Sadeghi AR, Koeberl P, Sullivan D, Arias O, Jin Y. HAFIX:Hardware-assisted flow integrity extension. In:Proc. of the 52nd ACM/EDAC/IEEE Design Automation Conf. (DAC). San Francisco:IEEE, 2015. 1-6.
    [70] Christoulakis N, Christou G, Athanasopoulos E, Ioannidis S. HCFI:Hardware-enforced control-flow integrity. In:Proc. of the 6th ACM Conf. on Data and Application Security and Privacy. New Orleans:ACM, 2016. 38-49.
    [71] Muench M, Pagani F, Shoshitaishvili Y, Kruegel C, Vigna G, Balzarotti D. Taming transactions:Towards hardware-assisted control flow integrity using transactional memory. In:Proc. of the 19th Int'l Symp. on Research in Attacks, Intrusions, and Defenses. Paris:Springer, 2016. 24-48.
    [72] INTEL. Intel® 64 and ia-32 architectures software developer's manual. Volume 3B:System Programming Guide, Part 2, 2021.
    [73] Ge XY, Cui WD, Jaeger T. GRIFFIN:Guarding control flows using intel processor trace. ACM SIGPLAN Notices, 2017, 52(4):585-598.[doi:10.1145/3093336.3037716]
    [74] Carlini N, Wagner D. ROP is still dangerous:Breaking modern defenses. In:Proc. of the 23rd USENIX Security Symp. San Diego:USENIX, 2014. 385-399.
    [75] Davi L, Sadeghi AR, Lehmann D, Monrose F. Stitching the gadgets:On the ineffectiveness of coarse-grained control-flow integrity protection. In:Proc. of the 23rd USENIX Conf. on Security Symp. San Diego:ACM, 2014. 401-416.
    [76] Evans I, Long F, Otgonbaatar U, Shrobe H, Rinard M, Okhravi H, Sidiroglou-Douskos S. Control Jujutsu:On the weaknesses of fine-grained control flow integrity. In:Proc. of the 22nd ACM SIGSAC Conf. on Computer and Communications Security. Denver:ACM, 2015. 901-913.
    [77] Göktas E, Athanasopoulos E, Bos H, Portokalidis G. Out of control:Overcoming control-flow integrity. In:Proc. of the 2014 IEEE Symp. on Security and Privacy. Berkeley:IEEE, 2014. 575-589.
    [78] Carlini N, Barresi A, Payer M, Wagner D, Gross TR. Control-flow bending:On the effectiveness of control-flow integrity. In:Proc. of the 24th USENIX Security Symp. Washington:USENIX, 2015. 161-176.
    [79] Burow N, McKee D, Carr SA, Payer M. CFIXX:Object type integrity for C++ virtual dispatch. In:Proc. of the Symp. on Network and Distributed System Security (NDSS). San Diego:NDSS, 2018.
    [80] Ge XY, Talele N, Payer M, Jaeger T. Fine-grained control-flow integrity for kernel software. In:Proc. of the 2016 IEEE European Symp. on Security and Privacy (EuroS&P). Saarbruecken:IEEE, 2016. 179-194.
    [81] Xu XY, Ghaffarinia M, Wang WH, Hamlen KW, Lin ZQ. CONFIRM:Evaluating compatibility and relevance of control-flow integrity protections for modern software. In:Proc. of the 28th USENIX Security Symp. Santa Clara:USENIX, 2019. 1805-1821.
    [82] Muntean P, Neumayer M, Lin ZQ, Tan G, Grossklags J, Eckert C. Analyzing control flow integrity with LLVM-CFI. In:Proc. of the 35th Annual Computer Security Applications Conf. San Juan:ACM, 2019. 584-597.
    [83] Li Y, Wang MZ, Zhang C, Chen XM, Yang ST, Liu Y. Finding cracks in shields:On the security of control flow integrity mechanisms. In:Proc. of the 2020 ACM SIGSAC Conf. on Computer and Communications Security. ACM, 2020. 1821-1835.
    [84] Henning JL. SPEC CPU2000:Measuring CPU performance in the new millennium. Computer, 2000, 33(7):28-35.[doi:10.1109/2.869367]
    [85] Henning JL. SPEC CPU2006 benchmark descriptions. ACM SIGARCH Computer Architecture News, 2006, 34(4):1-17.[doi:10.1145/1186736.1186737]
    [86] Bucek J, Lange KD, Kistowski JV. SPEC CPU2017:Next-generation compute benchmark. In:Proc. of the 2018 ACM/SPEC Int'l Conf. on Performance Engineering. Berlin:ACM, 2018. 41-42.
    [87] Kwon D, Seo J, Baek S, Kim G, Ahn S, Paek Y. VM-CFI:Control-flow integrity for virtual machine kernel using Intel PT. In:Proc. of the 18th Int'l Conf. on Computational Science and Its Applications. Melbourne:Springer, 2018. 127-137.
    [88] Pewny J, Holz T. Control-flow restrictor:Compiler-based CFI for iOS. In:Proc. of the 29th Annual Computer Security Applications Conf. Louisiana, 2013. 309-318.
    [89] Abbasi A, Holz T, Zambon E, Etalle S. ECFI:Asynchronous control flow integrity for programmable logic controllers. In:Proc. of the 33rd Annual Computer Security Applications Conf. Orlando:ACM, 2017. 437-448.
    [90] Abera T, Asokan N, Davi L, Ekberg JE, Nyman T, Paverd A, Sadeghi AR, Tsudik G. C-FLAT:Control-flow attestation for embedded systems software. In:Proc. of the 2016 ACM SIGSAC Conf. on Computer and Communications Security. Vienna:ACM, 2016. 743-754.
    [91] Adepu S, Brasser F, Garcia L, Rodler M, Davi L, Sadeghi AR, Zonouz S. Control behavior integrity for distributed cyber-physical systems. In:Proc. of the 11th ACM/IEEE Int'l Conf. on Cyber-physical Systems (ICCPS). Sydney:IEEE, 2020. 30-40.
    [92] Das S, Zhang W, Liu Y. A fine-grained control flow integrity approach against runtime memory attacks for embedded systems. IEEE Transactions on Very Large Scale Integration (VLSI) Systems, 2016, 24(11):3193-3207.[doi:10.1109/TVLSI.2016.2548561]
    [93] Werner M, Unterluggauer T, Schaffenrath D, Mangard S. Sponge-based control-flow protection for iot devices. In:Proc. of the 2018 IEEE European Symp. on Security and Privacy (EuroS&P). London:IEEE, 2018. 214-226.
    [94] Nyman T, Ekberg JE, Davi L, Asokan N. CFI CaRE:Hardware-supported call and return enforcement for commercial microcontrollers. In:Proc. of the 20th Int'l Symp. on Research in Attacks, Intrusions, and Defenses. Atlanta:Springer, 2017. 259-284.
    [95] Kemerlis VP, Portokalidis G, Keromytis AD. kGuard:Lightweight kernel protection against return-to-user attacks. In:Proc. of the 21st USENIX Conf. on Security Symp. Bellevue:ACM, 2012. 39.
    [96] The Wine Committee. Wine. 2021. http://www.winehq.org
    [97] de Melo AC. Performance counters on linux. In:Proc. of the Linux Plumbers Conf. Portland, 2009.
    [98] Coker R. Disk performance benchmark tool-Bonnie. 2016. https://www.coker.com.au/bonnie++
    [99] Pozo R, Miller B. SciMark 2.0. 2016. http://math.nist.gov/scimark2
    [100] Albayraktaroglu K, Jaleel A, Wu X, Franklin M, Jacob B, Tseng CW, Yeung D. BioBench:A benchmark suite of bioinformatics applications. In:Proc. of the IEEE Int'l Symp. on Performance Analysis of Systems and Software. Austin:IEEE, 2005. 2-9.
    [101] Guthaus MR, Ringenberg JS, Ernst D, Austin TM, Mudge T, Brown RB. MiBench:A free, commercially representative embedded benchmark suite. In:Proc. of the 4th Annual IEEE Int'l Workshop on Workload Characterization. WWC-4 (Cat. No. 01EX538). Austin:IEEE, 2001. 3-14.
    [102] McCalpin JD. STREAM benchmark. 1995. http://www.cs.virginia.edu/stream/ref.html
    [103] Wilander J, Nikiforakis N, Younan Y, Kamkar M, Joosen W. RIPE:Runtime intrusion prevention evaluator. In:Proc. of the 27th Annual Computer Security Applications Conf. 2011. 41-50.
    [104] Cambridge. Exim. 2021. http://www.exim.org
    [105] Fitzpatrick B. Distributed caching with memcached. Linux Journal, 2004, 124. (查阅所有网上资料, 未找到卷期页码等信息, 请核对补充)
    [106] Farkhani RM, Jafari S, Arshad S, Robertson W, Kirda E, Okhravi H. On the effectiveness of type-based control flow integrity. In:Proc. of the 34th Annual Computer Security Applications Conf. San Juan:ACM, 2018. 28-39.
    [107] Wang WH, Xu XY, Hamlen KW. Object flow integrity. In:Proc. of the 2017 ACM SIGSAC Conf. on Computer and Communications Security. Dallas:ACM, 2017. 1909-1924.
    引证文献
引用本文

张正,薛静锋,张静慈,陈田,谭毓安,李元章,张全新.进程控制流完整性保护技术综述.软件学报,2023,34(1):489-508

复制
分享
文章指标
  • 点击次数:
  • 下载次数:
  • HTML阅读次数:
  • 引用次数:
历史
  • 收稿日期:2021-05-02
  • 最后修改日期:2021-06-24
  • 在线发布日期: 2022-09-30
  • 出版日期: 2023-01-06
文章二维码
友情链接:中国科学院软件研究所中国计算机学会中国科学院国家自然科学基金委员会CCF数字图书馆Int'l J of Softw Info计算机系统应用
您是第19780313位访问者
版权所有：中国科学院软件研究所 京ICP备05046678号-3
地址：北京市海淀区中关村南四街4号,邮政编码：100190
电话：010-62562563 传真：010-62562533 Email：jos@iscas.ac.cn
技术支持：北京勤云科技发展有限公司

京公网安备 11040202500063号