.png){kind=icon}
返回
Identification of Return-Oriented Programming Attacks Using RISC-V Instruction Trace Data
.png){kind=icon}
OA
AI
DOI：10.1109/ACCESS.2022.3170479.png)
.png){kind=icon}
原文求助.png){kind=icon}
分享.png){kind=icon}
收藏
摘要
En 中文
An increasing number of embedded systems include dedicated neural hardware. To benefit from this specialized hardware, deep learning techniques to discover malware on embedded systems are needed. This effort evaluated candidate machine learning detection techniques for distinguishing exploited from non-exploited RISC-V program behavior using execution traces. We first developed a dataset of execution traces containing Return Oriented Programming (ROP) exploitation on the RISC-V Instruction Set Architecture (ISA) and then developed several deep learning bidirectional Long Short-Term Memory (LSTM) models capable of distinguishing exploited traces from non-exploited traces, each using subsets of features from the execution traces. An objective of this effort was to evaluate which features (instruction addresses and immediate values) from an execution trace are application-specific, which features (opcodes and operands) are application-agnostic, and how these subsets of features affect model performance. Application-agnostic features allow a model to generalize its detection capability to detecting ROP in previously unseen applications. The model using opcode and operand sequences obtained 98.21% cross validation accuracy and 97.94% test accuracy. In contrast, a model using address values obtained 92.79% cross validation accuracy with 99.59% test set accuracy. This research also analyzed whether ROPs exploitation significantly affects branch prediction; experimental evidence suggests that it does. Thus, branch prediction behavior could be a valuable feature in detecting ROPs exploits.
Keyword:
Malware
Program processors
Hardware
Embedded systems
Codes
Registers
Deep learning
Computational and artificial intelligence
recurrent neural networks
computer viruses
embedded software
computer architecture
RISC-V
期刊
IF:
3.6
论文数:
9.8W
被引数:
29.4W
机构
引用论文
分享收藏Targeted Ransomware: A New Cyber Threat to Edge System of Brownfield Industrial Internet of Things
PREAI
分享收藏Delayed metamorphosis by larvae of benthic marine invertebrates: Does it occur? Is there a price to pay?.png)
Ophelia
OpheliaIF0
PREAI
分享收藏Visualization and deep-learning-based malware variant detection using OpCode-level features使用操作码级功能的可视化和基于深度学习的恶意软件变体检测
PREAI
分享收藏
查看更多内容