NG-MVEE: A New Proposed Hybrid Technique for Enhanced Mitigation of Code Re-Use Attack
Code-Reuse Attacks (CRAs) are solid mechanisms to bypass advanced software and hardware defenses because they use the software’s own code and they are very hard to be detected without significant overhead. Numerous methods have been proposed to protect against memory-based attacks that re...
| Main Authors: | , , , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
IEEE
2023-01-01
|
| Series: | IEEE Access |
| Subjects: | |
| Online Access: | https://ieeexplore.ieee.org/document/10107607/ |
| _version_ | 1827942783020695552 |
|---|---|
| author | Ayman M. El-Zoghby Mahmoud Said Elsayed Anca D. Jurcut Marianne A. Azer |
| author_facet | Ayman M. El-Zoghby Mahmoud Said Elsayed Anca D. Jurcut Marianne A. Azer |
| author_sort | Ayman M. El-Zoghby |
| collection | DOAJ |
| description | Code-Reuse Attacks (CRAs) are solid mechanisms to bypass advanced software and hardware defenses because they use the software’s own code and they are very hard to be detected without significant overhead. Numerous methods have been proposed to protect against memory-based attacks that result from reusing parts of the attacked binary code. In this paper, two problems were tackled. the first problem is the lack of a categorized survey, analysis, and evaluation of the different CRAs proposed in the literature. The second problem is the inherent vulnerability that exists in protection techniques that are based on Multi-Variant Execution Environment (MVEE) since they are using shared Linux libraries with gadget-prone codes. In the paper a novel framework of CRA mitigation is introduced; fusing the two different prominent techniques of control flow integrity and multi-variant execution environment. The novel mitigation technique, named Next Generation MVEE (NG-MVEE), was built upon an existing generic CRA detection system (GHUMVEE) and complemented with a different CRA detection technique (G-Free) in order to provide comprehensive protection against code-reuse attacks. The outcome of the hybrid system is an optimized hybrid version of an MVEE technique, with minimal performance overhead increase due to the added protection layer of the G-Free technique. A median of 7% performance overhead resulted from the proposed protection system. |
| first_indexed | 2024-03-13T10:04:31Z |
| format | Article |
| id | doaj.art-988a5f67d3ef4cdca16c16c2cb5d3810 |
| institution | Directory Open Access Journal |
| issn | 2169-3536 |
| language | English |
| last_indexed | 2024-03-13T10:04:31Z |
| publishDate | 2023-01-01 |
| publisher | IEEE |
| record_format | Article |
| series | IEEE Access |
| spelling | doaj.art-988a5f67d3ef4cdca16c16c2cb5d38102023-05-22T23:00:33ZengIEEEIEEE Access2169-35362023-01-0111481694819110.1109/ACCESS.2023.326988110107607NG-MVEE: A New Proposed Hybrid Technique for Enhanced Mitigation of Code Re-Use AttackAyman M. El-Zoghby0https://orcid.org/0009-0001-3517-8226Mahmoud Said Elsayed1https://orcid.org/0000-0003-2416-7481Anca D. Jurcut2https://orcid.org/0000-0002-2705-1823Marianne A. Azer3https://orcid.org/0000-0002-8068-5120School of Information Technology and Computer Science, Nile University, Cairo, EgyptSchool of Computer Science, University College Dublin, Dublin 4, IrelandSchool of Computer Science, University College Dublin, Dublin 4, IrelandSchool of Information Technology and Computer Science, Nile University, Cairo, EgyptCode-Reuse Attacks (CRAs) are solid mechanisms to bypass advanced software and hardware defenses because they use the software’s own code and they are very hard to be detected without significant overhead. Numerous methods have been proposed to protect against memory-based attacks that result from reusing parts of the attacked binary code. In this paper, two problems were tackled. the first problem is the lack of a categorized survey, analysis, and evaluation of the different CRAs proposed in the literature. The second problem is the inherent vulnerability that exists in protection techniques that are based on Multi-Variant Execution Environment (MVEE) since they are using shared Linux libraries with gadget-prone codes. In the paper a novel framework of CRA mitigation is introduced; fusing the two different prominent techniques of control flow integrity and multi-variant execution environment. The novel mitigation technique, named Next Generation MVEE (NG-MVEE), was built upon an existing generic CRA detection system (GHUMVEE) and complemented with a different CRA detection technique (G-Free) in order to provide comprehensive protection against code-reuse attacks. The outcome of the hybrid system is an optimized hybrid version of an MVEE technique, with minimal performance overhead increase due to the added protection layer of the G-Free technique. A median of 7% performance overhead resulted from the proposed protection system.https://ieeexplore.ieee.org/document/10107607/Code-reuse attacksexploit mitigationGHUMVEEG-Freehybrid-systemsoftware security |
| spellingShingle | Ayman M. El-Zoghby Mahmoud Said Elsayed Anca D. Jurcut Marianne A. Azer NG-MVEE: A New Proposed Hybrid Technique for Enhanced Mitigation of Code Re-Use Attack IEEE Access Code-reuse attacks exploit mitigation GHUMVEE G-Free hybrid-system software security |
| title | NG-MVEE: A New Proposed Hybrid Technique for Enhanced Mitigation of Code Re-Use Attack |
| title_full | NG-MVEE: A New Proposed Hybrid Technique for Enhanced Mitigation of Code Re-Use Attack |
| title_fullStr | NG-MVEE: A New Proposed Hybrid Technique for Enhanced Mitigation of Code Re-Use Attack |
| title_full_unstemmed | NG-MVEE: A New Proposed Hybrid Technique for Enhanced Mitigation of Code Re-Use Attack |
| title_short | NG-MVEE: A New Proposed Hybrid Technique for Enhanced Mitigation of Code Re-Use Attack |
| title_sort | ng mvee a new proposed hybrid technique for enhanced mitigation of code re use attack |
| topic | Code-reuse attacks exploit mitigation GHUMVEE G-Free hybrid-system software security |
| url | https://ieeexplore.ieee.org/document/10107607/ |
| work_keys_str_mv | AT aymanmelzoghby ngmveeanewproposedhybridtechniqueforenhancedmitigationofcodereuseattack AT mahmoudsaidelsayed ngmveeanewproposedhybridtechniqueforenhancedmitigationofcodereuseattack AT ancadjurcut ngmveeanewproposedhybridtechniqueforenhancedmitigationofcodereuseattack AT marianneaazer ngmveeanewproposedhybridtechniqueforenhancedmitigationofcodereuseattack |