Return-oriented programming detection

Abstract

According to one embodiment, a threat detection system is integrated with at least a dynamic analysis engine. The dynamic analysis engine is configured to automatically detect a function call by an application, responsive to detecting the function call, analyze contents located at one or more addresses located within a portion of memory allocated for the application, and, based on the analysis, determine whether one or more objects included in received network traffic is associated with a return-oriented programming (ROP) exploit.

Description

FIELD

Embodiments of the disclosure relate to the field of cyber security. More specifically, one embodiment of the disclosure relates to a system, apparatus and method for detecting a return-oriented programming (ROP) exploit based, at least in part, on instruction sequences stored at valid addresses located within a portion of memory allocated for an instance of an application; the application attempting to execute one or more objects contained within received network traffic.

GENERAL BACKGROUND

Over the last decade, malicious software has become a pervasive problem for Internet users as many networked resources include vulnerabilities that are subject to attack. For instance, over the past few years, more and more vulnerabilities are being discovered in software that is loaded onto network devices, such as vulnerabilities within operating systems for example. While some vulnerabilities continue to be addressed through software patches, prior to the release of such software patches, network devices will continue to be targeted for attack by exploits, namely malicious computer code that attempts to take advantage of a vulnerability in computer software by acquiring sensitive information or adversely influencing or attacking normal operations of the network device or the entire enterprise network.

In particular, a malware writing technique known as ROP has become fairly widespread recently. ROP is an exploit that allows a writer of malware to chain together sequences of instructions through return instructions thereby accomplishing one or more tasks via the execution of the chain of sequences of instructions. ROP techniques were developed as a way to circumvent data execution prevention (DEP) techniques, which have been recently implemented in many operating systems to thwart unauthorized activities including malicious attacks.

A “DEP system” prevents the execution of portions of memory allocated by an application marked as “non-executable.” For instance, areas of allocated memory that contain data as opposed to executable code may be marked as “non-executable.” In particular, the stack and “virtual” heap of memory allocated by an application are typically marked as non-executable by default. Therefore, malware writers that previously inserted shellcode into the stack or virtual heap and executed an instruction to direct the execution flow to the inserted shellcode are not able to execute the inserted shellcode. A DEP system typically prevents malware writers from executing the inserted shellcode by causing the application to terminate.

In order to circumvent the protections established by a DEP system, malware writers turned to return-oriented programming Malware writers may accomplish tasks they would have inserted into the stack and/or virtual heap using shellcode by executing sequences of instructions already appearing in executable code, such as a dynamically-loaded library (DLL), loaded by the application. Using the ROP technique, malware writers search the areas of the allocated memory marked as “executable” (such as DLLs) for sequences of instructions that, chained together, accomplish any desired tasks. The sequences of instructions are chained together through the use of return instructions following the sequence of instructions. For example, the return instruction following sequence_1 will point to sequence_2. Therefore, merely performing a search of the stack or virtual heap for shellcode may not be sufficient to detect such exploits.

BRIEF DESCRIPTION OF THE DRAWINGS

Embodiments of the invention are illustrated by way of example and not by way of limitation in the figures of the accompanying drawings, in which like references indicate similar elements and in which:

FIG. 1 is an exemplary block diagram of an operational flow for ROP exploit detection by a network device 100 (e.g., a TDP system).

FIG. 2A is an exemplary block diagram of a ROP exploit detection environment deploying a plurality of threat detection and prevention (TDP) systems communicatively coupled to a management system via a network.

FIG. 2B is a second exemplary block diagram of a ROP exploit detection environment deploying a plurality of threat detection and prevention (TDP) systems communicatively coupled to a management system via a network.

FIG. 3 is an exemplary block diagram of a monitoring logic and a ROP detection module to analyze the contents of a portion of the memory allocated by an application within a virtual machine (VM).

FIG. 4 is a flowchart illustrating an exemplary method for detecting a ROP exploit.

FIG. 5 is an exemplary block diagram of a portion of the stack allocated by an application of which a snapshot has been taken.

FIG. 6 is a flowchart illustrating an in-depth exemplary method for detecting a ROP exploit.

FIG. 7 is an exemplary block diagram of logic associated with the TDP system 210₁ of FIGS. 2A-2B.

FIG. 8 is an exemplary illustration of a network device configured with a ROP exploit detection logic.

DETAILED DESCRIPTION

Various embodiments of the disclosure determine whether an object of network content or other digital content is attempting to utilize a particular type of programming technique, return-oriented programming (ROP), to circumvent any malware detection or protection procedures employed by the network device, including data execution prevention (DEP) systems. This determination entails an analysis of an application's allocated memory and its contents to ascertain whether the contents correspond to a ROP exploit and the object should be classified as suspicious or even malware.

Specifically, in one embodiment, this determination explores the contents stored at addresses surrounding (within a predetermined address range of) a predetermined location (select address value) within the stack at a particular point in time. The contents stored on the stack within a particular distance from the predetermined location are analyzed to determine whether each is stored at a valid address in memory allocated to one of certain software modules (e.g., of the application being executed). If an address within the predetermined address range is not a valid address in memory allocated to one of the modules, its contents are disregarded for purposes of ROP detection. However, if an address within the predetermined address range is a valid address in memory allocated to one of the modules, the contents located at that address, and, in some embodiments, the next valid address or addresses in the stack, are further analyzed to determine if the address or addresses contain a gadget (i.e., computer code with less than a predefined number of instructions that are chained together followed by a “return” instruction). If they do contain one or more gadgets, a ROP exploit may have been uncovered. In some embodiments, depending on factors such as the number of detected gadgets, the object may be classified as “suspicious,” that is, associated with a probable ROP exploit or malware or as “malicious,” that is, associated with a high probability that the object is malware. In some embodiments, a correlation engine may associate the object with a score, weight or threat level corresponding to a probability that the object is associated with a ROP exploit, and may also classify the object as suspicious if the score exceeds a threshold, or even malicious if the score exceeds a higher threshold. In some embodiments, if a ROP exploit is detected, the object is always classified as malware.

Embodiments of the invention may be employed by or take the form of a network device or apparatus implementing a threat detection and prevention (TDP) system, where the network device has a dynamic analysis engine for monitoring and analyzing behavior of objects during processing in a virtual runtime environment. In some embodiments, the TDP system may be implemented or executed by a server or client device or other system (called an “endpoint”) connectable to a network. In other embodiments, the TDP system may be a dedicated cyber-security appliance or general purpose computer system. The TDP system may include an optional static analysis engine as well as the dynamic analysis engine. According to one embodiment of the disclosure, the static analysis engine operates as a filter that analyzes information associated with characteristics of one or more objects extracted from monitored network traffic in efforts to determine if the characteristics are anomalous and thus indicative of an exploit. If so, the object(s) are labeled “suspicious”. The dynamic analysis engine may include virtual execution logic to automatically process and analyze, without user assistance, content within object(s) of the received network traffic. Furthermore, the dynamic analysis engine may include monitoring logic to automatically instantiate and execute an application to execute or otherwise process an object within received network traffic and analyze the memory allocation for the application and patterns of instructions stored therein in order to detect a heap spray attack and/or an ROP exploit, in accordance with any of the techniques and embodiments described herein.

I. TERMINOLOGY

In the following description, certain terminology is used to describe features of the invention. For example, in certain situations, both terms “logic” and “engine” are representative of hardware, firmware and/or software that is configured to perform one or more functions. As hardware, logic (or engine) may include circuitry having data processing or storage functionality. Examples of such circuitry may include, but are not limited or restricted to a microprocessor, one or more processor cores, a programmable gate array, a microcontroller, an application specific integrated circuit, wireless receiver, transmitter and/or transceiver circuitry, semiconductor memory, or combinatorial logic.

Logic (or engine) may be software in the form of one or more software modules, such as executable code in the form of an executable application, an application programming interface (API), a subroutine, a function, a procedure, an applet, a servlet, a routine, source code, object code, a shared library/dynamic load library, or one or more instructions. These software modules may be stored in any type of a suitable non-transitory storage medium, or transitory storage medium (e.g., electrical, optical, acoustical or other form of propagated signals such as carrier waves, infrared signals, or digital signals). Examples of non-transitory storage medium may include, but are not limited or restricted to a programmable circuit; a semiconductor memory; non-persistent storage such as volatile memory (e.g., any type of random access memory “RAM”); persistent storage such as non-volatile memory (e.g., read-only memory “ROM”, power-backed RAM, flash memory, phase-change memory, etc.), a solid-state drive, hard disk drive, an optical disc drive, or a portable memory device. As firmware, the executable code is stored in persistent storage.

The term “object” generally refers to a collection of data (e.g., digital values, which may include instructions, commands, statements, and other data), whether in transit (e.g., over a network) or at rest (e.g., stored), often having a logical structure or organization that enables the object to be classified for purposes of analysis. During analysis, for example, the object may exhibit a set of expected characteristics and, during processing, a set of expected behaviors. The object may also exhibit a set of unexpected characteristics and a set of unexpected behaviors that may evidence an exploit and potentially allow the object to be classified as an exploit.

Examples of objects may include one or more flows or a self-contained element within a flow itself. A “flow” generally refers to related packets that are received, transmitted, or exchanged within a communication session. For convenience, a packet is broadly referred to as a series of bits or bytes of data having a prescribed format, which may include packets, frames, or cells, and, within each, header, payload, etc.

As an illustrative example, an object may include a set of flows such as (1) a sequence of transmissions in accordance with a particular communication protocol (e.g., User Datagram Protocol (UDP); Transmission Control Protocol (TCP); or Hypertext Transfer Protocol (HTTP); etc.), or (2) inter-process communications (e.g., Remote Procedure Call “RPC” or analogous processes, etc.). Similar, as another illustrative example, the object may be a self-contained element, where different types of such objects may include an executable file, non-executable file, a document (for example, a Microsoft Office® document), a dynamically linked library (DLL), a Portable Document Format (PDF) file, a JavaScript file, Zip file, a Flash file, an electronic mail (email), downloaded web page, an instant messaging element in accordance with Session Initiation Protocol (SIP) or another messaging protocol, or the like.

An “exploit” may be construed broadly as information (e.g., executable code, data, command(s), etc.) that attempts to take advantage of a vulnerability. Typically, a “vulnerability” is a coding error or artifact of software (e.g., computer program) that allows an attacker to alter legitimate control flow during processing of the software (computer program) by a network device, and thus, causes the network device to experience undesirable or unexpected behaviors. The undesired or unexpected behaviors may include a communication-based anomaly or an execution-based anomaly, which, for example, could (1) alter the functionality of an network device executing application software in a malicious manner; (2) alter the functionality of the network device executing that application software without any malicious intent; and/or (3) provide unwanted functionality which may be generally acceptable in another context. To illustrate, a computer program may be considered as a state machine, where all valid states (and transitions between states) are managed and defined by the program, in which case an exploit may be viewed as seeking to alter one or more of the states (or transitions) from those defined by the program.

Malware may be construed broadly as computer code that executes an exploit to take advantage of a vulnerability, for example, to harm or co-opt operation of a network device or misappropriate, modify or delete data. Conventionally, malware is often said to be designed with malicious intent. An object may constitute or contain malware.

The term “transmission medium” is a physical or logical communication path between two or more network devices (e.g., any devices with data processing and network connectivity such as, for example, a security appliance, a server, a mainframe, a computer such as a desktop or laptop, netbook, tablet, firewall, smart phone, router, switch, bridge, etc.). For instance, the communication path may include wired and/or wireless segments. Examples of wired and/or wireless segments include electrical wiring, optical fiber, cable, bus trace, or a wireless channel using infrared, radio frequency (RF), or any other wired/wireless signaling mechanism.

In certain instances, the term “detected” is used herein to represent that there is a prescribed level of confidence (or probability) in the presence of an exploit or, in particular, a ROP exploit, within an object under analysis. For instance, the virtual execution logic may detect the presence of a ROP exploit by monitoring or observing unexpected or anomalous behaviors or activities, and, in response, determining that the object includes a ROP exploit.

The term “network device” should be construed as any electronic device with the capability of connecting to a network. Such a network may be a public network such as the Internet or a private network such as a wireless data telecommunication network, wide area network, a type of local area network (LAN), or a combination of networks. Examples of a network device may include, but are not limited or restricted to, a laptop, a mobile phone, a tablet, a computer, etc.

The term “gadget” may be construed as a sequence of computer instructions not including a “return” instruction (hereinafter referred to as “instructions”) followed by a “return” instruction, where the sequence of instructions prior to the return instruction is less than a predefined threshold. A gadget may also consist solely of a return instruction. As an illustrative example, a gadget may be defined as any instruction sequence having less than ten instructions followed by a return instruction. Therefore, any instruction sequence consisting of more than one but less than a predetermined amount of instructions followed by a return instruction will be considered a gadget.

The term “computerized” generally represents that any corresponding operations are conducted by hardware in combination with software and/or firmware. Also, the terms “compare” or “comparison” generally mean determining if a match (e.g., a certain level of correlation) is achieved between two items where one of the items may include a particular signature pattern.

The term “signature” designates an indicator of a set of characteristics and/or behaviors exhibited by one or more exploits that may not be unique to those exploit(s). Thus, a match of the signature may indicate to some level of probability, often well less than 100%, that an object constitutes an exploit. In some contexts, those of skill in the art have used the term “signature” as a unique identifier or “fingerprint,” for example of a specific virus or virus family (or other exploit), which is generated for instance as a hash of its machine code, and that is a special sub-case for purposes of this disclosure.

Lastly, the terms “or” and “and/or” as used herein are to be interpreted as inclusive or meaning any one or any combination. Therefore, “A, B or C” or “A, B and/or C” mean “any of the following: A; B; C; A and B; A and C; B and C; A, B and C.” An exception to this definition will occur only when a combination of elements, functions, steps or acts are in some way inherently mutually exclusive.

The invention may be utilized for detection, verification and/or prioritization of malicious content such as exploits, in particular, ROP exploits. As this invention is susceptible to embodiments of many different forms, it is intended that the present disclosure is to be considered as an example of the principles of the invention and not intended to limit the invention to the specific embodiments shown and described.

II. FIRST EMBODIMENT

ROP Exploit Detection within a TDP System

A. Operational Flow for ROP Exploit Detection

Referring to FIG. 1, an exemplary block diagram of an operational flow for ROP exploit detection by a network device 100 (e.g., a TDP system) is shown. Herein, some or all of the incoming objects 110 associated with monitored network traffic are received by virtual execution logic 270, which is part of a dynamic analysis engine 130 (see FIGS. 2A-2B), either directly or via an optional static analysis engine 120. According to one embodiment of the disclosure, when deployed in the network device 100, the static analysis engine 120 is configured as a capture and filter device that receives the incoming objects 110 and conducts heuristics (e.g., rules check), exploit signature checks and/or vulnerability signature checks on some or all of the objects 110, as described below.

The virtual execution logic 270 conducts an in-depth analysis of at least one object of the incoming objects 110 by instantiating a computer application to virtually process the object and analyze the contents within a portion of the stack of memory allocated by the application. Specifically, the virtual execution logic 270 determines whether the contents at each address of the stack represents a valid address located within a portion of memory allocated to a module of the application, such as a dynamically loaded library (DLL) or other module loaded by the application. If the address value represents a valid address located within a portion of memory allocated to the module, a portion of the virtual execution logic 270 may inspect the instruction sequence for a gadget, the instruction sequence located at that address and in valid addresses following that address.

Upon conducting at least an analysis of the addresses stored within a portion of the stack of an application used to execute at least one object of the incoming objects 110, the dynamic analysis engine 130 provides the results 150 of its analysis (referred to herein as “VM-based results”), including information regarding any uncovered gadgets, to reporting logic 160 for storage in database 255 and subsequent access. If implemented as part of the network device 100, the static analysis engine 120 may also provide results 140 of its analysis (referred to herein as “static-based results”) in some embodiments to reporting logic 160 for storage in database 255 and subsequent access.

Thereafter, at least portions of the static-based results 140 and the VM-based results 150 for the incoming objects 110 may be combined by the reporting logic 160. The reporting logic 160 may issue an alert or report 170 (e.g., an email message, text message, display screen image, etc.) to security administrators to, for example, communicate the urgency in handling an uncovered ROP exploit or other exploit within the object of the incoming objects 110.

According to one embodiment of the disclosure, the communicative coupling between the static analysis engine 120 and the dynamic analysis engine 130 is provided in a serial configuration, where the incoming object(s) 110 (or a copy thereof) may be processed in the virtual execution logic 270 after analysis by the static analysis engine 120. However, the static analysis engine 120 and the dynamic analysis engine 130 may be provided in a parallel configuration, where the incoming object(s) 110 (or copy thereof) may be processed in the virtual execution logic 270 concurrently with analysis of objects by the static analysis engine 120.

B. General Architecture of Network Device Deploying a ROP Exploit Detection Logic

Referring to FIG. 2A, an exemplary block diagram of a ROP exploit detection environment 200 deploying a plurality of threat detection and prevention (TDP) systems 210₁-210_N (N>1, e.g., N=3) communicatively coupled to a management system 220 via a network 225 is shown. The ROP exploit detection environment 200 comprises a server device 232, an optional firewall 236, a client device 234 and a TDP system 210₁ communicatively coupled to the network 230 via a network interface 238. The TDP system 210₁ is further communicatively coupled to the management system 220 and one or more TDP systems 210₂-210₃ via the network 225. In general, management system 220 is adapted to manage TDP systems 210₁-210₃. For instance, management system 220 is responsible for automatically updating a list of function calls to be observed by a portion of the virtual execution logic 270 and trigger the ROP exploit detection within some or all of TDP systems 210₁-210_N.

Herein, according to the embodiment illustrated in FIG. 2A, a first TDP system 210₁ is a network device that is adapted to analyze information associated with network traffic routed over a communication network 230 between at least one server device 232 and at least one client device 234. The communication network 230 may include a public network such as the Internet, in which case an optional firewall 236 (represented by dashed lines) may be interposed prior to accessing client device 234. Alternatively, the communication network 230 may be a private network such as a wireless data telecommunication network, wide area network, a type of local area network (LAN), or a combination of networks.

As shown, the first TDP system 210₁ may be communicatively coupled with the communication network 230 via a network interface 238. In general, the network interface 238 operates as a data capturing device (sometimes referred to as a “tap” or “network tap”) that is configured to receive data propagating to/from the client device 234 and provide at least some of this data to the first TDP system 210₁. Alternatively, as shown in FIG. 2B, the first TDP system 210₁ may be positioned behind the firewall 236 and in-line with client device 234.

According to one embodiment of the disclosure, the network interface 238 is capable of receiving and routing objects associated with network traffic to the first TDP system 210₁. The network interface 238 may provide the entire object or certain content within the object, for example, one or more files that are part of a set of flows, packet payloads, or the like. In some embodiments, although not shown, network interface 238 may be contained within the first TDP system 210₁.

It is contemplated that, for any embodiments where the first TDP system 210₁ is implemented as a dedicated appliance or a dedicated computer system, the network interface 238 may include an assembly integrated into the appliance or computer system that includes a network interface card and related logic (not shown) for connecting to the communication network 230 to non-disruptively “tap” network traffic propagating through firewall 236 and provide either a duplicate copy of at least a portion of the network traffic or at least a portion the network traffic itself to the dynamic analysis engine 130 and the optional static analysis engine 120, if included within the TDP system 210₁. In other embodiments, the network interface 238 can be integrated into an intermediary device in the communication path (e.g., firewall 236, router, switch or other networked network device, which in some embodiments may be equipped with Switched Port Analyzer “SPAN” ports) or can be a standalone component, such as an appropriate commercially available network tap. In virtual environments, a virtual tap (vTAP) can be used to duplicate files from virtual networks.

As further shown in FIG. 2A, the first TDP system 210₁ comprises the optional static analysis engine 120, a scheduler 260, a storage device 265, the dynamic analysis engine 130, a classification engine 280 and the reporting logic 160.

In some embodiments, as shown in FIGS. 2A-2B, the static analysis engine 120 may include one or more software modules that, when executed by one or more processors, performs static scanning on a particular object, namely heuristics, exploit signature checks and/or vulnerability signature checks for example. The static analysis engine 120 and the dynamic analysis engine 130 may be one or more software modules executed by the same processor or different processors, where these different processors may be located within the same processor package (e.g., different processor cores) and/or located at remote or even geographically remote locations that are communicatively coupled (e.g., by a dedicated communication link) or a network.

More specifically, as shown, static analysis engine 120 may be configured with heuristics logic 250, exploit matching logic 252, and/or vulnerability matching logic 253. Heuristics logic 250 is adapted for analysis of certain portions of an object under analysis to determine whether any portion corresponds to either (i) a statically determined communication protocol anomaly (e.g., HTTP, TCP, etc.) or other deviation from a predetermined rule or policy; (ii) a “suspicious” identifier such as either a particular Uniform Resource Locator “URL” that has previously been determined as being associated with known exploits or a particular source or destination (IP or MAC) address that has previously been determined as being associated with known exploits); (iii) a particular exploit pattern; or (iv) a particular shellcode pattern. When deployed, the exploit matching logic 252 may be adapted to perform exploit signature checks, which may involve a comparison of an object under analysis against one or more pre-stored exploit signatures (e.g., pre-configured and predetermined attack patterns) from signatures database 251. Additionally or in the alternative, the static analysis engine 120 may be configured with vulnerability matching logic 253 that is adapted to perform vulnerability signature checks, namely, detect identifiers within the object that correspond to an exploit directed to a known vulnerability in a computer application, for instance, a process of uncovering deviations in messaging practices set forth in applicable communication protocols (e.g., HTTP, TCP, etc.).

The static analysis engine 120 may route suspicious objects to the virtual execution logic 270 within dynamic analysis engine 130, and filter other “non-suspicious” objects from further analysis. In one embodiment, if the object is not suspected of being an exploit, the static analysis engine 120 may simply denote that the object is non-malicious. The dynamic analysis engine 130 is configured to provide an in-depth analysis of objects included in the received network traffic and/or suspicious object(s) from the static analysis engine 120. The analysis may include inspecting instruction sequences stored at particular addresses located within a portion of the memory allocated by application executed by one or more objects.

More specifically, if the optional static scanning is conducted, upon its completion, the static analysis engine 120 may provide a suspicious object to the dynamic analysis engine 130 for in-depth dynamic analysis using virtual machines (VMs) 275₁-275_M (M≧1). For instance, the dynamic analysis engine 130 may simulate transmission and/or receipt by a destination device comprising the virtual machine.

According to one embodiment, one or more VMs 275₁-275_M within the virtual execution environment 272 may be configured with one or more of the software profiles corresponding to the software images stored within storage device 265. Alternatively, the VMs 275₁-275_M may be configured according to a prevalent software configuration, software configuration used by a network device within a particular enterprise network (e.g., client device 234), or an environment that is associated with the object to be processed, including software such as a web browser application, PDF™ reader application, or the like. However, for a known vulnerability which occurs after a successful match during a vulnerability signature check for example, the VMs 275₁-275_M may be more narrowly configured to software profiles associated with vulnerable software. For example, a particular version of an application may be used by the VMs 275₁-275_M.

The scheduler 260 may be adapted to configure the multiple VMs 275₁-275_M for concurrent (e.g., overlapping or simultaneous) virtual execution of a variety of different versions of the software, such as various operating systems, in efforts to detect whether an object included within the received network traffic is attempting to utilize a ROP exploit. Of course, the VM configuration described above may be handled by logic other than the scheduler 260. For instance, although not shown, the static analysis engine 120 and/or dynamic analysis engine 130 may include configuration logic to handle VM configuration as well.

The dynamic analysis engine 130 is adapted to execute one or more VMs 275₁-275_M to detect an attempt to utilize a ROP exploit by simulating the execution of an object under analysis within a run-time environment as expected by the type of object. The dynamic analysis engine 130 analyzes the received network traffic and determines which application is suitable for executing an object of the received network traffic within one or more VMs 275₁, . . . , and/or 275_M. The monitoring logic 276 instantiates an instance of the application within the virtual execution environment 272 to open/execute the object. The monitoring logic 276 has a ROP detection module 321 (as seen in FIG. 3) that operates in association with the instantiated application in the VM(s) 275₁-275_M to monitor behaviors (e.g., activities) of the running application as it processes the object. The ROP detection module 321 analyzes addresses stored on a portion of the allocated memory, in particular, a portion of the stack allocated to the application, and determines whether a threshold number of gadgets have been chained together to conclude that the object contains, or is associated with, a ROP exploit. Alternatively, a weight may be attached to each instruction sequence, and the monitoring logic 321 may determine whether a ROP exploit is present based on a combined total of the weights given to the instruction sequences at the addresses within the portion of the stack.

The score determination logic 278 (which will be discussed in further detail below) may also be implemented within the virtual execution logic 270 to generate a score that represents a probability (or level of confidence) that the object under analysis is associated with a malicious attack. For instance, the score may be based, at least in part, on the VM-based results and, in some embodiments, on a combination of the static-based results and VM-based results.

The classification engine 280 may be configured to receive the static-based results 140 (e.g., results from static analysis, metadata associated with the incoming network traffic, etc.) and/or the VM-based results 150. According to one embodiment of the disclosure, the classification engine 280 comprises prioritization logic 282 and score determination logic 284. The prioritization logic 282 may be configured to apply weighting to results provided from dynamic analysis engine 130 and/or static analysis engine 250. Thereafter, the classification engine 280 may route the classification results 281 comprising the weighting and/or prioritization applied to the static-based results 140 and/or the VM-based results 150 to the reporting logic 160. The classification results 281 may, among others, classify the object as malware, classify the object as a member of a family of malware and/or exploits, describe the malware and/or exploits and provide the metadata associated with any object(s) within which the malware and/or exploits were detected. The alert generation logic 256 of the reporting logic 160 may generate an alert for the client device 234 and/or route the alert to the management system 220 via the network 225 for further analysis by a network administrator. In addition, the reporting logic 160 may store the classification results 281 (including the static-based results 140 and the VM-based results 150) in the database 255 for future reference. Finally, a signature for the malware or exploit may be generated and provided to one or more other systems to enable them to detect or classify objects matching the signature as malware in a more efficient manner.

Referring to FIG. 3, an exemplary block diagram of a monitoring logic and a ROP detection module to analyze the contents of a portion of the memory allocated for an application within a VM is shown. In the embodiment as shown, the virtual execution logic 270 comprises the monitoring logic 276, a score determination logic 278 and virtual execution environment 272 including one or more VMs, such as VM 275₁. In the illustration, the monitoring logic 276 opens an instance of an application 310 (for example, a browser such as Internet Explorer®) through an open process operation 300.

The monitoring logic 276 observes the application 310 as it is allocated memory including a “virtual” heap 320 and a stack 322 within the VM 275₁. The monitoring logic 276 is equipped with a ROP detection module 321, e.g., located within the virtual environment, which operates in conjunction with the application instance 310 (i.e., process) to obtain information and perform various tasks for the monitoring logic 276 such as, among others, detecting activities initiated by the application 310 and obtaining information required in detecting shellcode and/or a ROP exploit (to be discussed below). An operating system 312 may also be present within the VM 275₁. The application 310 and the ROP detection module 321 may communicate with the operating system 312. For example, the ROP detection module 321 may observe function calls made by the application 310 and/or querying the operating system 312 to determine what memory has been allocated to the application 310. Furthermore, the ROP detection module 321 may query the application 310 directly to determine what memory has been allocated to the application 310.

In particular, a portion of the monitoring logic 276 observes (i.e., performs an operation referred to as “hooking” or “intercepting”) function calls initiated by the application 310. For example, if the VM 275₁ is executing a Microsoft® operating system, the ROP detection module 321 may observe function calls such as application programming interface (API) calls. In a second example, if the VM 275₁ is executing an Apple® operating system, such as OS X®, the ROP detection module 321 may observe function calls such as system calls. The observing of a function call by the ROP detection module 321 may trigger a ROP exploit detection process, as described below. The portion of the monitoring logic 276 performing functionalities described above and/or below may be referred to “ROP exploit detection logic.”

Referring to FIG. 4, a flowchart illustrating an exemplary method for detecting a ROP exploit is shown. In block 401, after the monitoring logic 276 has instantiated an instance of application 310 and the instance is executing in the VM, the ROP detection module 321 observes a function call made by the application 310.

In block 402, the ROP detection module 321 takes a snapshot of a portion of the stack surrounding the location of the current position of the stack pointer (the portion of the stack of which the snapshot was taken will be referred to as “snapshot 500” as is seen in FIG. 5) at the point in time the function call is observed. The snapshot 500 captures the current content on the stack at addresses surrounding the stack pointer. The snapshot is captured so that the contents may be preserved for analysis, otherwise, for example, the contents might have been over-written and thus made not available. The range addresses (e.g., a number of addresses) included in the snapshot 500 may be predetermined number, and may be set or modified by, for example, a configuration file that is uploaded to the TDP system 210₁ by the management system 220. The snapshot may capture contents from a number of addresses prior to and a number of addresses following the current position of the stack pointer, which may be numerically the same or different.

Referring to FIGS. 3-5, in block 403, the ROP detection module 321 analyzes the addresses of all contents stored within the snapshot 500 to determine whether the address values represent “valid” addresses, that is, addresses of memory locations allocated to the application 310. The ROP detection module 321 will compare the address represented by each address value in the snapshot 500 against a list of allocated memory for the application obtained by querying the application 310 (or, in some embodiments, the operating system 312 as illustrated in FIG. 3) for metadata regarding the allocation.

In block 404 of FIG. 4, the ROP detection module 321 determines whether a ROP exploit is present in the contents based on the analysis of instruction sequences within the snapshot 500. In some embodiments, for each valid address, the ROP detection module 321 may analyze the contents of that address and, as appropriate, of one or more “next” address values for locations so long as they too have valid addresses. The ROP detection module 321 will examine the contents at that address or those addresses for an instruction sequence that represents a gadget. Thereafter, an alert may be generated by the ROP detection module 321 notifying the monitoring logic 276 of the presence of a ROP exploit.

Referring now to FIG. 5, an exemplary block diagram of a portion of the stack allocated by application 310 of which a snapshot has been taken is shown. Among the contents included in the snapshot 500, FIG. 5 shows the contents 501-506 as an illustrative example. The contents 502 and 504-506 are seen to represent memory addresses and will be compared to a list addresses allocated to application 310, as identified by metadata obtainable from the application 310. In contrast, the contents 501 and 503 represent addresses that are not valid for the application 310, and will be disregarded for purposes of analysis by the ROP detection module 321. The ROP detection module 321 inspects the contents of valid addresses for gadgets. For illustrative purposes, four gadgets are illustrated in FIG. 5 by the groupings of the instructions 511-514.

Referring to FIG. 6, a flowchart illustrating a more detailed in-depth exemplary method for detecting a ROP exploit in shown. As primarily shown in FIGS. 3 and 6, in block 601, the ROP detection module 321 begins to perform function call observing (“hooking”) on the application 310, e.g., from within the VM 275 of FIG. 3. In block 602, the ROP detection module 321 observes a function call made by the application 310 and takes a snapshot 500 of the stack 322. In block 603, the ROP detection module 321 analyzes the contents within the snapshot 500. In block 604, the ROP detection module 321 determines whether a first content in the snapshot 500 represents a valid address of a location allocated to the application 310. If the content does not represent a valid address (block at block 604), the ROP detection module 321 checks whether the content being analyzed is the last content within the snapshot 500 (block 605). If the content currently being analyzed is the last content within the snapshot 500 (yes at block 605), the ROP detection module 321 disregards the function call made by the application 310 and returns to await a next function call, if any (block 606). However, if the content being analyzed is not the last content within the snapshot 500 (no at block 605), the ROP detection module 321 moves to the next content (block 607) and begins to analyze the next content as discussed above.

If the content being analyzed does represent a valid address for the application 310 (yes at block 604), the ROP detection module 321 inspects the instruction sequence located at the address (block 608). At block 609, the ROP detection module 321 inspects the sequence of instructions at valid addresses within the stack to determine whether the sequence of instructions is a gadget. The inspection of the sequence of instructions entails, at least, counting the number of instructions prior to a “return” instruction. If the number of instructions prior to a “return” instruction is below a first predetermined threshold, the sequence of instructions is considered a gadget.

If the instruction sequence is not determined to be a gadget (no at block 609), the ROP detection module 321 returns to block 605 and determines whether the content being analyzed is the last content within the snapshot 500. If the instruction sequence is determined to be a gadget (yes at block 609), the ROP detection module 321 may assign a weight to the instruction sequence based on the contents of the instruction sequence (block 610). For example, an instruction sequence comprised of more than one but less than nine instructions followed by a “return” instruction may be given a first weight whereas an instruction sequence comprising only a “return” instruction may be given a second, lower weight. The assigned weights may be based on experiential knowledge acquired through analysis of and, in some embodiments, machine learning from known malicious and non-malicious objects. Thereafter, in block 611, the ROP detection module 321 determines whether the combined total weight of all previously inspected instructions identified as gadgets exceeds a predetermined threshold weight. If the combined total weight does not exceed a predetermined threshold weight (no at block 611), the ROP detection module 321 returns to block 605 and checks whether the content being analyzed in the last content within the snapshot 500. However, if the combined total weight does exceed a predetermined threshold weight (yes at block 611), the ROP detection module 321 reports the presence of a ROP exploit (block 612).

In an alternative embodiment, the ROP detection module 321 may utilize a gadget counter instead of assigning weights to each identified gadget. In such an embodiment, when the ROP detection module 321 identifies an instruction sequence as a gadget, the ROP detection module 321 increments a gadget counter. If the gadget counter exceeds a predefined threshold defining the number of gadgets necessary to conclude a ROP exploit is present, the ROP detection module 321 may report the presence of a ROP exploit. However, if the gadget counter does not exceed the threshold defining the number of gadgets necessary to conclude a ROP exploit is present, the ROP detection module 321 returns to block 605 and determines whether the content being analyzed in the last content within the snapshot 500.

Although the ROP detection module 321 may perform ROP exploit detection logic (as described above) when a function call executed by the application 310 is observed, the ROP exploit detection logic may be triggered in some embodiments as a result of the ROP detection module 321 performing a stack discrepancy check. A stack discrepancy check involves analyzing a Thread Information Block (TIB). The TIB is a data structure that contains information regarding a currently running thread. The contents of the TIB include, among other things, an address representing the base of the stack of the application from which the thread was started and an address representing the limit of the stack. The base and stack addresses represent the range of the stack. During a stack discrepancy check, the ROP detection module 321 determines whether the current stack pointer is pointing to an address within the range represented by the base and stack addresses extracted from the TIB. If the current stack pointer is pointing to an address located within the range, no stack discrepancy is reported. However, if the current stack pointer is found to be pointing to a location outside of the range, a stack discrepancy is reported.

Therefore, in one embodiment of the disclosure, a stack discrepancy check may be performed by the ROP detection module 321 and, if a stack discrepancy is reported for a given application running, for example within the VM 275₁, the ROP exploit detection logic may be triggered.

Referring back to FIG. 2A, the score determination logic 278 within the dynamic analysis engine 130 may be configured to compute a score based on analysis of monitored behavior during execution of the application within the one or more VMs 275₁, . . . , and/or 275_M. According to one embodiment of the disclosure, the score determination logic 278 has one or more software modules that are used to determine a probability (or level of confidence) that the object contains a ROP exploit. As discussed above, the score determination logic 278 may assign a score based on one or more of (i) the static-based results 140, and/or (ii) VM-based results 150 which may include, among other things, an alert of a ROP exploit (or lack thereof) and/or the individual weights assigned to each gadget identified within a snapshot 500.

The scores may be given equal weighting or the weighting for one the static-based results 140 may differ from that given to the VM-based results 150 due to the accuracy of a set of results in detecting the presence of a ROP exploit and the likelihood of the detection resulting in a false positive.

C. Exemplary Logic Layout of TDP System

Referring now to FIG. 7, an exemplary block diagram of logic associated with the TDP system 210₁ of FIGS. 2A-2B is shown. The TDP system 210₁ comprises one or more processors 700 that are coupled to the communication interface logic 710 via a first transmission medium 720. Communication interface logic 710 enables communication with other TDP systems 210₂-210₃ and management system 220 of FIG. 2A-2B. According to one embodiment of the disclosure, the communication interface logic 710 may be implemented as a physical interface including one or more ports for wired connectors. Additionally, or in the alternative, communication interface logic 710 may be implemented with one or more radio units for supporting wireless communications with other network devices.

The processor(s) 700 is further coupled to the persistent storage 730 via the transmission medium 725. According to one embodiment of the disclosure, the persistent storage 730 may include (i) the static analysis engine 120 including the signatures database 254, the vulnerability matching logic 253, the exploit matching logic 252 and the heuristics logic 250; (ii) the dynamic analysis engine 130 including the virtual execution logic 272, the monitoring logic 276 and the score determination logic 278; and (iv) the reporting logic 160. Of course, when implemented as hardware, one or more of these logic units could be implemented separately from each other.

The static analysis engine 120, if included, comprises one or more software modules that conduct a first static analysis on one or more incoming objects. As described above, this analysis may involve performing at least exploit signature checks and vulnerability signature checks on each incoming object to determine whether characteristics of any of these objects are indicative of an exploit, and in particular, a ROP exploit. Upon detection that one or more suspicious objects have characteristics of an exploit, the static analysis engine 120 provides the suspicious object(s) to the virtual execution logic 270.

The virtual execution environment 272 comprises one or more software modules that are used for performing an in-depth, dynamic and real-time analysis of one or more objects included in the received network traffic using one or more VMs. More specifically, the virtual execution environment 272 is adapted to run one or more of the VM(s) 275₁-275_M, which each virtually processes the content associated with the one or more objects within a computer application 310 in order to determine the presence of one or more exploits, and in particular, a ROP exploit. Furthermore, the monitoring logic 276 monitors in real-time during run-time, and may also log, at least the instruction sequences located at valid addresses allocated to the application 310 when the valid addresses correspond to contents within the snapshot 500. The monitoring logic 276 analyzes contents within the snapshot 500 of the stack and inspects the instruction sequence(s) located at one or more of the addresses to identify one or more gadgets.

Thereafter, according to the observed behavior of the virtually processed content, the monitoring logic 276 may determine that the content is associated with one or more exploits, and in particular, one or more ROP exploits, where the severity of the observed anomalous behavior and/or the likelihood of the anomalous behavior resulting from an exploit, is evaluated and reflected in a “score” assigned by the score determination logic 278. Processor(s) 700 may invoke the reporting logic 160, which produces an alert for conveying information regarding the detected ROP exploit by the TDP system 210₁.

III. ALTERNATIVE EMBODIMENT

ROP Exploit Detection within a Network Device

According to an alternative embodiment of the disclosure, a network device may be configured to implement at least a monitoring logic which may be communicatively coupled with a ROP exploit detection logic. In some embodiments, the ROP exploit detection logic may be co-located with the monitoring logic within the network device and in other embodiments may be located remotely with respect to the device. In other words, a network device may be equipped with integrated or embedded the monitoring logic, which performs its functions within the network device and communicates its results, e.g., over a dedicated communication link or network, to the ROP exploit detection logic.

Referring to FIG. 8, a network device may be configured with a ROP exploit detection logic. In FIG. 8, the network device is represented by, as an illustrative example, a tablet 800. The tablet 800 includes a display screen 801, an antenna 802 and a ROP exploit detection logic 810. The ROP exploit detection logic 810 includes a monitoring logic 276 which may be equipped with a ROP detection module 321 for monitoring operations and other behavior of an application 310 from within the tablet 800.

In one embodiment, the ROP exploit detection logic 810 may be implemented as a software service within the tablet 800. In such an embodiment, the ROP detection module 321 performs function call observing (“hooking”). When a function call is observed, the ROP detection module 321 analyzes the actions taken by the tablet 800 as a result of the function call or system call to determine whether the object that made the call, contains, or is associated with, a ROP exploit. In one embodiment, the ROP exploit detection logic 810 may operate as a daemon such that the ROP exploit detection logic 810 runs as a background process on the tablet 800. In yet another embodiment, the ROP exploit detection logic 810 may be implemented as a software application on the tablet 800.

The ROP detection module 321 may capture and analyze the contents of a snapshot 500 of the memory allocated for the application 310 instantiated as a result of the function call. The ROP exploit detection logic 810 may analyze, as reported by the ROP detection module 321, information such as (i) the instruction sequences located at addresses included in the snapshot 500, (ii) the number of gadgets (i.e., instruction sequences containing certain characteristics such as less than a predetermined number of instructions prior to a return instruction), and/or (iii) a weight of each gadget assigned by the ROP detection module 321 during the execution of the application 310 in the VM 275₁.

One or more alerts generated by either, or both, the ROP detection module 321 and/or the ROP exploit detection logic 810 may be displayed to a user on the display screen 801. For example, when the combined total weight for all identified gadgets exceeds a predetermined threshold, an alert may be displayed on the display screen 801. Such alerts may present the user with the option to remediate the detected ROP exploit locally, i.e., on the tablet 800, or the option to store the information associated with the detected ROP exploit for remediation by the appropriate network administrator. One example of remediation that may occur locally is a system restore of the tablet 800 to system defaults. Furthermore, the information associated with the detected ROP exploit may be transmitted via the antenna 802 to the appropriate network administrator.

In addition to the generation of an alert, the ROP exploit detection logic 810 may prevent the application from executing on the tablet 800, outside of the confines of the VM 275₁. For instance, upon determination of the presence of a ROP exploit associated with application 310, the ROP exploit detection logic 810 may prevent the tablet 800 from executing an actual instance of the application outside of the virtual environment.

In the foregoing description, the invention is described with reference to specific exemplary embodiments thereof. It will, however, be evident that various modifications and changes may be made thereto without departing from the broader spirit and scope of the invention as set forth in the appended claims.

Claims

1. A computerized method, comprising: detecting a function call by an application;responsive to detecting the function call, capturing and preserving contents in a range of a stack of memory addresses surrounding a current stack pointer;analyzing contents located at a first valid address within the preserved contents to detect a first gadget and contents located at a second valid address within the preserved contents to detect a second gadget, the first valid address and the second valid address being located within a portion of a region of memory allocated for the application, wherein the first gadget comprises a first sequence of a first number of instructions less than a predetermined number of instructions followed by a return instruction, and the second gadget comprises a second sequence of a second number of instructions less than the predetermined number of instructions followed by a return instruction;assigning a first weight to the first gadget based on the first number of instructions and a second weight to the second gadget based on the second number of instructions, wherein the first weight is different than the second weight; anddetermining that a return-oriented programming (ROP) exploit is present within the portion of the region of allocated memory within the preserved contents based on at least whether a combination of at least the first weight and the second weight exceeds a predetermined weight threshold.

2. The computerized method of claim 1, wherein the first gadget includes (1) a sequence of one or more computer instructions other than a return instruction and (2) the return instruction following the sequence of one or more computer instructions, where a number of instructions forming the sequence of one or more computer instructions is less than a predefined threshold.

3. The computerized method of claim 2, wherein the function call is a system call.

4. The computerized method of claim 2, wherein the function call is an application programming interface (API) call.

5. The computerized method of claim 2, wherein the first gadget includes a first sequence of computer instructions and the second gadget includes a second sequence of computer instructions.

6. The computerized method of claim 2, further comprising: determining whether any valid addresses are present within the portion of the region of allocated memory.

7. The computerized method of claim 2, wherein a valid address is an address in memory of a software component loaded by the application.

8. The computerized method of claim 7, wherein the software component loaded by the application is a dynamically-loaded library (DLL).

9. The computerized method of claim 1, wherein the content of the first gadget is a length of the sequence of one or more computer instructions preceding the return instruction.

10. The computerized method of claim 1, wherein the first gadget includes at least one instruction but less than a threshold number of instructions preceding the return instruction.

11. The computerized method of claim 1, wherein the second gadget includes only Rap the return instruction.

12. The computerized method of claim 2, further comprising: prior to detecting the function call by the application, detecting a stack discrepancy.

13. The computerized method of claim 12, wherein the detection of the stack discrepancy is accomplished by analyzing a Thread Information Block of the application.

14. The computerized method of claim 2, further comprising: dynamically configuring a virtual machine with a software image representing a current operating state of a targeted client device, the software image representing content and structure of a storage volume for the targeted client device at a time of configuring the virtual machine; anddetecting the function call, responsive to detecting the function call, analyzing the contents located at one or more of the valid addresses, and determining that the ROP exploit is present within the portion of the region of allocated memory within the virtual machine.

15. The computerized method of claim 14, wherein the virtual machine includes a module, the application and an operating system of the targeted client device.

16. The computerized method of claim 15, wherein the module queries one or more of the application or the operating system to determine what memory has been allocated to the application.

17. A system comprising: one or more processors;a storage module communicatively coupled to the one or more processors, the storage module includes logic to:detect a function call by an application;responsive to detecting the function call, capture and preserve contents in a range of a stack of memory addresses surrounding a current stack pointer;analyze contents located at a first valid address within the preserved contents to detect a first gadget and contents located at a second valid address within the preserved contents to detect a second gadget, the first valid address and the second valid address being located within a portion of a region of memory allocated for the application, wherein the first gadget comprises a first sequence of a first number of instructions less than a predetermined number of instructions followed by a return instruction, and the second gadget comprises a second sequence of a second number of instructions less than the predetermined number of instructions followed by a return instruction;assign a first weight to the first gadget based on the first number of instructions and a second weight to the second gadget based on the second number of instructions, wherein the first weight is different than the second weight; anddetermine that a return-oriented programming (ROP) exploit is present within the portion of the region of allocated memory within the preserved contents based on at least whether a combination of at least the first weight and the second weight exceeds a predetermined weight threshold.

18. The system of claim 17, wherein the first gadget includes (1) a sequence of one or more computer instructions other than a return instruction and (2) the return instruction following the sequence of one or more computer instructions, where a number of instructions forming the sequence of one or more computer instructions is less than a predefined threshold.

19. The system of claim 18, wherein the function call is a system call.

20. The system of claim 18, wherein the function call is an application programming interface (API) call.

21. The system of claim 18, wherein a valid address is an address in memory of a software component loaded by the application.

22. The system of claim 21, wherein the software component loaded by the application is a dynamically-loaded library (DLL).

23. The system of claim 18, wherein presence of the ROP exploit is based on a combined weight of all detected gadgets present within the portion of the region of allocated memory.

24. The computerized method of claim 1, wherein the preserved contents includes a copy of the range of the stack of memory addresses surrounding the current stack pointer when the function call is detected.

25. The system of claim 17, wherein the preserved contents includes a copy of the range of the stack of memory addresses surrounding the current stack pointer when the function call is detected.

26. The computerized method of claim 1, wherein the first gadget includes (1) a sequence of one or more computer instructions other than a return instruction and (2) a return instruction following the sequence of one or more computer instructions, where a number of instructions forming the sequence of one or more computer instructions is less than a predefined threshold, and the second gadget includes only a return instruction.

27. The system of claim 17, wherein the first gadget includes (1) a sequence of one or more computer instructions other than a return instruction and (2) a return instruction following the sequence of one or more computer instructions, where a number of instructions forming the sequence of one or more computer instructions is less than a predefined threshold, and the second gadget includes only a return instruction.

28. The method of claim 1, wherein determining the ROP exploit is present is based on at least a combination of the first weight, the second weight and weights of one or more additional gadgets, each detected at valid addresses located within the portion of the region of memory allocated for the application within the preserved contents.

29. The system of claim 18, wherein determining the ROP exploit is present is based on at least a combination of the first weight, the second weight and weights of one or more additional gadgets, each detected at valid addresses located within the portion of the region of memory allocated for the application within the preserved contents.