loading...
Using Branch Correlation to Identify Infeasible Paths for Anomaly Detection
Orlando, Florida, USA December 09-December 13
DOI Bookmark: http://doi.ieeecomputersociety.org/10.1109/MICRO.2006.4839th Annual IEEE/ACM International Sy ...
 This Article 
 
PDF
HTML
 
 Share 
   
 Bibliographic References 
   
 Add to: 
 
Digg
Furl
Spurl
Blink
Simpy
Google
Del.icio.us
Y!MyWeb
 
 Search 
   
Xiaotong Zhuang, IBM T.J. Watson Research Center, NY
Tao Zhang, IBM T.J. Watson Research Center, NY
Santosh Pande, Georgia Institute of Technology
In this paper, we propose a system called Infeasible Path Detection System (IPDS) to combat memory tampering attacks causing invalid program control flows. In our system, the compiler analyzes correlations between branches and then the analyzed information is conveyed to the runtime system. The runtime system detects dynamic infeasible program paths by combining compiler determined information with runtime information to check the legality of the path taken during execution. IPDS achieves a zero false positive rate and can detect a high percentage of memory tampering for many attacks in which the tampering actually causes a change in control flow. Moreover, IPDS only incurs a modest amount of hardware resource and negligible performance penalty.
Citation:
Xiaotong Zhuang, Tao Zhang, Santosh Pande, "Using Branch Correlation to Identify Infeasible Paths for Anomaly Detection," micro, pp.113-122, 39th Annual IEEE/ACM International Symposium on Microarchitecture (MICRO'06), 2006
Usage of this product signifies your acceptance of the Terms of Use.