Return Oriented Programming Attack Detection Via Memory Monitoring

A computing device, comprising:

• a memory;
• and
• a processor coupled to the memory and configured with processor-executable to perform operations comprising:
• loading a memory traversal map for a program called to run on the processor;
• monitoring a memory access request of the program to the memory;
• comparing a memory address of the memory from the memory access request to the memory traversal map;
• and
• determining whether the memory access request indicates a return oriented programming attack based on comparing the memory address to the memory traversal map.

A computing device, comprising:

• means for loading a memory traversal map for a program called to run on the computing device;
• means for monitoring a memory access request of the program to a memory of the computing device;
• means for comparing a memory address of the memory from the memory access request to the memory traversal map;
• and
• means for determining whether the memory access request indicates a return oriented programming attack based comparing the memory address to the memory traversal map.

A non-transitory processor-readable storage medium having stored thereon processor-executable instructions configured to cause a processor of a computing device to perform operations comprising:

• loading a memory traversal map for a program called to run on the computing device;
• monitoring a memory access request of the program to a memory of the computing device;
• comparing a memory address of the memory from the memory access request to the memory traversal map;
• and
• determining whether the memory access request indicates a return oriented programming attack based on comparing the memory address to the memory traversal map.