Return-oriented programming protection
AssigneeC2A-SEC, Ltd.
InventorsYitzhack DAVIDOVICH, Yoav FUCHS, Nir BRAKHA
Life of this patent
Estimating the term…
Abstract
An ROP attack protection method for a plurality of ECUs, the method constituted of: receiving data destined for one of the plurality of ECUs; determining which of the plurality of ECUs the received data is destined for; responsive to a unique model associated with the determined ECU, analyzing the received data to identify control flow instructions addressed to one or more predetermined addresses; responsive to the analyzation, generate a statistical analysis of the identified control flow instructions; and responsive to the generated statistical analysis, outputting a signal indicating a possibility of an attack.
Claims12
A return-oriented programming (ROP) attack protection method for a plurality of electronic control units (ECUs), the method comprising:
- receiving data destined for one of the plurality of ECUs;
- determining which of the plurality of ECUs the received data is destined for;
- responsive to a unique model associated with said determined ECU, analyzing said received data to identify control flow instructions addressed to one or more predetermined addresses;
- responsive to said analyzation, generate a statistical analysis of said identified control flow instructions;
- responsive to said generated statistical analysis, detecting the presence of an ROP attack;
- and
- outputting a signal indicating said detected presence of an ROP attack.
A return-oriented programming (ROP) attack protection system comprising:
- a processor;
- and
- a memory, said memory having stored therein a plurality of a unique models, each unique model associated with a respective one of a plurality of electronic control units (ECUs),
- wherein said processor is arranged to:
- receive data destined for one of the plurality of ECUs;
- determine which of the plurality of ECUs the received data is destined for;
- responsive to said respective unique model associated with said determined ECU, analyze said received data to identify control flow instructions addressed to one or more predetermined addresses;
- responsive to said analyzation, generate a statistical analysis of said identified control flow instructions;
- responsive to said generated statistical analysis, detect the presence of an ROP attack;
- and
- output a signal indicating said detected presence of an ROP attack.
Dependencies are inferred from the claim text.