Code Reuse Attack Detection Based on Hardware and Software Performance Counters

Currently, with the continuous development of code reuse attack, it has become a mainstream attack, how to defend or detect this attack has become a research hotspot in the security field. Most of the existing techniques have the problems of high overhead and limited detection scope, for this reason, this paper proposes a code reuse attack detection method based on hardware and software performance counters, which realizes efficient and low overhead code reuse attack detection by collecting the number of selected event occurrences from the system wide. This method significantly improves the efficiency and accuracy of attack detection by training a GRU-SVM neural network model, utilizing GRU to extract time-series features, and combining the accurate classification capability of SVM. Meanwhile, this paper utilizes the sensitive system call records to determine the possible location of the attack through the sensitive system call records after the attack is detected. The experiments conducted reveal that the proposed strategy ensures precise identification capabilities, maintains low computational resource consumption, and is adaptable to diverse scenarios. This presents a reliable and efficient pathway for mitigating risks associated with code reuse vulnerabilities.