Techniques for detecting false positive return-oriented programming attacks

Abstract

Various embodiments are generally directed to an apparatus, method and other techniques to determine whether a target address of a register for an execution instruction is valid or invalid based on a comparison between the target address and one or more valid target addresses stored in a storage, increase a number of invalid target addresses if the target address is invalid, and determine whether the number of invalid target addresses is greater than an invalid target address threshold. Various embodiments may also include initiating a security measure to prevent a security breach if the number of invalid target addresses is greater than the invalid target address threshold or executing the execution instruction if the number of invalid target addresses is less than or equal to the invalid target address threshold.

1 .- 25 . (canceled) 
     
     
         26 . An apparatus, comprising:
 a memory; and   logic, at least a portion of which is comprised in circuitry coupled to the memory, the logic to:
 identify an intended target address for an indirect branch instruction; 
 retrieve a predicted target address for the indirect branch instruction from a lookup table; 
 compare the intended target address to the predicted target address; and 
 increment an invalid target address counter and enable execution tracking when the intended target address differs from the predicted target address, execution tracking to track a number of instructions executed with an execution instruction counter. 
   
     
     
         27 . The apparatus of  claim 26 , the logic to execute the indirect branch instruction when the invalid target address counter is below an invalid target address threshold. 
     
     
         28 . The apparatus of  claim 27 , the logic to:
 identify a second intended target address for a second indirect branch instruction;   retrieve a second predicted target address for the second indirect branch instruction from the lookup table;   compare the second intended target address to the second predicted target address; and   increment the execution instruction counter when the second intended target address matches the second predicted target address.   
     
     
         29 . The apparatus of  claim 28 , the logic to reset the invalid target address counter and the execution instruction counter when the execution instruction counter is above an execution instruction threshold. 
     
     
         30 . The apparatus of  claim 29 , the logic to disable execution tracking when the execution instruction counter is above the execution instruction threshold. 
     
     
         31 . The apparatus of  claim 28 , the logic to execute the second indirect branch instruction when the execution instruction counter is below an execution instruction threshold. 
     
     
         32 . The apparatus of  claim 31 , the logic to unlink a translation block when execution instruction counter is below the execution instruction threshold. 
     
     
         33 . The apparatus of  claim 26 , the logic to initiate a security measure when the invalid target address counter is above an invalid target address threshold, the security measure to protect a computing device from a return-oriented programming attack. 
     
     
         34 . The apparatus of  claim 26 , the indirect branch instruction comprising a return instruction. 
     
     
         35 . The apparatus of  claim 26 , the logic to disable a function routine of a library when execution tracking is enabled. 
     
     
         36 . A computer-implemented method, comprising:
 identifying an intended target address for an indirect branch instruction;   retrieving a predicted target address for the indirect branch instruction from a lookup table;   comparing the intended target address to the predicted target address; and   incrementing an invalid target address counter and enabling execution tracking when the intended target address differs from the predicted target address, execution tracking to track a number of instructions executed with an execution instruction counter.   
     
     
         37 . The computer-implemented method of  claim 36 , comprising executing the indirect branch instruction when the invalid target address counter is below an invalid target address threshold. 
     
     
         38 . The computer-implemented method of  claim 37 , comprising:
 identifying a second intended target address for a second indirect branch instruction;   retrieving a second predicted target address for the second indirect branch instruction from the lookup table;   comparing the second intended target address to the second predicted target address; and   incrementing the execution instruction counter when the second intended target address matches the second predicted target address.   
     
     
         39 . The computer-implemented method of  claim 38 , comprising resetting the invalid target address counter and the execution instruction counter when the execution instruction counter is above an execution instruction threshold. 
     
     
         40 . The computer-implemented method of  claim 39 , comprising disabling execution tracking when the execution instruction counter is above the execution instruction threshold. 
     
     
         41 . The computer-implemented method of  claim 38 , comprising executing the second indirect branch instruction when the execution instruction counter is below an execution instruction threshold. 
     
     
         42 . The computer-implemented method of  claim 41 , comprising unlinking a translation block when execution instruction counter is below the execution instruction threshold. 
     
     
         43 . The computer-implemented method of  claim 36 , comprising initiating a security measure when the invalid target address counter is above an invalid target address threshold, the security measure to protect a computing device from a return-oriented programming attack. 
     
     
         44 . The computer-implemented method of  claim 36 , the indirect branch instruction comprising a return instruction. 
     
     
         45 . The computer-implemented method of  claim 36 , comprising disabling a function routine of a library when execution tracking is enabled. 
     
     
         46 . At least one non-transitory computer-readable medium comprising a set of instructions that, in response to being executed by a processor circuit, cause the processor circuit to:
 identify an intended target address for an indirect branch instruction;   retrieve a predicted target address for the indirect branch instruction from a lookup table;   compare the intended target address to the predicted target address; and   increment an invalid target address counter and enable execution tracking when the intended target address differs from the predicted target address, execution tracking to track a number of instructions executed with an execution instruction counter.   
     
     
         47 . The at least one non-transitory computer-readable medium of  claim 46 , comprising instructions that, in response to being executed by the processor circuit, cause the processor circuit to execute the indirect branch instruction when the invalid target address counter is below an invalid target address threshold. 
     
     
         48 . The at least one non-transitory computer-readable medium of  claim 47 , comprising instructions that, in response to being executed by the processor circuit, cause the processor circuit to:
 identify a second intended target address for a second indirect branch instruction;   retrieve a second predicted target address for the second indirect branch instruction from the lookup table;   compare the second intended target address to the second predicted target address; and   increment the execution instruction counter when the second intended target address matches the second predicted target address.   
     
     
         49 . The at least one non-transitory computer-readable medium of  claim 48 , comprising instructions that, in response to being executed by the processor circuit, cause the processor circuit to reset the invalid target address counter and the execution instruction counter when the execution instruction counter is above an execution instruction threshold. 
     
     
         50 . The at least one non-transitory computer-readable medium of  claim 49 , comprising instructions that, in response to being executed by the processor circuit, cause the processor circuit to disable execution tracking when the execution instruction counter is above the execution instruction threshold.