Run-time detection of buffer overflow attacks without explicit sensor data objects

Abstract

This paper presents two schemes for detecting buffer overflow attacks at run-time. One is sensor embedding, which hides sensor data objects inside code pointers, and the other stack frame inversion checking, which detects attacks by inspecting processor registers. Our methods make it difficult for attackers to guess the locations of sensors so that they cannot easily bypass sensors when they attempt to access code pointers. We have implemented the schemes by extending the GCC toolchain. Experimental data shows that our schemes provide programs with powerful detection and protection capabilities at the reasonable sacrifice of execution efficiency. Operating systems would improve on the defense against buffer overflow attacks by using our toolchain when they are built.