Return-oriented programming (ROP) is a code reuse attack that chains short snippets of existing code to perform arbitrary operations on target machines. Existing detection methods against ROP exhibit unsatisfactory detection accuracy and/or have high runtime overhead. In this paper, we present ROPNN, which innovatively combines address space layout guided disassembly and deep neural networks to detect ROP payloads. The disassembler treats application input data as code pointers and aims to find any potential gadget chains, which are then classified by a deep neural network as benign or malicious. Our experiments show that ROPNN has high detection rate (99.3%) and a very low false positive rate (0.01%). ROPNN successfully detects all of the 100 real-world ROP exploits that are collected in-the-wild, created manually or created by ROP exploit generation tools. Additionally, ROPNN detects all 10 ROP exploits that can bypass Bin-CFI. ROPNN is non-intrusive and does not incur any runtime overhead to the protected program.

翻译：返回导向编程（ROP）是一种代码复用攻击，通过拼接现有代码的短片段在目标机器上执行任意操作。现有ROP检测方法存在检测精度不理想和/或运行时开销高的问题。本文提出ROPNN，创新性地结合了地址空间布局引导的反汇编技术与深度神经网络来检测ROP载荷。该反汇编器将应用程序输入数据视为代码指针，旨在发现任何潜在的工具链（gadget chain），随后由深度神经网络将其分类为良性或恶意。实验表明，ROPNN具有高检测率（99.3%）和极低误报率（0.01%）。ROPNN成功检测了所有100个真实世界ROP漏洞利用样本——包括野外采集、人工构建或由ROP漏洞利用生成工具创建的样本。此外，ROPNN能检测所有10个可绕过Bin-CFI的ROP漏洞利用。ROPNN具有非侵入性，不会对被保护程序产生任何运行时开销。