RecurFI

Abstract

Although Control-Flow Integrity (CFI) presents a powerful software defense paradigm, it requires a significant runtime overhead in practice. The traditional coarse-grained CFI solutions such as Microsoft's Enhanced Mitigation Experience Toolkit (EMET) address this issue by compromising the security enforced by the original CFI. Unfortunately, though, due to its relaxed policy, new types of exploits have been emerging lately. In this thesis, we present RecurFI, a novel coarse-grained CFI solution that proposes a new sweet spot between security and performance. We define the CFI policies by capturing the general pattern of normal execution and examine recursively whether execution of the protected process satisfy the CFI policies or not. We show that RecurFI can detect all the exploits in our experiment with less than 2% runtime overhead on average.