DeepCheck: A Non-intrusive Control-flow Integrity Checking based on Deep
  Learning
  Code reuse attack (CRA) is a powerful attack that reuses existing codes to
hijack the program control flow. Control flow integrity (CFI) is one of the
most popular mechanisms to prevent against CRAs. However, current CFI
techniques are difficult to be deployed in real applications due to suffering
several issues such as modifying binaries or compiler, extending instruction
set architectures (ISA) and incurring unacceptable runtime overhead. To address
these issues, we propose the first deep learning-based CFI technique, named
DeepCheck, where the control flow graph (CFG) is split into chains for deep
neural network (DNN) training. Then the integrity features of CFG can be
learned by DNN to detect abnormal control flows. DeepCheck does not interrupt
the application and hence incurs zero runtime overhead. Experimental results on
Adobe Flash Player, Nginx, Proftpd and Firefox show that the average detection
accuracy of DeepCheck is as high as 98.9%. In addition, 64 ROP exploits created
by ROPGadget and Ropper are used to further test the effectiveness, which shows
that the detection success rate reaches 100%.
