Control-Flow Attestation (CFA) is a security service that allows an entity
(verifier) to verify the integrity of code execution on a remote computer
system (prover). Existing CFA schemes suffer from impractical assumptions, such
as requiring access to the prover's internal state (e.g., memory or code), the
complete Control-Flow Graph (CFG) of the prover's software, large sets of
measurements, or tailor-made hardware. Moreover, current CFA schemes are
inadequate for attesting embedded systems due to their high computational
overhead and resource usage.
In this paper, we overcome the limitations of existing CFA schemes for
embedded devices by introducing RAGE, a novel, lightweight CFA approach with
minimal requirements. RAGE can detect Code Reuse Attacks (CRA), including
control- and non-control-data attacks. It efficiently extracts features from
one execution trace and leverages Unsupervised Graph Neural Networks (GNNs) to
identify deviations from benign executions. The core intuition behind RAGE is
to exploit the correspondence between execution trace, execution graph, and
execution embeddings to eliminate the unrealistic requirement of having access
to a complete CFG.
We evaluate RAGE on embedded benchmarks and demonstrate that (i) it detects
40 real-world attacks on embedded software; (ii) Further, we stress our scheme
with synthetic return-oriented programming (ROP) and data-oriented programming
(DOP) attacks on the real-world embedded software benchmark Embench, achieving
98.03% (ROP) and 91.01% (DOP) F1-Score while maintaining a low False Positive
Rate of 3.19%; (iii) Additionally, we evaluate RAGE on OpenSSL, used by
millions of devices and achieve 97.49% and 84.42% F1-Score for ROP and DOP
attack detection, with an FPR of 5.47%.

我们介绍了一种新颖的轻量级 CFA 方法 RAGE，用于嵌入式设备中，它能够检测代码重用攻击，包括控制和非控制数据攻击，并通过使用无监督图神经网络来识别对正常执行的偏离，而无需完整的控制流图。通过在嵌入式基准测试和 OpenSSL 上进行评估，我们证明了 RAGE 的有效性。