US 11,853,414 B2
Mitigation of return-oriented programming attacks
Erik Jan Loman, Hengelo (NL); Lute Edwin Engels, Zuidwolde (NL); Andrew J. Thomas, Oxfordshire (GB); and Kenneth D. Ray, Seattle, WA (US)
Assigned to Sophos Limited, Abingdon (GB)
Filed by Sophos Limited, Abingdon (GB)
Filed on Nov. 16, 2021, as Appl. No. 17/527,706.
Application 17/527,706 is a continuation of application No. 16/848,105, filed on Apr. 14, 2020, granted, now 11,194,900.
Application 16/848,105 is a continuation of application No. 15/667,847, filed on Aug. 3, 2017, granted, now 10,650,141, issued on May 12, 2020.
Claims priority of provisional application 62/370,680, filed on Aug. 3, 2016.
Prior Publication US 2022/0075868 A1, Mar. 10, 2022
Int. Cl. G06F 21/54 (2013.01); G06F 21/56 (2013.01)
CPC G06F 21/54 (2013.01) [G06F 21/566 (2013.01); G06F 2221/034 (2013.01)] 20 Claims
OG exemplary drawing
 
1. A computer program product comprising computer executable code embodied in a non-transitory computer readable medium that, when executing on one or more computing devices, suppresses false positive indications of return-oriented programming attacks by performing the steps of:
deploying a security measure to detect control-flow integrity compromises indicative of a return-oriented programming (ROP) exploit on a computing device;
receiving a report of a possible ROP exploit from the security measure, the report including contextual information for the possible ROP exploit, wherein the contextual information further includes path information for one or more files associated with the possible ROP exploit and branch information for one or more processes associated with the possible ROP exploit;
normalizing the report to isolate machine-specific variations in the path information and the branch information;
hashing the normalized report to provide a hashed report;
pre-filtering the hashed report with a filter to determine if the report belongs to a collection of known false-positive reports; and
in response to determining, based on applying the filter to the hashed report, that the report of the possible ROP exploit does not belong to a collection of known false-positive reports, responding to the report with a remediation for the possible ROP exploit.