{"id":"https://openalex.org/W70478248","doi":null,"title":"Transparent ROP exploit mitigation using indirect branch tracing","display_name":"Transparent ROP exploit mitigation using indirect branch tracing","publication_year":2013,"publication_date":"2013-08-14","ids":{"openalex":"https://openalex.org/W70478248","mag":"70478248"},"language":"en","primary_location":{"id":"mag:70478248","doi":null,"is_oa":false,"landing_page_url":"http://0b4af6cdc2f0c5998459-c0245c5c937c5dedcca3f1764ecc9b2f.r43.cf2.rackcdn.com/12320-sec13-paper_pappas.pdf","pdf_url":null,"source":{"id":"https://openalex.org/S4306421123","display_name":"USENIX Security Symposium","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"conference"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":"USENIX Security Symposium","raw_type":null},"parent_works":[],"lineage":["https://openalex.org/W70478248"],"child_works_count":0,"type":"conference-paper","is_traditional":true,"indexed_in":[],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5109877424","display_name":"Vasilis Pappas","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I78577930","display_name":"Columbia University","ror":"https://ror.org/00hj8s172","country_code":"US","type":"education","lineage":["https://openalex.org/I78577930"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Vasilis Pappas","raw_affiliation_strings":["Columbia University"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Columbia University","institution_ids":["https://openalex.org/I78577930"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5007101727","display_name":"Michalis Polychronakis","orcid":"https://orcid.org/0000-0002-3106-0343","observed_orcids":["https://orcid.org/0000-0002-3106-0343"]},"institutions":[{"id":"https://openalex.org/I78577930","display_name":"Columbia University","ror":"https://ror.org/00hj8s172","country_code":"US","type":"education","lineage":["https://openalex.org/I78577930"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Michalis Polychronakis","raw_affiliation_strings":["Columbia University"],"raw_orcid":"https://orcid.org/0000-0002-3106-0343","affiliations":[{"raw_affiliation_string":"Columbia University","institution_ids":["https://openalex.org/I78577930"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5023057383","display_name":"Angelos Dennis Keromytis","orcid":"https://orcid.org/0000-0003-3815-5932","observed_orcids":["https://orcid.org/0000-0003-3815-5932"]},"institutions":[{"id":"https://openalex.org/I78577930","display_name":"Columbia University","ror":"https://ror.org/00hj8s172","country_code":"US","type":"education","lineage":["https://openalex.org/I78577930"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Angelos D. Keromytis","raw_affiliation_strings":["Columbia University"],"raw_orcid":"https://orcid.org/0000-0003-3815-5932","affiliations":[{"raw_affiliation_string":"Columbia University","institution_ids":["https://openalex.org/I78577930"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I78577930"],"apc_list":null,"apc_paid":null,"fwci":21.4392,"has_fulltext":false,"cited_by_count":274,"citation_normalized_percentile":{"value":0.99830461,"is_in_top_1_percent":true,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":96,"max":100},"biblio":{"volume":null,"issue":null,"first_page":"447","last_page":"462"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1708","display_name":"Hardware and Architecture"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1708","display_name":"Hardware and Architecture"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.0,"subfield":{"id":"https://openalex.org/subfields/1712","display_name":"Software"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10743","display_name":"Software Testing and Debugging Techniques","score":0.0,"subfield":{"id":"https://openalex.org/subfields/1712","display_name":"Software"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/return-oriented-programming","display_name":"return-oriented programming","score":0.996999979019165},{"id":"https://openalex.org/keywords/indirect-branch-prediction","display_name":"indirect branch prediction","score":0.5799999833106995},{"id":"https://openalex.org/keywords/windows-7","display_name":"Windows 7","score":0.6179999709129333},{"id":"https://openalex.org/keywords/runtime-overhead","display_name":"runtime overhead","score":0.47600001096725464}],"concepts":[{"id":"https://openalex.org/C165696696","wikidata":"https://www.wikidata.org/wiki/Q11287","display_name":"Exploit","level":2,"score":0.9147233366966248},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8240439891815186},{"id":"https://openalex.org/C2779960059","wikidata":"https://www.wikidata.org/wiki/Q7113681","display_name":"Overhead (engineering)","level":2,"score":0.5521498918533325},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.532592236995697},{"id":"https://openalex.org/C160145156","wikidata":"https://www.wikidata.org/wiki/Q778586","display_name":"Executable","level":2,"score":0.49630647897720337},{"id":"https://openalex.org/C149635348","wikidata":"https://www.wikidata.org/wiki/Q193040","display_name":"Embedded system","level":1,"score":0.48701411485671997},{"id":"https://openalex.org/C78766204","wikidata":"https://www.wikidata.org/wiki/Q555032","display_name":"Multi-core processor","level":2,"score":0.43968671560287476},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.22713586688041687}],"mesh":[],"locations_count":1,"locations":[{"id":"mag:70478248","doi":null,"is_oa":false,"landing_page_url":"http://0b4af6cdc2f0c5998459-c0245c5c937c5dedcca3f1764ecc9b2f.r43.cf2.rackcdn.com/12320-sec13-paper_pappas.pdf","pdf_url":null,"source":{"id":"https://openalex.org/S4306421123","display_name":"USENIX Security Symposium","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"conference"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":"USENIX Security Symposium","raw_type":null}],"best_oa_location":null,"sustainable_development_goals":[],"study_designs":[],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":35,"referenced_works":["https://openalex.org/W1112477","https://openalex.org/W74995240","https://openalex.org/W1515653707","https://openalex.org/W1529311848","https://openalex.org/W1545927878","https://openalex.org/W1551225951","https://openalex.org/W1593678010","https://openalex.org/W1963947298","https://openalex.org/W1964281299","https://openalex.org/W1982829328","https://openalex.org/W1984187936","https://openalex.org/W1996931407","https://openalex.org/W2009801020","https://openalex.org/W2027963645","https://openalex.org/W2074943483","https://openalex.org/W2086277109","https://openalex.org/W2087300543","https://openalex.org/W2098010707","https://openalex.org/W2106462763","https://openalex.org/W2109219878","https://openalex.org/W2111817346","https://openalex.org/W2115539010","https://openalex.org/W2121468041","https://openalex.org/W2123436168","https://openalex.org/W2132806808","https://openalex.org/W2134633067","https://openalex.org/W2138517425","https://openalex.org/W2152644030","https://openalex.org/W2154555738","https://openalex.org/W2158438481","https://openalex.org/W2162800072","https://openalex.org/W2168843528","https://openalex.org/W2171143790","https://openalex.org/W2171929398","https://openalex.org/W2238842336"],"related_works":["https://openalex.org/W7097754848","https://openalex.org/W2130659827","https://openalex.org/W7100202050","https://openalex.org/W2158389625","https://openalex.org/W2009801020","https://openalex.org/W7100361121","https://openalex.org/W995370299","https://openalex.org/W7099910258","https://openalex.org/W1851018411","https://openalex.org/W3199622058"],"abstract_inverted_index":{"Return-oriented":[0],"programming":[1],"(ROP)":[2],"has":[3,140,163],"become":[4],"the":[5,13,25,34,56,66,104,122],"primary":[6],"exploitation":[7],"technique":[8,54],"for":[9,55,95,109,118,166],"system":[10],"compromise":[11],"in":[12,121],"presence":[14,35],"of":[15,27,36,58,68,85,134,144],"non-executable":[16],"page":[17],"protections.":[18],"ROP":[19,51,76,175],"exploits":[20],"are":[21],"facilitated":[22],"mainly":[23],"by":[24],"lack":[26],"complete":[28],"address":[29],"space":[30],"randomization":[31],"coverage":[32],"or":[33],"memory":[37],"disclosure":[38],"vulnerabilities,":[39],"necessitating":[40],"additional":[41],"ROP-specific":[42],"mitigations.\r\n\r\nIn":[43],"this":[44],"paper":[45],"we":[46],"present":[47],"a":[48],"practical":[49],"runtime":[50,91,142],"exploit":[52],"prevention":[53],"protection":[57],"third-party":[59],"applications.":[60,106,169],"Our":[61,107],"approach":[62],"is":[63,80],"based":[64],"on":[65],"detection":[67,159],"abnormal":[69],"control":[70],"transfers":[71],"that":[72,138,154],"take":[73],"place":[74],"during":[75],"code":[77],"execution.":[78],"This":[79],"achieved":[81],"using":[82],"hardware":[83],"features":[84],"commodity":[86],"processors,":[87],"which":[88],"incur":[89],"negligible":[90,164],"overhead":[92,143,165],"and":[93,189],"allow":[94],"completely":[96],"transparent":[97],"operation":[98],"without":[99],"requiring":[100],"any":[101],"modifications":[102],"to":[103,146],"protected":[105,179],"implementation":[108],"Windows":[110],"7,":[111],"named":[112],"kBouncer,":[113],"can":[114],"be":[115],"selectively":[116],"enabled":[117],"installed":[119],"programs":[120],"same":[123],"fashion":[124],"as":[125],"user-friendly":[126],"mitigation":[127],"toolkits":[128],"like":[129],"Microsoft's":[130],"EMET.":[131],"The":[132],"results":[133],"our":[135,171],"evaluation":[136],"demonstrate":[137],"kBouncer":[139,177],"low":[141],"up":[145],"4%,":[147],"when":[148],"stressed":[149],"with":[150,173],"specially":[151],"crafted":[152],"workloads":[153],"continuously":[155],"trigger":[156],"its":[157],"core":[158],"component,":[160],"while":[161],"it":[162],"actual":[167],"user":[168],"In":[170],"experiments":[172],"in-the-wild":[174],"exploits,":[176],"successfully":[178],"all":[180],"tested":[181],"applications,":[182],"including":[183],"Internet":[184],"Explorer,":[185],"Adobe":[186,190],"Flash":[187],"Player,":[188],"Reader.":[191]},"counts_by_year":[{"year":2025,"cited_by_count":5},{"year":2024,"cited_by_count":6},{"year":2023,"cited_by_count":4},{"year":2022,"cited_by_count":7},{"year":2021,"cited_by_count":17},{"year":2020,"cited_by_count":24},{"year":2019,"cited_by_count":24},{"year":2018,"cited_by_count":28},{"year":2017,"cited_by_count":43},{"year":2016,"cited_by_count":50},{"year":2015,"cited_by_count":49},{"year":2014,"cited_by_count":17}],"updated_date":"2026-11-04T10:54:05.112534","created_date":"2016-06-24T00:00:00"}