{"id":"https://openalex.org/W4378191980","doi":"https://doi.org/10.1109/host55118.2023.10132957","title":"Gadgets of Gadgets in Industrial Control Systems: Return Oriented Programming Attacks on PLCs","display_name":"Gadgets of Gadgets in Industrial Control Systems: Return Oriented Programming Attacks on PLCs","publication_year":2023,"publication_date":"2023-05-01","ids":{"openalex":"https://openalex.org/W4378191980","doi":"https://doi.org/10.1109/host55118.2023.10132957"},"language":"en","primary_location":{"id":"doi:10.1109/host55118.2023.10132957","is_oa":false,"landing_page_url":"https://doi.org/10.1109/host55118.2023.10132957","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2023 IEEE International Symposium on Hardware Oriented Security and Trust (HOST)","raw_type":"proceedings-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5057398935","display_name":"Adeen Ayub","orcid":"https://orcid.org/0000-0002-9623-5810"},"institutions":[{"id":"https://openalex.org/I184840846","display_name":"Virginia Commonwealth University","ror":"https://ror.org/02nkdxk79","country_code":"US","type":"education","lineage":["https://openalex.org/I184840846"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Adeen Ayub","raw_affiliation_strings":["Virginia Commonwealth University,Department of Computer Science,USA","Department of Computer Science, Virginia Commonwealth University, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Virginia Commonwealth University,Department of Computer Science,USA","institution_ids":["https://openalex.org/I184840846"]},{"raw_affiliation_string":"Department of Computer Science, Virginia Commonwealth University, USA","institution_ids":["https://openalex.org/I184840846"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5081114032","display_name":"Nauman Zubair","orcid":null},"institutions":[{"id":"https://openalex.org/I192396691","display_name":"University of New Orleans","ror":"https://ror.org/034mtvk83","country_code":"US","type":"education","lineage":["https://openalex.org/I192396691","https://openalex.org/I2799628689"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Nauman Zubair","raw_affiliation_strings":["University of New Orleans,Department of Computer Science,USA","Department of Computer Science, University of New Orleans, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of New Orleans,Department of Computer Science,USA","institution_ids":["https://openalex.org/I192396691"]},{"raw_affiliation_string":"Department of Computer Science, University of New Orleans, USA","institution_ids":["https://openalex.org/I192396691"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5019996334","display_name":"Hyunguk Yoo","orcid":null},"institutions":[{"id":"https://openalex.org/I192396691","display_name":"University of New Orleans","ror":"https://ror.org/034mtvk83","country_code":"US","type":"education","lineage":["https://openalex.org/I192396691","https://openalex.org/I2799628689"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Hyunguk Yoo","raw_affiliation_strings":["University of New Orleans,Department of Computer Science,USA","Department of Computer Science, University of New Orleans, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of New Orleans,Department of Computer Science,USA","institution_ids":["https://openalex.org/I192396691"]},{"raw_affiliation_string":"Department of Computer Science, University of New Orleans, USA","institution_ids":["https://openalex.org/I192396691"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5047917288","display_name":"Wooyeon Jo","orcid":"https://orcid.org/0000-0002-6595-0117"},"institutions":[{"id":"https://openalex.org/I184840846","display_name":"Virginia Commonwealth University","ror":"https://ror.org/02nkdxk79","country_code":"US","type":"education","lineage":["https://openalex.org/I184840846"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Wooyeon Jo","raw_affiliation_strings":["Virginia Commonwealth University,Department of Computer Science,USA","Department of Computer Science, Virginia Commonwealth University, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Virginia Commonwealth University,Department of Computer Science,USA","institution_ids":["https://openalex.org/I184840846"]},{"raw_affiliation_string":"Department of Computer Science, Virginia Commonwealth University, USA","institution_ids":["https://openalex.org/I184840846"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5063509441","display_name":"Irfan Ahmed","orcid":"https://orcid.org/0000-0001-5648-388X"},"institutions":[{"id":"https://openalex.org/I184840846","display_name":"Virginia Commonwealth University","ror":"https://ror.org/02nkdxk79","country_code":"US","type":"education","lineage":["https://openalex.org/I184840846"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Irfan Ahmed","raw_affiliation_strings":["Virginia Commonwealth University,Department of Computer Science,USA","Department of Computer Science, Virginia Commonwealth University, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Virginia Commonwealth University,Department of Computer Science,USA","institution_ids":["https://openalex.org/I184840846"]},{"raw_affiliation_string":"Department of Computer Science, Virginia Commonwealth University, USA","institution_ids":["https://openalex.org/I184840846"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":1.6485,"has_fulltext":false,"cited_by_count":10,"citation_normalized_percentile":{"value":0.8608162,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":94,"max":98},"biblio":{"volume":null,"issue":null,"first_page":"215","last_page":"226"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.9998000264167786,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.9998000264167786,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9991000294685364,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12122","display_name":"Physical Unclonable Functions (PUFs) and Hardware Security","score":0.9975000023841858,"subfield":{"id":"https://openalex.org/subfields/1708","display_name":"Hardware and Architecture"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.789520263671875},{"id":"https://openalex.org/keywords/programmable-logic-controller","display_name":"Programmable logic controller","score":0.667110800743103},{"id":"https://openalex.org/keywords/control-logic","display_name":"Control logic","score":0.6049849987030029},{"id":"https://openalex.org/keywords/embedded-system","display_name":"Embedded system","score":0.5615043640136719},{"id":"https://openalex.org/keywords/industrial-control-system","display_name":"Industrial control system","score":0.5162701606750488},{"id":"https://openalex.org/keywords/network-packet","display_name":"Network packet","score":0.4888705611228943},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.3511272072792053},{"id":"https://openalex.org/keywords/control","display_name":"Control (management)","score":0.33796215057373047},{"id":"https://openalex.org/keywords/operating-system","display_name":"Operating system","score":0.3145162761211395},{"id":"https://openalex.org/keywords/computer-hardware","display_name":"Computer hardware","score":0.22562682628631592}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.789520263671875},{"id":"https://openalex.org/C37374048","wikidata":"https://www.wikidata.org/wiki/Q188674","display_name":"Programmable logic controller","level":2,"score":0.667110800743103},{"id":"https://openalex.org/C2776350369","wikidata":"https://www.wikidata.org/wiki/Q843479","display_name":"Control logic","level":2,"score":0.6049849987030029},{"id":"https://openalex.org/C149635348","wikidata":"https://www.wikidata.org/wiki/Q193040","display_name":"Embedded system","level":1,"score":0.5615043640136719},{"id":"https://openalex.org/C40071531","wikidata":"https://www.wikidata.org/wiki/Q2513962","display_name":"Industrial control system","level":3,"score":0.5162701606750488},{"id":"https://openalex.org/C158379750","wikidata":"https://www.wikidata.org/wiki/Q214111","display_name":"Network packet","level":2,"score":0.4888705611228943},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.3511272072792053},{"id":"https://openalex.org/C2775924081","wikidata":"https://www.wikidata.org/wiki/Q55608371","display_name":"Control (management)","level":2,"score":0.33796215057373047},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.3145162761211395},{"id":"https://openalex.org/C9390403","wikidata":"https://www.wikidata.org/wiki/Q3966","display_name":"Computer hardware","level":1,"score":0.22562682628631592},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/host55118.2023.10132957","is_oa":false,"landing_page_url":"https://doi.org/10.1109/host55118.2023.10132957","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2023 IEEE International Symposium on Hardware Oriented Security and Trust (HOST)","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[],"funders":[{"id":"https://openalex.org/F4320306110","display_name":"U.S. Department of Homeland Security","ror":"https://ror.org/00jyr0d86"}],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":55,"referenced_works":["https://openalex.org/W53119127","https://openalex.org/W152620456","https://openalex.org/W1876033015","https://openalex.org/W1963947298","https://openalex.org/W1976837639","https://openalex.org/W2002578057","https://openalex.org/W2015655574","https://openalex.org/W2025394175","https://openalex.org/W2033773771","https://openalex.org/W2041078517","https://openalex.org/W2098010707","https://openalex.org/W2159216827","https://openalex.org/W2162800072","https://openalex.org/W2313420215","https://openalex.org/W2561791320","https://openalex.org/W2570433379","https://openalex.org/W2594635183","https://openalex.org/W2600332792","https://openalex.org/W2613412685","https://openalex.org/W2613654158","https://openalex.org/W2742236820","https://openalex.org/W2768270002","https://openalex.org/W2791587036","https://openalex.org/W2801080689","https://openalex.org/W2898466078","https://openalex.org/W2945937333","https://openalex.org/W2946606376","https://openalex.org/W2948592548","https://openalex.org/W2952754944","https://openalex.org/W2959428502","https://openalex.org/W2971297766","https://openalex.org/W3036981874","https://openalex.org/W3048367981","https://openalex.org/W3091997824","https://openalex.org/W3108707471","https://openalex.org/W3111411071","https://openalex.org/W3151425564","https://openalex.org/W3171138449","https://openalex.org/W3177650213","https://openalex.org/W3185775967","https://openalex.org/W3186896525","https://openalex.org/W4221103416","https://openalex.org/W4221118516","https://openalex.org/W4287301415","https://openalex.org/W4292002670","https://openalex.org/W4327939490","https://openalex.org/W4327939593","https://openalex.org/W6602098182","https://openalex.org/W6606141063","https://openalex.org/W6683671222","https://openalex.org/W6730803111","https://openalex.org/W6734670938","https://openalex.org/W6763259340","https://openalex.org/W6779398090","https://openalex.org/W6786817275"],"related_works":["https://openalex.org/W2768165469","https://openalex.org/W4312858719","https://openalex.org/W2600332792","https://openalex.org/W2728426605","https://openalex.org/W4253069238","https://openalex.org/W3111767900","https://openalex.org/W2966748955","https://openalex.org/W4377710638","https://openalex.org/W4389279166","https://openalex.org/W2889239165"],"abstract_inverted_index":{"In":[0],"industrial":[1],"control":[2,10,29,42,108,247,277,296],"systems":[3,63],"(ICS),":[4],"programmable":[5],"logic":[6,30,43,109,248,278,297],"controllers":[7],"(PLCs)":[8],"directly":[9],"and":[11,21,53,84,171,197,202,228,263,279],"monitor":[12],"physical":[13,39,253],"processes":[14],"in":[15,50,79,114,131,175,302],"real-time":[16],"such":[17],"as":[18,120,194],"nuclear":[19],"plants,":[20],"power":[22],"grid":[23],"stations.":[24],"Adversaries":[25],"typically":[26],"transfer":[27,95],"malicious":[28,86],"to":[31,36,56,82,94,117,134,164,179,185,212,221,231],"PLCs":[32,223],"over":[33,98],"the":[34,66,92,99,115,128,166,186,246,290,311],"network":[35,51,60],"sabotage":[37],"a":[38,121,138,147,161,176,256,260,264,274,285,295,303,317,327],"process.":[40],"These":[41],"attacks":[44,106,219,244,312],"are":[45,54],"well-understood":[46],"containing":[47],"machine":[48,96],"instructions":[49,97,183],"packets":[52],"likely":[55],"be":[57,314],"detected":[58],"by":[59],"intrusion":[61],"detection":[62],"(IDS).":[64],"On":[65],"other":[67],"hand,":[68],"return-oriented":[69],"programming":[70,191],"(ROP)":[71],"reuses":[72],"blocks":[73,181],"(or":[74],"gadgets)":[75],"of":[76,182,189,250,319],"existing":[77],"code":[78],"computer":[80],"memory":[81,178,234],"create":[83],"execute":[85],"code.":[87],"It":[88],"limits":[89],"or":[90,287],"eliminates":[91],"need":[93],"network,":[100],"making":[101],"it":[102,119],"stealthier.":[103],"Currently,":[104],"ROP":[105,140,154,173,218,243,271,292],"on":[107,142,245,326],"has":[110,280],"never":[111],"been":[112],"discussed":[113],"literature":[116],"explore":[118,135],"practical":[122],"ICS":[123,237],"attack.":[124],"This":[125],"paper":[126],"is":[127],"first":[129,270],"attempt":[130],"this":[132],"direction":[133],"challenges":[136],"for":[137,168],"successful":[139,242],"attack":[141,272,293],"real-world":[143],"PLCs,":[144],"including":[145],"maintaining":[146],"continuous":[148],"(control":[149],"logic)":[150],"scan":[151,329],"cycle":[152],"through":[153],"gadgets,":[155],"no":[156,225,323],"user":[157],"input":[158],"(to":[159],"cause":[160],"buffer":[162],"overflow)":[163],"overwrite":[165],"stack":[167,226],"gadget":[169],"installation,":[170],"limited":[172],"gadgets":[174,301,321],"PLC":[177,190,205,233],"find":[180,210],"equivalent":[184],"high-level":[187],"constructs":[188,294],"languages":[192],"(such":[193],"instruction":[195],"list,":[196],"ladder":[198],"logic).":[199],"We":[200,239],"identify":[201],"utilize":[203],"typical":[204],"design":[206],"features":[207],"(that":[208],"we":[209],"exploitable)":[211],"overcome":[213],"these":[214],"challenges,":[215],"which":[216],"makes":[217],"applicable":[220],"most":[222],"e.g.,":[224],"protection,":[227],"remote":[229],"access":[230],"certain":[232],"regions":[235],"via":[236],"protocols.":[238],"demonstrate":[240],"two":[241,281],"programs":[249],"three":[251],"fully-functional":[252],"processes,":[254],"i.e.,":[255],"belt":[257],"conveyor":[258],"system,":[259],"four-floor":[261],"elevator,":[262],"compact":[265],"traffic":[266],"light":[267],"system.":[268],"The":[269],"manipulates":[273],"PLC\u2019s":[275,304,328],"current":[276],"variants":[282],"involving":[283],"either":[284],"single":[286],"multiple":[288],"gadgets;":[289],"second":[291],"from":[298],"scratch":[299],"using":[300,316],"memory.":[305],"Our":[306],"evaluation":[307],"results":[308],"show":[309],"that":[310],"can":[313],"performed":[315],"set":[318],"small-sized":[320],"with":[322],"significant":[324],"effect":[325],"time.":[330]},"counts_by_year":[{"year":2026,"cited_by_count":1},{"year":2025,"cited_by_count":3},{"year":2024,"cited_by_count":2},{"year":2023,"cited_by_count":4}],"updated_date":"2026-07-01T08:55:40.977307","created_date":"2025-10-10T00:00:00"}