A Dual-Model Detection Framework Based on Address Validation and Boolean Control Flow: Runtime Software Attacks

Molou, Franck Alex Olivier ; Larsen, Casper Rømer Halling

4. semester

Cyber Security, Master

2025

2025-06-03

118 pages

Runtime software attacks pose a significant threat to embedded and IoT systems, particularly in safety-critical domains such as medical devices. Unlike traditional malware, these attacks hijack control flow without injecting new code, using techniques such as Return-Oriented Programming (ROP). This thesis explores both offensive and defensive aspects of runtime attacks through a vulnerable insulin pump controller as a real-world proof-of-concept. We first construct a functional ROP exploit on a standalone binary to demonstrate how attackers can bypass authentication and trigger unauthorized system calls using chained instruction-level gadgets. Building on this, we propose two lightweight runtime detection techniques for resource-constrained environments. The first method, Address-based ROP Detection (ARD), validates return addresses at runtime against a static whitelist of legitimate control-flow targets. The second method introduces a Boolean State Validator (BSVD) model that encodes program logic into Boolean state transitions, enabling semantic anomaly detection. Both techniques are implemented and evaluated using dynamic binary instrumentation (Intel PIN) and static analysis (Ghidra, angr). Results show reliable control-flow hijack detection with minimal overhead, without requiring source code or hardware changes.

Runtime software attacks pose a significant threat to embedded and IoT systems, particularly in safety-critical domains such as medical devices. Unlike traditional malware, these attacks hijack control flow without injecting new code, using techniques such as Return-Oriented Programming (ROP). This thesis explores both offensive and defensive aspects of runtime attacks through a vulnerable insulin pump controller as a real-world proof-of-concept. We first construct a functional ROP exploit on a standalone binary to demonstrate how attackers can bypass authentication and trigger unauthorized system calls using chained instruction-level gadgets. Building on this, we propose two lightweight runtime detection techniques for resource-constrained environments. The first method, Address-based ROP Detection (ARD), validates return addresses at runtime against a static whitelist of legitimate control-flow targets. The second method introduces a Boolean State Validator (BSVD) model that encodes program logic into Boolean state transitions, enabling semantic anomaly detection. Both techniques are implemented and evaluated using dynamic binary instrumentation (Intel PIN) and static analysis (Ghidra, angr). Results show reliable control-flow hijack detection with minimal overhead, without requiring source code or hardware changes.

Download
View record in AAU Student Projects