  Return Oriented Programming (ROP) is a technique by which an attacker can
induce arbitrary behavior inside a vulnerable program without injecting a
malicious code. The continues failure of the currently deployed defenses
against ROP has made it again one of the most powerful memory corruption
attacks. ROP is also considered as one of the most flexible attacks, its level
of flexibility, unlike other code reuse attacks, can reach the Turing
completeness. Several efforts have been undertaken to study this threat and to
propose better defense mechanisms (mitigation or prevention), yet the majority
of them are not deeply reviewed nor officially implemented.Furthermore, similar
studies show that the techniques proposed to prevent ROP-based exploits usually
yield a high false-negative rate and a higher false-positive rate, not to
mention the overhead that they introduce into the protected program. The first
part of this research work aims at providing an in-depth analysis of the
currently available anti-ROP solutions (deployed and proposed), focusing on
inspecting their defense logic and summarizing their weaknesses and problems.
The second part of this work aims at introducing our proposed Indicators Of
Compromise (IOCs) that could be used to improve the detection rate of ROP
attacks. The three suggested indicators could detect these attacks at run-time
by checking the presence of some artifacts during the execution of the targeted
program.
