  Return-Oriented Programming (ROP) is a software exploit for system
compromise. By chaining short instruction sequences from existing code pieces,
ROP can bypass static code-integrity checking approaches and non-executable
page protections. Existing defenses either require access to source code or
binary, a customized compiler or hardware modifications, or suffer from high
performance and storage overhead. In this work, we propose SIGDROP, a low-cost
approach for ROP detection which uses low-level properties inherent to ROP
attacks. Specifically, we observe special patterns of certain hardware events
when a ROP attack occurs during program execution. Such hardware event-based
patterns form signatures to flag ROP attacks at runtime. SIGDROP leverages
Hardware Performance Counters, which are already present in commodity
processors, to efficiently capture and extract the signatures. Our evaluation
demonstrates that SIGDROP can effectively detect ROP attacks with acceptable
performance overhead and negligible storage overhead.
