TLCFI-PLC: Trampoline-Based Lightweight Control Flow Integrity Scheme for Protecting PLC
Summary
PLCs (programmable logic controllers, specialized computers that control industrial systems) are at risk from RunStage Attacks, where attackers corrupt memory to hijack the program's control flow (the order in which instructions execute) and manipulate critical operations. TLCFI-PLC is a proposed defense system that uses trampoline-based instrumentation (a lightweight code insertion technique) to monitor and restrict control flow execution, splitting protection into an offline analysis phase that maps legitimate execution paths and an online monitoring phase that detects hijacking attempts. Testing on real PLCs showed the system adds minimal overhead (less than 1% file size increase) while staying within acceptable performance limits.
Solution / Mitigation
TLCFI-PLC is implemented as a two-phase scheme: (1) offline analysis phase that parses PLC binary control logic and employs trampoline-based instrumentation to constrain control flow execution while extracting legitimate target addresses and execution paths to construct a control flow integrity baseline, and (2) online detection phase where the instrumented PLC records runtime control flow information to shared memory and an asynchronous checker monitors execution paths to detect hijacking attempts. The prototype was implemented on a WAGO PLC running the CodeSys runtime environment.
Classification
Original source: http://ieeexplore.ieee.org/document/11612854
First tracked: August 23, 2026 at 02:01 AM
Classified by LLM (prompt v3) · confidence: 95%