Subtopic Deep Dive

Control-Flow Integrity
Research Guide

What is Control-Flow Integrity?

Control-Flow Integrity (CFI) is a security technique that enforces valid control transfers in software to prevent code-reuse attacks like ROP and JOP by ensuring execution follows the intended program control-flow graph.

Introduced by Abadi et al. (2005) with 1015 citations, CFI uses compiler instrumentation or hardware support to validate indirect branches. It protects against exploits that hijack control flow without altering code. Over 100 papers build on this foundational work.

15
Curated Papers
3
Key Challenges

Why It Matters

CFI counters dominant code-reuse exploits in real-world systems, as shown in Abadi et al. (2005), enabling deployment in browsers and OSes. Newsome and Song (2005) demonstrate its role in detecting exploits via dynamic analysis, reducing worm propagation like CodeRed. Schneider (2000) provides the policy foundation for enforceable CFI mechanisms, impacting industrial defenses.

Key Research Challenges

Fine-grained CFI Overhead

Coarse-grained CFI offers low overhead but weak protection against JOP (Abadi et al., 2005). Fine-grained policies require context-sensitive checks, increasing runtime costs. Hardware acceleration remains underexplored for scalability.

Handling Indirect Branches

Validating indirect jumps and calls demands precise control-flow graphs (Abadi et al., 2005). Dynamic code and multi-version binaries complicate static analysis. Taint tracking aids detection but struggles with real-time enforcement (Newsome and Song, 2005).

Compatibility with Legacies

Retrofitting legacy C/C++ codebases breaks binary compatibility (Abadi et al., 2005). Compiler-based insertion conflicts with optimizations. Schneider (2000) notes policy expressiveness limits retroactive enforcement.

Essential Papers

1.

Hyperledger fabric

Elli Androulaki, Artem Barger, Vita Bortnikov et al. · 2018 · 3.2K citations

Fabric is a modular and extensible open-source system for deploying and operating permissioned blockchains and one of the Hyperledger projects hosted by the Linux Foundation (www.hyperledger.org). ...

2.

A lattice model of secure information flow

Dorothy E. Denning · 1976 · Communications of the ACM · 1.9K citations

This paper investigates mechanisms that guarantee secure information flow in a computer system. These mechanisms are examined within a mathematical framework suitable for formulating the requiremen...

3.

Language-based information-flow security

Andrei Sabelfeld, Andrew C. Myers · 2003 · IEEE Journal on Selected Areas in Communications · 1.9K citations

Current standard security practices do not provide substantial assurance that the end-to-end behavior of a computing system satisfies important security policies such as confidentiality. An end-to-...

4.

Guide to Industrial Control Systems (ICS) Security

Keith Stouffer, Victoria Pillitteri, Suzanne Lightman et al. · 2015 · 1.3K citations

3541 et seq., Public Law (P.L.) 113-283.NIST is responsible for developing information security standards and guidelines, including minimum requirements for federal information systems, but such st...

5.

Dynamic Taint Analysis for Automatic Detection, Analysis, and Signature Generation of Exploits on Commodity Software

James Newsome, Dawn Song · 2005 · OPAL (Open@LaTrobe) (La Trobe University) · 1.3K citations

Software vulnerabilities have had a devastating effect on the Internet. Worms such as CodeRed and Slammer can compromise hundreds of thousands of hosts within hours or even minutes, and cause milli...

6.

Enforceable security policies

Fred B. Schneider · 2000 · ACM Transactions on Information and System Security · 1.3K citations

A precise characterization is given for the class of security policies enforceable with mechanisms that work by monitoring system execution, and automata are introduced for specifying exactly that ...

7.

TaintDroid

William Enck, Peter Gilbert, Seungyeop Han et al. · 2014 · ACM Transactions on Computer Systems · 1.1K citations

Today’s smartphone operating systems frequently fail to provide users with visibility into how third-party applications collect and share their private data. We address these shortcomings with Tain...

Reading Guide

Foundational Papers

Start with Abadi et al. (2005) for CFI definition and prototype; Schneider (2000) for policy foundations; Newsome and Song (2005) for taint-based exploit context.

Recent Advances

Recent works extend Abadi (2005) to hardware CFI and mobile systems; check citationGraph for 2015+ advances.

Core Methods

Static CFG construction, dynamic branch validation, taint propagation (Abadi et al., 2005; Newsome and Song, 2005).

How PapersFlow Helps You Research Control-Flow Integrity

Discover & Search

Research Agent uses searchPapers('control-flow integrity ROP') to find Abadi et al. (2005), then citationGraph reveals 100+ forward citations including taint analysis extensions. exaSearch uncovers hardware CFI implementations, while findSimilarPapers connects to Newsome and Song (2005) for exploit detection links.

Analyze & Verify

Analysis Agent runs readPaperContent on Abadi et al. (2005) to extract CFI algorithms, then verifyResponse with CoVe cross-checks claims against Schneider (2000). runPythonAnalysis parses performance tables from 50 CFI papers using pandas to compute average overhead (GRADE: A for empirical rigor).

Synthesize & Write

Synthesis Agent detects gaps in fine-grained CFI via contradiction flagging across papers, then Writing Agent uses latexEditText and latexSyncCitations to draft CFI survey sections citing Abadi et al. (2005). latexCompile generates PDF with exportMermaid diagrams of control-flow graphs.

Use Cases

"Compare runtime overhead of CFI implementations across 20 papers"

Research Agent → searchPapers → Analysis Agent → runPythonAnalysis(pandas aggregation of tables) → CSV export with stats (mean 5-15% slowdown).

"Write LaTeX appendix on CFI policy models with citations"

Synthesis Agent → gap detection → Writing Agent → latexEditText + latexSyncCitations(Abadi 2005, Schneider 2000) → latexCompile → PDF output.

"Find GitHub repos implementing Abadi's CFI prototype"

Research Agent → paperExtractUrls(Abadi 2005) → Code Discovery → paperFindGithubRepo → githubRepoInspect → verified implementation code.

Automated Workflows

Deep Research scans 50+ CFI papers via searchPapers → citationGraph → structured report with overhead meta-analysis. DeepScan applies 7-step verification: readPaperContent(Abadi) → CoVe → runPythonAnalysis → GRADE grading. Theorizer generates new CFI policies from Schneider (2000) enforcement automata.

Frequently Asked Questions

What is Control-Flow Integrity?

CFI enforces legitimate control transfers to block ROP/JOP attacks (Abadi et al., 2005).

What are core CFI methods?

Compiler instrumentation inserts checks at indirect branches; hardware uses tagged pointers (Abadi et al., 2005).

What are key CFI papers?

Abadi et al. (2005, 1015 citations) introduced CFI; Schneider (2000) formalized enforceable policies.

What are open CFI problems?

Scalable fine-grained enforcement and legacy binary support remain unsolved (Abadi et al., 2005).

Research Security and Verification in Computing with AI

PapersFlow provides specialized AI tools for Computer Science researchers. Here are the most relevant for this topic:

See how researchers in Computer Science & AI use PapersFlow

Field-specific workflows, example queries, and use cases.

Computer Science & AI Guide

Start Researching Control-Flow Integrity with AI

Search 474M+ papers, run AI-powered literature reviews, and write with integrated citations — all in one workspace.

See how PapersFlow works for Computer Science researchers