TLCFI-PLC: Trampoline-Based Lightweight Control Flow Integrity Scheme for Protecting PLC

Abstract

Programmable Logic Controllers (PLCs) are core components of Industrial Control System (ICS), and their security is essential for the reliable operation of critical infrastructure. However, PLCs are vulnerable to RunStage Attacks, which are runtime attacks that occur when the PLC is in the “Run” mode executing control logic. In the class of RunStage Attacks considered in this work, adversaries corrupt memory and hijack control flow to manipulate control logic. Due to the limited resources and stringent real-time requirements of PLCs, existing control flow defense schemes still suffer from shortcomings in resource usage and real-time performance. To address these challenges, we propose TLCFI-PLC, a trampoline-based lightweight control flow integrity scheme for defending against RunStage control flow hijacking attacks. The scheme consists of two phases: offline analysis and online monitoring. In the offline analysis phase, TLCFI-PLC parses the PLC binary control logic and employs trampoline-based instrumentation to constrain control flow execution, avoiding large-scale rewriting that could alter the memory layout or program size. It then extracts legitimate target addresses and execution paths to construct a control flow integrity baseline. In the online detection phase, the instrumented PLC records runtime control flow information to shared memory, where an asynchronous checker monitors execution paths and detects hijacking attempts. We implemented a prototype on a WAGO PLC running the CodeSys runtime environment. Experiments show that, among the 248 selected case studies, the sizes of the processed files ranged from 44 KB to 552 KB, and the instrumentation time was generally less than 5 seconds. Two supplementary sets of 10 binaries were evaluated: a scenario-oriented set for binary-size overhead, averaging below 1%, and a randomly selected set for scan-cycle time, which remained within acceptable limits. These results further confirm the robustness of the proposed scheme.