Sdft: A PDG-based Summarization for Efficient Dynamic Data Flow Tracking

by   Xiao Kan, et al.

Dynamic taint analysis (DTA) has been widely used in various security-relevant scenarios that need to track the runtime information flow of programs. Dynamic binary instrumentation (DBI) is a prevalent technique in achieving effective dynamic taint tracking on commodity hardware and systems. However, the significant performance overhead incurred by dynamic taint analysis restricts its usage in production systems. Previous efforts on mitigating the performance penalty fall into two categories, parallelizing taint tracking from program execution and abstracting the tainting logic to a higher granularity. Both approaches have only met with limited success. In this work, we propose Sdft, an efficient approach that combines the precision of DBI-based instruction-level taint tracking and the efficiency of function-level abstract taint propagation. First, we build the library function summaries automatically with reachability analysis on the program dependency graph (PDG) to specify the control- and data dependencies between the input parameters, output parameters, and global variables of the target library. Then we derive the taint rules for the target library functions and develop taint tracking for library function that is tightly integrated into the state-of-the-art DTA framework Libdft. By applying our approach to the core C library functions of glibc, we report an average of 1.58x speed up of the tracking performance compared with Libdft64. We also validate the effectiveness of the hybrid taint tracking and the ability on detecting real-world vulnerabilities.


Neutaint: Efficient Dynamic Taint Analysis with Neural Networks

Dynamic taint analysis (DTA) is widely used by various applications to t...

Statistical Program Slicing: a Hybrid Slicing Technique for Analyzing Deployed Software

Dynamic program slicing can significantly reduce the code developers nee...

Directed Greybox Fuzzing with Stepwise Constraint Focusing

Dynamic data flow analysis has been widely used to guide greybox fuzzing...

Dynamic Slicing by On-demand Re-execution

In this paper, we propose a novel approach that aims to offer an alterna...

Fine Grained Dataflow Tracking with Proximal Gradients

Dataflow tracking with Dynamic Taint Analysis (DTA) is an important meth...

An Empirical Study of Information Flows in Real-World JavaScript

Information flow analysis prevents secret or untrusted data from flowing...

TaintAssembly: Taint-Based Information Flow Control Tracking for WebAssembly

WebAssembly (wasm) has recently emerged as a promisingly portable, size-...

Please sign up or login with your details

Forgot password? Click here to reset