Abstract:Dynamic taint analysis (DTA) has been widely used in various security-relevant scenarios that need to track the runtime information flow of programs. Dynamic binary instrumentation (DBI) is a prevalent technique in achieving effective dynamic taint tracking on commodity hardware and systems. However, the significant performance overhead incurred by dynamic taint analysis restricts its usage in production systems. Previous efforts on mitigating the performance penalty fall into two categories, parallelizing taint tracking from program execution and abstracting the tainting logic to a higher granularity. Both approaches have only met with limited success. In this work, we propose Sdft, an efficient approach that combines the precision of DBI-based instruction-level taint tracking and the efficiency of function-level abstract taint propagation. First, we build the library function summaries automatically with reachability analysis on the program dependency graph (PDG) to specify the control- and data dependencies between the input parameters, output parameters, and global variables of the target library. Then we derive the taint rules for the target library functions and develop taint tracking for library function that is tightly integrated into the state-of-the-art DTA framework Libdft. By applying our approach to the core C library functions of glibc, we report an average of 1.58x speed up of the tracking performance compared with Libdft64. We also validate the effectiveness of the hybrid taint tracking and the ability on detecting real-world vulnerabilities.

Summary-Based Context-Sensitive Data-Dependence Analysis in Presence of Callbacks

Conditional Dyck-CFL Reachability Analysis for Complete and Efficient Library Summarization.

Points to analysis for partial call graph construction

Efficient Path-Sensitive Data-Dependence Analysis

LibAlchemy: A Two-Layer Persistent Summary Design for Taming Third-Party Libraries in Static Bug-Finding Systems

Falcon: A Fused Approach to Path-Sensitive Sparse Data Dependence Analysis

Optimize Context-Sensitive Andersen-style Points-to Analysis by Method Summarization and Cycle-Elimination

Fast and precise points-to analysis with incremental CFL-reachability summarisation: preliminary experience

Dependence Analysis for C Programs with Combinability of Dataflow Facts under Consideration

An Approach to Analyzing Dependence Based on Exception Propagation Analysis

Refining the Pointer Analysis by Exploiting Constraints on the CFL-Paths.

Dependence Analysis for Java

Context-aware Code Summary Generation

Data-flow Summarization of Android Library with Points-to Analysis

CP-BCS: Binary Code Summarization Guided by Control Flow Graph and Pseudo Code

Call-Graph-Based Context-Sensitive Points-to Analysis for Java

Sdft: A PDG-based Summarization for Efficient Dynamic Data Flow Tracking

Improving Side-Effect Analysis with Lazy Access Path Resolving

Reducing Extension Edges Of Concurrent Programs For Reachability Analysis

Function Call Graph Context Encoding for Neural Source Code Summarization

Summarizing Source Code with Transferred API Knowledge