HardTaint: Production-Run Dynamic Taint Analysis via Selective Hardware Tracing
Dynamic taint analysis (DTA), as a fundamental analysis technique, is widely used in security, privacy, and diagnosis, etc. As DTA demands to collect and analyze massive taint data online, it suffers extremely high runtime overhead. Over the past decades, numerous attempts have been made to lower the overhead of DTA. Unfortunately, the reductions they achieved are marginal, causing DTA only applicable to the debugging/testing scenarios. In this paper, we propose and implement HardTaint, a system that can realize production-run dynamic taint tracking. HardTaint adopts a hybrid and systematic design which combines static analysis, selective hardware tracing and parallel graph processing techniques. The comprehensive evaluations demonstrate that HardTaint introduces only around 8% runtime overhead which is an order of magnitude lower than the state-of-the-arts, while without sacrificing any taint detection capability.
Wed 23 OctDisplayed time zone: Pacific Time (US & Canada) change
13:40 - 15:20 | Static Analysis and Program Verification 2OOPSLA 2024 at IBR East Chair(s): Anders Møller Aarhus University | ||
13:40 20mTalk | HardTaint: Production-Run Dynamic Taint Analysis via Selective Hardware Tracing OOPSLA 2024 Yiyu Zhang Nanjing University, Tianyi Liu Nanjing University, Yueyang Wang Nanjing University, Yun Qi Nanjing University, Kai Ji Nanjing University, Jian Tang Nanjing University, Xiaoliang Wang Nanjing University, Xuandong Li Nanjing University, Zhiqiang Zuo Nanjing University DOI | ||
14:00 20mTalk | MEA2: a Lightweight Field-Sensitive Escape Analysis with Points-to Calculation for Golang OOPSLA 2024 Boyao Ding University of Science and Technology of China, Qingwei Li University of Science and Technology of China, Yu Zhang University of Science and Technology of China, Fugen Tang University of Science and Technology of China, Jinbao Chen University of Science and Technology of China DOI | ||
14:20 20mTalk | Newtonian Program Analysis of Probabilistic Programs OOPSLA 2024 DOI | ||
14:40 20mTalk | Non-Termination Proving at Scale OOPSLA 2024 Azalea Raad Imperial College London, Julien Vanegue Imperial College London; Bloomberg, Peter W. O'Hearn Lacework; University College London DOI | ||
15:00 20mTalk | Quantum Control Machine: The Limits of Control Flow in Quantum Programming OOPSLA 2024 Charles Yuan Massachusetts Institute of Technology, Agnes Villanyi MIT CSAIL, Michael Carbin Massachusetts Institute of Technology DOI |