Sdft：一种基于PDG的高效动态数据流跟踪方法
Sdft: A PDG-based Summarization for Efficient Dynamic Data Flow Tracking
摘要：
动态污点分析（DTA）已广泛应用于各种需要跟踪程序运行时信息流的安全相关场景中。动态二进制插装（DBI）是在商用硬件和系统上实现有效的动态污点跟踪的流行技术。然而，动态污点分析产生的显着的性能开销限制了其在生产系统中的使用。以前减轻性能损失的努力分为两类，并行化污染跟踪程序执行和抽象的污染逻辑到一个更高的粒度。这两种方法都只取得了有限的成功。在这项工作中，我们提出了Sdft，一种有效的方法，结合了基于DBI的预防级污点跟踪的精度和函数级抽象污点传播的效率。首先，我们自动构建库函数摘要，并在程序依赖图（PDG）上进行可达性分析，以指定目标库的输入参数，输出参数和全局变量之间的控制和数据依赖关系。然后，我们推导出目标库函数的污染规则，并开发库函数的污染跟踪，该函数紧密集成到最先进的DTA框架Libdft中。通过将我们的方法应用于glibc的核心C库函数，我们报告了与Libdft64相比，跟踪性能平均提高了1.58倍。我们还验证了混合污点跟踪的有效性和检测现实世界中的漏洞的能力。
英文摘要：
Dynamic taint analysis (DTA) has been widely used in various security-relevant scenarios that need to track the runtime information flow of programs. Dynamic binary instrumentation (DBI) is a prevalent technique in achieving effective dynamic taint tracking on commodity hardware and systems. However, the significant performance overhead incurred by dynamic taint analysis restricts its usage in production systems. Previous efforts on mitigating the performance penalty fall into two categories, parallelizing taint tracking from program execution and abstracting the tainting logic to a higher granularity. Both approaches have only met with limited success. In this work, we propose Sdft, an efficient approach that combines the precision of DBI-based instruction-level taint tracking and the efficiency of function-level abstract taint propagation. First, we build the library function summaries automatically with reachability analysis on the program dependency graph (PDG) to specify the control- and data dependencies between the input parameters, output parameters, and global variables of the target library. Then we derive the taint rules for the target library functions and develop taint tracking for library function that is tightly integrated into the state-of-the-art DTA framework Libdft. By applying our approach to the core C library functions of glibc, we report an average of 1.58x speed up of the tracking performance compared with Libdft64. We also validate the effectiveness of the hybrid taint tracking and the ability on detecting real-world vulnerabilities.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
