A hardware-oriented multi-label data stream tracing method

Abstract

This invention relates to the field of dynamic program analysis and provides a hardware-based multi-label data stream tracing method. The method includes: dividing input data into multiple fixed-size regions and assigning a unique label vector to each region; decoding the actual instructions executed by the program according to the data operation semantics of the instructions; calculating the taint propagation of the label vectors of the source and destination operands using a predefined microcode sequence based on the instruction decoding result, to obtain the tainted label vectors; starting from a specified position in the program execution, tracing back to the tainted region based on the bits set to 1 in the label vector corresponding to that instruction operand; and refining the label vector allocation and taint propagation calculation according to the size of the tainted region until the target accuracy is achieved. This invention solves the problem of low computational efficiency in dynamic taint analysis, improves taint propagation efficiency, and allows for more detailed dynamic accuracy adjustment.

Description

Technical Field

[0001] This invention relates to the field of program dynamic analysis, and in particular to a hardware-based multi-label data stream tracing method. Background Technology

[0002] With the increasing complexity of computer system security threats, dynamic taint analysis has become an important tool for detecting data stream anomalies and potential vulnerabilities. This technology effectively identifies security issues such as data tampering and information leakage by marking untrusted data (taint sources) and tracing their propagation path during program execution. Especially in scenarios such as the Internet of Things (IoT) and cloud computing, dynamic taint analysis plays a crucial role in ensuring system security. However, traditional taint analysis methods are primarily software-based, resulting in high performance overhead and poor scalability, making it difficult to meet the demands of efficient security analysis in modern hardware environments.

[0003] Currently, mainstream dynamic taint analysis solutions in the industry generally employ set operations or instruction-level instrumentation techniques to achieve taint propagation. For example, DECAF sets taint rules for each instruction through dynamic instrumentation and uses set operations to track data flow; PANDA translates instructions into LLVM intermediate language before performing taint analysis; and Libdft uses the Intel Pin tool to implement taint marking for registers and memory. While these solutions achieve high accuracy at the software level, they suffer from significant drawbacks such as high time and space complexity, fixed granularity, and prominent performance bottlenecks. Especially for multi-source taint analysis scenarios, existing methods are difficult to implement due to excessive computational resource consumption. Summary of the Invention

[0004] This invention provides a hardware-oriented multi-label data stream tracing method that solves the problems of low computational efficiency and inability to dynamically adjust analysis precision in dynamic taint analysis due to the complexity of set operations. It achieves a significant improvement in taint propagation efficiency through hardware-friendly bit vector labeling and parallel computing, while supporting dynamic precision adjustment from block level to bit level.

[0005] This invention provides a hardware-based multi-tag data stream tracing method, comprising the following steps:

[0006] The input data is divided into multiple regions of fixed size, and a unique label vector is assigned to each region. The label vector is marked by bit offset.

[0007] For the instructions actually executed by the program, the instructions are decoded according to the data operation semantics of the instructions to obtain the instruction decoding result;

[0008] Based on the instruction decoding result, the microcode sequence is calculated through predefined taint propagation, and the taint propagation calculation is performed on the label vectors of the source operand and the destination operand to obtain the taint propagated label vector;

[0009] Starting from a specified position in the program, based on the bits set to 1 in the tag vector corresponding to the instruction operand after the taint propagation, the corresponding region is traced back as the taint region.

[0010] If the size of the tainted region is less than or equal to a preset threshold, a tag vector is assigned to each byte or bit, and then the tainted region is determined by performing tainted propagation calculation based on the assigned tag vector.

[0011] If the size of the tainted region is greater than a preset threshold, the tainted region is further divided into multiple fixed-size sub-blocks, and the label vector allocation and taint propagation calculation are repeated to determine the corresponding tainted region until the target accuracy is achieved.

[0012] According to the present invention, a hardware-oriented multi-label data stream tracing method is provided, wherein dividing the input data into multiple fixed-size regions and assigning a unique label vector to each region specifically includes: using the starting address of the input data in memory as a base address; dividing the input data sequentially from the base address in units of hardware parallel processing bit width to obtain multiple fixed-size regions; generating an N-bit binary label vector for each region, where N is equal to the hardware parallel processing bit width; wherein, in the label vector of the i-th region, only the i-th bit is set to 1, and the remaining N-1 bits are all set to 0, and the value of i ranges from 0 to N-1.

[0013] According to a hardware-based multi-tag data flow tracing method provided by the present invention, before decoding the received external instructions, a taint propagation rule based on microcode is constructed, including: traversing the target instruction set and extracting the opcode, operand type, and length information of each instruction; determining the data flow direction between the source operand and the destination operand based on the semantics of the opcode; generating one or more microcode instructions for each instruction based on the data flow direction, wherein the microcode instructions include assignment instructions, shift instructions, logical operation instructions, and control flow transfer instructions; establishing a mapping relationship between the microcode instructions and the corresponding opcodes; generating a taint propagation rule table based on the mapping relationship and storing it in a preset format.

[0014] According to a hardware-based multi-tag data stream tracing method provided by the present invention, the step of performing taint propagation calculation on the tag vectors of the source operand and the destination operand based on the instruction decoding result to obtain the taint-propagated tag vector specifically includes: determining the microcode instruction sequence corresponding to the current instruction based on the instruction decoding result; reading the first tag vector corresponding to the source operand from the taint recording area, and reading the second tag vector corresponding to the destination operand from the taint recording area; inputting the first tag vector and the second tag vector into a vector calculation module; performing logical operations on the first tag vector and / or the second tag vector according to the microcode instruction sequence to generate a third tag vector of the destination operand; and writing the third tag vector back to the position corresponding to the destination operand in the taint recording area to update its taint state.

[0015] According to a hardware-based multi-tag data stream tracing method provided by the present invention, a hardware parallel bit processing unit synchronously executes logical operations on an N-bit tag vector; the logical operations include OR, AND, XOR, and bit shift operations; taint propagation calculation is performed through a vector calculation module, which is a microcode interpretation and execution unit or a configurable logic circuit, wherein: the microcode interpretation and execution unit converts the microcode instruction sequence into micro-operation signals through a decoder before execution; the configurable logic circuit solidifies the microcode instruction sequence into a hardware logic gate array to complete the logical operations on the tag vector in a single cycle.

[0016] According to the hardware-oriented multi-tag data stream tracing method provided by the present invention, the target precision includes byte-level precision or bit-level precision, and further division stops when the size of any tainted region is equal to the user-defined precision.

[0017] This invention also provides a multi-tag data stream tracking system, comprising the following modules:

[0018] A labeling module is used to divide the input data into multiple fixed-size regions, assign a unique label vector to each region, and the label vector is labeled by bit offset.

[0019] The decoding module is used to decode the instructions actually executed by the program according to the data operation semantics of the instructions, and obtain the instruction decoding result.

[0020] The vector calculation module is used to calculate the taint propagation of the tag vectors of the source operand and the destination operand based on the instruction decoding result and through a predefined taint propagation calculation microcode sequence to obtain the taint propagated tag vector.

[0021] The taint backtracking module is used to backtrack the corresponding region as the taint region, starting from a specified position in the program and based on the bit set to 1 in the tag vector corresponding to the instruction operand after the taint propagation.

[0022] The taint location module is used to assign a tag vector to each byte or bit if the size of the taint region is less than or equal to a preset threshold, and then continue to perform taint propagation calculation based on the assigned tag vector to determine the corresponding taint region; if the size of the taint region is greater than the preset threshold, the taint region is further divided into multiple fixed-size sub-blocks, and the tag vector allocation and taint propagation calculation are repeated to determine the corresponding taint region until the target accuracy is achieved.

[0023] This invention provides a hardware-based multi-label data stream tracing method with the following advantages: First, by using a bit-offset-based label vector marking method, the input data is divided into fixed-size regions, and a unique binary label vector is assigned to each region. This allows the taint marking process to fully utilize the hardware's parallel computing capabilities, significantly improving marking efficiency. Second, through instruction decoding and taint propagation calculation based on label vectors, traditional complex set operations are transformed into efficient bit operations, greatly reducing computational complexity. In particular, the dynamic precision adjustment mechanism proposed in this invention intelligently selects whether to continue subdividing or directly perform fine marking based on the size of the taint region. This ensures that preliminary analysis can still be completed under limited resources, while achieving high-precision bit-level tracing when necessary. This progressive analysis method from coarse-grained to fine-grained not only solves the problem that traditional techniques cannot dynamically adjust analysis precision but also achieves the optimal balance between computational resources and tracking precision through iterative optimization. Attached Figure Description

[0024] To more clearly illustrate the technical solutions in this invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0025] Figure 1 This is the multi-label mapping logic provided by the present invention.

[0026] Figure 2 This is a flowchart illustrating the hardware-oriented multi-tag data stream tracing method provided by the present invention.

[0027] Figure 3 This is a schematic diagram of the stain source marking process provided by the present invention.

[0028] Figure 4This is a schematic diagram of the processing flow of the instructions provided by this invention in the hardware taint tracing engine.

[0029] Figure 5 This is a schematic diagram of the microcode-based taint propagation rule construction process provided by the present invention.

[0030] Figure 6 This is a schematic diagram of the data flow tracing calculation process provided by the present invention.

[0031] Figure 7 This is a schematic diagram of the iterative calculation method for stain labels of different precision provided by the present invention.

[0032] Figure 8 This is a schematic diagram of the hardware-oriented multi-tag data stream tracing system provided by the present invention.

[0033] Figure 9 This is a schematic diagram of the structure of the electronic device provided by the present invention. Detailed Implementation

[0034] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.

[0035] The English words or English abbreviations involved in this invention will be explained below.

[0036] DTA (Dynamic Taint Analysis) is a security analysis technique that tracks the propagation path of tagged data (taints) during program runtime.

[0037] LLVM (Low Level Virtual Machine) is a compiler infrastructure project that provides reusable compiler toolchains.

[0038] x86 is a CPU instruction set architecture developed by Intel, widely used in personal computers and servers.

[0039] CAM (Content-Addressable Memory) is a special type of memory that retrieves data based on content rather than address.

[0040] OR / AND / XOR represent logical OR, AND, and XOR operations, respectively, and are basic bit manipulation instructions in computers.

[0041] MOV, ADD, and LOAD are CPU instruction opcodes for data movement, addition, and memory loading, respectively.

[0042] A bit (binary digit) is the smallest unit of computer data, with a value of either 0 or 1.

[0043] byte, a unit of data consisting of 8 bits.

[0044] CPU (Central Processing Unit) is the core component of a computer that executes instructions and processes data.

[0045] A register is a high-speed storage unit inside the CPU used to temporarily store instructions and data.

[0046] Microcode is a type of low-level hardware instruction used to break down and execute complex machine instructions.

[0047] QEMU (Quick Emulator) is an open-source processor emulation software.

[0048] Intel Pin is a dynamic binary instrumentation tool framework developed by Intel.

[0049] ACM CCS (ACM Conference on Computer and Communications Security) is a top-tier academic conference in the field of information security.

[0050] The terminology involved in this invention will be explained below.

[0051] Instruction opcode: An instruction is the most basic unit of execution in a computer system, used to perform various operations, including arithmetic operations, logical operations, and memory read / write operations. An instruction consists of two parts: an opcode and operands. The opcode indicates the type of operation, i.e., the mode of computation.

[0052] Instruction operands: Instructions are the most basic units of execution in a computer system, used to perform various operations, including arithmetic operations, logical operations, and memory read / write operations. An instruction consists of two parts: an opcode and operands. An instruction contains zero or more operands, representing the data or memory addresses to be operated on.

[0053] Dynamic taint propagation: Based on program execution, it monitors data flow or control flow to track and detect explicit data propagation in memory, data misuse, etc.

[0054] Multi-source dynamic taint propagation analysis: By marking and tracking multiple untrusted data sources during program execution, it helps developers identify and fix potential security vulnerabilities, thereby improving the security and reliability of software systems.

[0055] Taint propagation rules: Taint propagation rules are the core of Dynamic Taint Analysis (DTA). They define how a tainted operand propagates to other data during program execution.

[0056] The taint propagation analysis includes two aspects: multi-source taint propagation analysis and single-source taint propagation analysis.

[0057] Currently, the main method for calculating taint propagation is through set operations. Representative dynamic taint propagation systems include:

[0058] 1. DECAF: Built on QEMU, its core capability comes from its dynamic instrumentation of each translated instruction. It performs taint propagation calculations by setting taint propagation rules for each instruction and then performing set operations. Its drawback lies in the high time complexity resulting from the large number of set operations involved in the taint propagation analysis process.

[0059] 2. PANDA: Platform for Architecture - Neutral Dynamic Analysis, is a dynamic taint analysis platform built on QEMU. Its core capability comes from the dynamic instrumentation of each translated instruction. By translating the obtained instructions into LLVM intermediate language, setting taint propagation rules for LLVM intermediate language, and performing set operations, dynamic taint propagation analysis is achieved. Its drawbacks are low analysis efficiency and extremely high memory consumption.

[0060] 3. Libdft: Implemented based on the Intel Pin tool, it dynamically marks and propagates taints in memory and registers during program execution. By instrumenting intermediate code, it analyzes the read and write operations of each instruction to achieve precise taint propagation. When tainted data reaches a sensitive operation (such as a system call), it triggers detection, thereby identifying potential security vulnerabilities.

[0061] For example, `mov eax, [ebx]` will cause the taint state of `eax` to inherit from the memory location pointed to by `ebx`. LibDFT primarily supports propagation tracing of input data, used to detect the usage paths of sensitive data.

[0062] Shortcomings: libdft only supports x86 systems, instruction-level instrumentation has high performance overhead, and it does not support multiple taint sources.

[0063] The input for taint propagation includes taint source information and the actual instructions executed by the program. Required support includes taint state recording and taint propagation rules. Upon receiving taint source information, the taint propagation engine sets a taint source marker at the corresponding position in the taint state record. It then tracks the execution process of each instruction in the target program, matches the taint propagation rules, and calculates whether the operands before and after instruction execution contain tainted data, and the source of that tainted data. After calculation, the tainted data state is updated in the taint record. When the user needs to determine the data used by a particular instruction, the taint propagation engine can output information such as the offset and length of the input data affecting that instruction within the overall input data.

[0064] The existing technology has many shortcomings:

[0065] 1. There is currently a lack of hardware-based methods for multi-source taint propagation.

[0066] 2. Existing taint propagation methods involve a large number of set merging and splitting operations when performing multi-source computation, resulting in high time and space complexity.

[0067] 3. Mask-based computation methods have high space complexity. In actual taint propagation computation, only a small portion of the instructions can be computed based on masks. Many of these instructions involve shifting, XOR operations, and other special handling. If all cases need to be satisfied, the storage and retrieval of large-scale masks will have extremely high space and time complexity.

[0068] 4. Existing multi-source taint propagation analysis methods have a fixed granularity, which cannot be flexibly changed during the analysis process.

[0069] The problems that this invention aims to solve include:

[0070] 1. Hardware resources are limited and expensive. How can we use limited hardware resources to label and compute tainted data that may be scattered across an almost infinite memory address space?

[0071] 2. How to transform the logic-intensive problem of numerous set merging and splitting operations in the existing taint propagation calculation process into a computationally intensive problem suitable for hardware implementation.

[0072] 3. How to solve the problem of high time and space complexity of masking algorithms.

[0073] 4. How to ensure the accuracy of calculations while maintaining high flexibility to adjust the analysis precision when calculating large-scale taints with limited hardware resources?

[0074] To address the aforementioned problems, this invention provides a computational scheme for taint propagation, including taint mapping and taint calculation. This scheme is independent of the specific CPU instruction type and can calculate the taint propagation process of any CPU instruction through instruction parsing. This calculation method can be implemented as microcode for hardware parsing and execution, or it can be embedded in logic circuits for direct instruction analysis. Comparatively, the execution efficiency of embedding it in logic circuits is higher than that of hardware parsing and execution. The main key points are as follows:

[0075] 1. A taint mapping method based on bit tags and relative tag offsets is defined, enabling limited hardware resources to map large-scale taint data.

[0076] 2. A vector computation rule for taint propagation is defined, which transforms the logic-intensive problem of taint propagation computation into a vector computation-intensive problem through vector computation.

[0077] 3. A hardware operation language corresponding to the rules was designed, which accurately describes the hardware implementation logic of the method of this application, and can be implemented using microcode or solidified hardware.

[0078] 4. A method for iteratively segmenting taint sources to perform dynamic taint propagation calculation is proposed, which allows the granularity of dynamic taint propagation analysis to be freely adjusted, with a minimum accuracy of bit level, exhibiting good flexibility and accuracy.

[0079] This invention comprises three parts: the first is a tainted memory mapping method (multi-label mapping logic); the second is a vector calculation rule definition method; and the third is an iterative calculation method for tainted labels of different precisions. The multi-label mapping logic is as follows: Figure 1 As shown. In the following sections, assuming that the hardware design can compute 128 bits of data at a time, we will describe how to use 128 bits of data for taint propagation calculations.

[0080] The following is combined with Figures 2-8 The embodiments of the present invention are described in detail.

[0081] Figure 2 This is a flowchart illustrating the hardware-oriented multi-tag data stream tracing method provided by the present invention, as shown below. Figure 2 As shown, the method includes the following steps:

[0082] S210. Divide the input data into multiple fixed-size regions and assign a unique label vector to each region. The label vector is marked using a bit offset method.

[0083] According to the present invention, a hardware-oriented multi-label data stream tracing method divides the input data into multiple fixed-size regions and assigns a unique label vector to each region. Specifically, the method includes: using the starting address of the input data in memory as a reference address; dividing the input data sequentially from the reference address in units of hardware parallel processing bit width to obtain multiple fixed-size regions; generating an N-bit binary label vector for each region, where N is equal to the hardware parallel processing bit width; wherein, in the label vector of the i-th region, only the i-th bit is set to 1, and the remaining N-1 bits are all set to 0, and the value of i ranges from 0 to N-1.

[0084] Specifically, in the tainted memory mapping part, a piecewise mapping method is used, the principle of which is as follows: Figure 1 As shown. This method achieves efficient taint marking on large-scale data through a systematic label allocation mechanism. The specific implementation process is as follows: Figure 3 As shown, it includes the following key steps:

[0085] Step 1: The system divides the input data into 128 equally sized blocks (approximately 8KB per block for a 1MB file) based on the starting memory address. During initialization, the system positions the pointer to the first data block and clears the internal counter.

[0086] Step 2: The system generates a unique 128-bit binary tag vector for each block. The tag generation rules are as follows: create 128 bits of data with an initial value of 0, and only set the bit corresponding to the current value of the counter to 1. For example, the tag for the first block (counter = 0) is 0x00...01 (bit 0 is set to 1), the tag for the second block (counter = 1) is 0x00...10 (bit 1 is set to 1), and so on. This design ensures that each block has a unique identifier, and the tag vector can be processed in parallel by hardware.

[0087] Step 3: After marking the current block, the system performs a pointer shift operation to point to the next block.

[0088] Step 4: Increment the counter by 1.

[0089] Step 5: The system continuously checks if the counter has reached 127 to ensure that all 128 blocks receive the correct label assignment. If not, proceed to Step 2. If yes, proceed to Step 6.

[0090] Step 6: Once all blocks have been marked, the process terminates.

[0091] Taking the analysis of a 1MB file as an example, after the program loads the file into memory, the system divides the continuous 1MB space into 128 blocks starting from the memory's starting address, and assigns a unique 128-bit tag to each block according to the rules mentioned above. This segmentation mapping mechanism has two major advantages: first, it achieves tag identification with O(1) complexity through bit offset marking; second, the 128-bit vector length perfectly matches the SIMD instruction set of modern processors, enabling parallel processing of tags. The entire marking process forms a closed-loop control, ensuring the precise correspondence between memory addresses and tag vectors, thus establishing a reliable foundation for subsequent taint propagation analysis.

[0092] S220. For the instructions actually executed by the program, decode the instructions according to the data operation semantics of the instructions to obtain the instruction decoding result.

[0093] According to the hardware-implemented multi-tag data flow tracing method provided by the present invention, before decoding the received program execution instructions, a taint propagation rule based on microcode is constructed, including: traversing the target instruction set and extracting the opcode, operand type, and length information of each instruction; determining the data flow direction between the source operand and the destination operand based on the semantics of the opcode; generating one or more microcode instructions for each instruction based on the data flow direction, wherein the microcode instructions include assignment instructions, shift instructions, logical operation instructions, and control flow transfer instructions; establishing a mapping relationship between the microcode instructions and the corresponding opcodes; generating a taint propagation rule table based on the mapping relationship and storing it in a preset format.

[0094] Specifically, after taint marking is completed, the system enters the critical taint propagation calculation stage. This invention proposes a taint labeling operation system based on 128-bit vectors, which consists of two core components: First, a complete set of 128-bit label vector operation rules is designed to fully utilize the parallel computing capabilities of modern processors; second, a dedicated microcode instruction set is developed to provide precise computational logic control for taint propagation.

[0095] Specifically, the microcode system in this solution (see Table 1) includes five major categories of key instructions:

[0096] 1) Assignment instructions are used to directly pass taint labels;

[0097] 2) Shift command, supporting label position adjustment;

[0098] 3) Logical operation instructions (including OR, AND, XOR, etc.) are used to process tag merging and filtering;

[0099] 4) Arithmetic operation instructions, handling the propagation of numerical taints;

[0100] 5) Control flow transfer instructions enable conditional judgments and process control. These instructions together constitute a complete taint propagation calculation model.

[0101] In terms of implementation, the system adopts a dual execution mode: it can be dynamically translated and executed through a software interpreter to meet flexibility requirements; or it can be directly embedded into dedicated hardware circuits to achieve nanosecond-level computing speeds. In particular, the hardware implementation, through customized logic circuit design, can complete the parallel processing of a 128-bit tag vector within one clock cycle, improving performance by two orders of magnitude compared to traditional software solutions. This flexible implementation architecture allows the solution to adapt to both the debugging needs of the R&D phase and the pursuit of ultimate performance in the production environment.

[0102] Table 1

[0103]

[0104] The microcode-based taint propagation computation system proposed in this invention has the following core architecture and workflow: Figure 4 As shown. Figure 4 This demonstrates the processing flow of a typical instruction in a hardware taint tracing engine. First, the taint record area stores the label vectors of all current data blocks, serving as the input source for subsequent operations. As the program continues execution, new instructions are retrieved from the "program instruction" stream; subsequently, this instruction is matched against a pre-built taint propagation rule table. If a match is successful, the system sends the corresponding "taint calculation microcode instruction sequence" to the next stage according to the instruction number (instruction 1, instruction 2, ..., instruction n). All matched microcode instruction sequences ultimately converge to the "computation module," which performs logical operations on the label vectors of the source and destination operands according to the microcode order. After the operation is complete, the updated label vectors are written back to the "taint record," thus completing one closed-loop taint propagation calculation.

[0105] Based on the above description, the process of constructing taint propagation rules based on microcode is as follows: Figure 5 As shown, a four-stage processing flow is adopted:

[0106] Phase 1 (Instruction Parsing):

[0107] The system first performs deep parsing of the target instruction, determining the specific semantics of the instruction opcode through syntax analysis, including the operation type (e.g., MOV, ADD), operand type (register, memory address, or immediate value), and operand bit width (8-bit, 16-bit, 32-bit, 64-bit, etc.). This stage establishes a complete instruction context environment for subsequent processing.

[0108] Second stage (operand extraction):

[0109] Based on the analysis results from the first phase, the system obtains the actual operation values ​​from the processor state. For register operands, the current register value is read directly; for memory operands, the memory content is obtained through address resolution; for composite operands, all relevant data is obtained recursively. Simultaneously, the system records the taint tag vector corresponding to each operand, preparing for microcode generation.

[0110] Phase 3 (Microcode Generation):

[0111] Based on instruction semantics and operand characteristics, the system dynamically generates corresponding microcode sequences. For example, for the MOV instruction, it generates tag copy microcode; for the ADD instruction, it generates tag merge (OR operation) microcode; and for shift instructions, it generates tag shift microcode. Each microcode is optimized to ensure full utilization of the parallel processing capabilities of the 128-bit vector.

[0112] Phase 4 (Rule Storage):

[0113] The generated microcode sequence is mapped to the original instruction opcode, and stored on the hard disk in a specific storage format as a dynamic taint propagation analysis rule. The storage format includes: opcode fingerprint, microcode sequence length, microcode instruction stream, and checksum. This structured storage scheme ensures both query efficiency and facilitates subsequent dynamic updates and maintenance.

[0114] The entire construction process automates the conversion from machine instructions to taint propagation rules, laying a solid foundation for subsequent real-time analysis. The system supports dynamically loading new propagation rules, enabling the analysis methods to continuously evolve and adapt to new instruction sets and security requirements.

[0115] S230. Based on the instruction decoding result, the taint propagation calculation is performed on the label vectors of the source operand and the destination operand using a predefined taint propagation calculation microcode sequence to obtain the taint propagated label vector.

[0116] According to the present invention, a hardware-based multi-tag data stream tracing method is provided, which performs taint propagation calculation on the tag vectors of the source operand and the destination operand based on the instruction decoding result to obtain the taint-propagated tag vector. Specifically, the method includes: determining the microcode instruction sequence corresponding to the current instruction based on the instruction decoding result; reading the first tag vector corresponding to the source operand from the taint recording area, and reading the second tag vector corresponding to the destination operand from the taint recording area; inputting the first tag vector and the second tag vector into a vector calculation module; performing logical operations on the first tag vector and / or the second tag vector according to the microcode instruction sequence to generate a third tag vector of the destination operand; and writing the third tag vector back to the position corresponding to the destination operand in the taint recording area to update its taint state.

[0117] Specifically, Figure 6 The data stream tracing calculation process is described in detail. Based on the above embodiments, the specific execution process of the microcode is as follows:

[0118] Step 1. The system loads the pre-compiled microcode rule set into the on-chip microcode cache through a dedicated configuration interface. This cache adopts a multi-level storage architecture, including:

[0119] Level 1 cache: Stores frequently used core microcode (such as MOV, ADD, etc.);

[0120] Second-level cache: Stores the complete microcode rule base;

[0121] Write buffer: Handles dynamically updated microcode rules.

[0122] The loading process uses DMA to ensure efficient transmission of microcode data.

[0123] Step 2. The system acquires the machine instructions to be analyzed in real time through the instruction acquisition interface. Each instruction packet contains: raw machine code, program counter value, and timestamp.

[0124] Step 3. The decoding unit completes instruction parsing within two clock cycles, obtains the instruction decoding result, and maps the opcode to the corresponding microcode entry address using a lookup table. The hardware scheduler then points the microcode instruction sequence pointer to the target address.

[0125] Step 4. The computation module extracts the microcode instructions from the microcode instruction sequence and uses the corresponding 128-bit tag vector as the source and destination operands. This computation module adopts a VLIW (Very Long Instruction Word) architecture, which can be executed in parallel per cycle.

[0126] Step 5. According to the microcode instructions, perform the specified bitwise operation (OR / AND / XOR, etc.), calculate the source operand and the destination operand, and store the calculation result in the calculation result register defined by the microcode.

[0127] Step 6. Update the 128-bit data in the taint status memory in memory according to the calculation result register.

[0128] Step 7. Check if the input command is empty. If not, proceed to Step 2. If empty, proceed to Step 8.

[0129] Step 8. Analysis complete.

[0130] By pre-loading microcode rules into multi-level on-chip caches in batches and utilizing DMA for zero-copy transfer, the system avoids latency caused by frequent external storage accesses and achieves rapid hits on hot rules through the first-level cache, significantly reducing the average instruction fetch time. Subsequently, the instruction acquisition interface pipes in machine instructions in real time, and the decoding unit completes parsing in just two cycles, directly mapping to the microcode entry point using a lookup table, eliminating the path selection overhead of traditional line-by-line interpretation. The computation module adopts a VLIW architecture, which can perform bitwise operations on a 128-bit tag vector in parallel within a single cycle, transforming the originally logic-intensive taint propagation that required multiple serial steps into a computationally intensive parallel task; while the write buffer supports dynamic rule hot updates, allowing rule evolution without system downtime.

[0131] According to the hardware-oriented multi-tag data stream tracing method provided by the present invention, a hardware parallel bit processing unit synchronously executes logical operations on an N-bit tag vector; the logical operations include OR, AND, XOR, and bit shift operations; taint propagation calculation is performed through a vector calculation module, which is a microcode interpretation and execution unit or a configurable logic circuit, wherein: the microcode interpretation and execution unit converts the microcode instruction sequence into micro-operation signals through a decoder before execution; the configurable logic circuit solidifies the microcode instruction sequence into a hardware logic gate array to complete the logical operations on the tag vector in a single cycle.

[0132] Specifically, this invention uses a 128-bit processing system as an example to detail the implementation of the hardware parallel bit processing unit. The vector computing module adopts a dual-mode architecture design: in configurable logic circuit mode, commonly used microcode instructions are solidified into dedicated computing units through pre-programmed Verilog code. Each logic gate array contains 128 parallel bit processing units, which can complete the full-width logic operation of the 128-bit tag vector in a single clock cycle. For special instructions, the system switches to microcode interpretation mode, where a four-stage pipeline decoder decomposes the microcode into micro-operations, which are then executed on demand by the reconfigurable computing units. The hardware design employs a global tag bus architecture, with tainted status registers directly connected to the computing units. Combined with a 128-bit wide DDR4 memory interface, it achieves a tag vector throughput of 16 bytes per cycle.

[0133] By adopting a 128-bit dual-mode vector computing architecture, the system solidifies the most frequently occurring microcode into a parallel logic gate array, enabling full-width computation of the entire row of tag vectors to be completed in a single cycle. When encountering special instructions, it only needs to switch to microcode interpretation mode, where the four-stage pipeline and reconfigurable units work together, preserving the flexibility of rule updates without slowing down overall throughput. Combined with the global tag bus directly connecting the taint register and the computing unit, and the 16-byte bandwidth per cycle provided by the 128-bit DDR4 interface, the entire hardware platform achieves high concurrency, low latency, and rule-evolvable 128-bit parallel taint tracing capabilities while maintaining low power consumption and a small footprint.

[0134] S240. Starting from the specified position in the program, backtrack to the corresponding region as the tainted region based on the bit set to 1 in the tag vector corresponding to the instruction operand after the taint propagation.

[0135] S250. If the size of the tainted region is less than or equal to a preset threshold, a tag vector is assigned to each byte or bit, and taint propagation calculation is performed based on the assigned tag vector to determine the corresponding tainted region. If the size of the tainted region is greater than the preset threshold, the tainted region is further divided into multiple fixed-size sub-blocks, and the tag vector assignment and taint propagation calculation are repeated to determine the corresponding tainted region until the target accuracy is achieved.

[0136] According to the hardware-oriented multi-tag data stream tracing method provided by the present invention, the target precision includes byte-level precision or bit-level precision. When the size of any tainted region is equal to the user-defined precision (1 byte or 1 bit), further division stops.

[0137] Specifically, after mapping taint propagation to labels in different regions, the computational accuracy of taint propagation needs to be gradually improved through multiple iterations, ultimately achieving bit-level resolution. The overall process is as follows: Figure 7 As shown; the following explanation uses a single 128-bit tag as an example. In actual implementation, the tag width can be expanded according to hardware resources, thereby proportionally reducing the number of iteration rounds:

[0138] Step 1. Divide the memory area occupied by the input data to be tracked into 128 consecutive regions, and assign a unique label offset value to each region in sequence—offset 0 corresponds to the first region, offset 1 corresponds to the second region, and so on, and finally generate a 128-bit label vector for each region.

[0139] Step 2. Based on the 128-bit tag record, analyze the program instructions one by one, calculate and update the 128-bit taint status according to the instruction semantics, and write the dynamic taint propagation results back to the taint record area in real time.

[0140] Step 3. At the location of the taint anomaly detection, determine whether an anomaly has occurred, or at the location specified by the user, query its taint status, i.e., traverse the 128-bit tag vector to query the taint status. If the bit at offset 0 in the region is 1, it means that the data at that location comes from taint region 1; if the bit at offset 1 in the region is 1, it means that the data at that location comes from input region 2 divided in Step 1; and so on, tracing back and locating all relevant taint sources.

[0141] Step 4. Collect all the tainted regions that have been backtracked, assuming the region is {0,3,6}.

[0142] Step 5. Determine the size of the stained area.

[0143] Step 6. If the size of any traced tainted region is still greater than 128 bytes, then subdivide the tainted region into 128 smaller sub-regions and return to Step 1 to continue iterating.

[0144] Step 7. If the traced sub-region is less than or equal to 128 bytes, then further assign independent label bits to each smallest unit at the byte or even bit level, and return to step 1.

[0145] Step 8. Repeat the above process until the accuracy of all tainted regions converges to the bit level, at which point the iteration terminates.

[0146] Through this iterative subdivision mechanism, the system can gradually converge the tracking granularity from the hundred-byte level to the bit level with extremely low overhead, even under limited hardware resources. This avoids the storage explosion caused by global masks and achieves high flexibility in fine-tuning as needed, thereby significantly improving the accuracy and reliability of taint analysis while ensuring performance.

[0147] The beneficial effects of this invention are as follows:

[0148] This invention proposes a "layer-by-layer subdivision-iterative refinement" strategy for taint source region segmentation. By recursively subdividing coarse-grained regions into smaller sub-regions and recalculating their label vectors at runtime, it can support near-infinite address space tracing needs while maintaining constant on-chip resources. This mechanism, with threshold-driven adaptive granularity adjustment at its core, allows the analysis system to maintain fast coarse-grained scanning in high-throughput scenarios, while automatically reverting to bit-level precision when security concerns arise. This achieves, for the first time, a dynamic balance between precision and resource consumption at the hardware level, ultimately enabling the resolution granularity of dynamic taint propagation to converge to a single bit.

[0149] This invention constructs a hardware-oriented vector-based taint computation paradigm, transforming the traditional logic-intensive propagation rules that rely on set operations and symbol masks into parallel logic operations using 128-bit (or wider) bit vectors as operands. Leveraging the bit-parallel capabilities of gate-level circuits, operations that previously required multiple condition checks and set merging are compressed into single-cycle bit operations, thereby reducing the algorithm complexity from O(n) level logic path depth to O(1) level hardware latency. This completely transforms taint propagation analysis from "logic-driven" to "computation-driven," significantly improving real-time performance and energy efficiency.

[0150] This invention designs a dual-deployable microcode interpretation and execution framework: In scenarios with volatile rules, the microcode resides in an on-chip cache as firmware, achieving nanosecond-level dynamic reprogramming through a four-stage pipelined decoder, supporting online updates of tainted semantics; in performance-sensitive scenarios, the same set of microcode can be directly embedded into a dedicated circuit via synthesis tools, forming a pure hardware data path without instruction fetching. This "software-hardware dual-mode" architecture retains the evolvability of security policies while providing near-physical computing bandwidth, offering hardware-level support for rapidly changing threat models that combines flexibility and extreme performance.

[0151] The multi-label data stream tracing system provided by the present invention is described below. The multi-label data stream tracing system described below can be referred to in correspondence with the hardware-oriented multi-label data stream tracing method described above.

[0152] like Figure 8 The figure shown is a multi-tag data stream tracing system provided by the present invention, comprising:

[0153] The labeling module 810 is used to divide the input data into multiple fixed-size regions, assign a unique label vector to each region, and label the label vector by bit offset.

[0154] The decoding module 820 is used to decode the instructions actually executed by the program according to the data operation semantics of the instructions, and obtain the instruction decoding result.

[0155] The vector calculation module 830 is used to perform taint propagation calculation on the tag vectors of the source operand and the destination operand according to the instruction decoding result and through a predefined taint propagation calculation microcode sequence to obtain the taint propagated tag vector;

[0156] The taint backtracking module 840 is used to backtrack the corresponding region as the taint region, starting from a specified position in the program and based on the bit set to 1 in the tag vector corresponding to the instruction operand after the taint propagation.

[0157] The taint location module 850 is used to assign a tag vector to each byte or bit if the size of the taint region is less than or equal to a preset threshold, and then continue to perform taint propagation calculation based on the assigned tag vector to determine the corresponding taint region; if the size of the taint region is greater than the preset threshold, the taint region is further divided into multiple fixed-size sub-blocks, and the tag vector allocation and taint propagation calculation are repeated to determine the corresponding taint region until the target accuracy is achieved.

[0158] Figure 9 An example is a schematic diagram of the physical structure of an electronic device, such as... Figure 9 As shown, the electronic device may include a processor 910, a communications interface 920, a memory 930, and a communication bus 940. The processor 910, communications interface 920, and memory 930 communicate with each other via the communication bus 940. The processor 910 can call logical instructions in the memory 930 to execute a hardware-based multi-tag data stream tracing method. This method includes: dividing the input data into multiple fixed-size regions, assigning a unique tag vector to each region, and marking the tag vectors using bit offsets; decoding the instructions actually executed by the program according to the data operation semantics of the instructions to obtain the instruction decoding result; and, based on the instruction decoding result, performing taint propagation calculation on the tag vectors of the source and destination operands using a predefined taint propagation microcode sequence to obtain the taint propagation result. The label vector after propagation; starting from the specified position in the program, based on the bit set to 1 in the label vector corresponding to the instruction operand after taint propagation, backtrack to the corresponding region as the taint region; if the size of the taint region is less than or equal to a preset threshold, then a label vector is assigned to each byte or bit, and taint propagation calculation is continued based on the assigned label vector to determine the corresponding taint region; if the size of the taint region is greater than the preset threshold, then the taint region is further divided into multiple fixed-size sub-blocks, and the label vector allocation and taint propagation calculation are repeated to determine the corresponding taint region until the target accuracy is achieved.

[0159] Furthermore, the logical instructions in the aforementioned memory 930 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0160] On the other hand, the present invention also provides a computer program product, which includes a computer program that can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the multi-label data stream tracing method provided by the above methods. The method includes: dividing the input data into multiple fixed-size regions, assigning a unique label vector to each region, and marking the label vector by bit offset; decoding the instructions actually executed by the program according to the data operation semantics of the instructions to obtain the instruction decoding result; and calculating the microcode sequence through predefined taint propagation based on the instruction decoding result to analyze the source operation... Tag propagation calculations are performed on the tag vectors of the operand and the destination operand to obtain the tainted tag vector. Starting from a specified position in the program, the corresponding region is traced back to identify the tainted region based on the bits set to 1 in the tag vector corresponding to the tainted instruction operand. If the size of the tainted region is less than or equal to a preset threshold, a tag vector is assigned to each byte or bit, and taint propagation calculations are performed again based on the assigned tag vectors to determine the corresponding tainted region. If the size of the tainted region is greater than the preset threshold, the tainted region is further divided into multiple fixed-size sub-blocks, and the tag vector allocation and taint propagation calculations are repeated to determine the corresponding tainted region until the target accuracy is achieved.

[0161] Furthermore, the present invention also provides a non-transitory computer-readable storage medium storing a computer program thereon. When executed by a processor, this computer program implements the multi-label data stream tracing method provided by the methods described above. This method includes: dividing input data into multiple fixed-size regions; assigning a unique label vector to each region; marking the label vectors using bit offsets; decoding the instructions actually executed by the program according to the data operation semantics of the instructions to obtain an instruction decoding result; and calculating a microcode sequence based on the instruction decoding result through predefined taint propagation, and applying the label vectors of the source and destination operands to the microcode. The program performs taint propagation calculations to obtain a taint-propagated label vector. Starting from a specified position in the program, it backtracks to the corresponding region as the taint region based on the bits set to 1 in the label vector corresponding to the instruction operand after taint propagation. If the size of the taint region is less than or equal to a preset threshold, a label vector is assigned to each byte or bit, and taint propagation calculations are performed again based on the assigned label vectors to determine the corresponding taint region. If the size of the taint region is greater than the preset threshold, the taint region is further divided into multiple fixed-size sub-blocks, and the label vector allocation and taint propagation calculations are repeated to determine the corresponding taint region until the target accuracy is achieved.

[0162] The system embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0163] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., including several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods of various embodiments or some parts of embodiments.

[0164] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A hardware-implemented multi-tag data flow tracing method, characterized by, The method comprises the following steps: Divide the input data into a plurality of fixed-size regions, and assign a unique label vector to each region, the label vector being marked by bit offset, specifically comprising: taking the starting address of the input data in the memory as the reference address; starting from the reference address, dividing the input data in sequence in units of hardware parallel processing bit width to obtain a plurality of fixed-size regions; generating an N-bit binary label vector for each region, where N is equal to the hardware parallel processing bit width; wherein only the ith bit of the label vector of the ith region is set to 1, and the remaining N-1 bits are all set to 0, and i ranges from 0 to N-1; According to the data operation semantics of the instruction, the actually executed instructions of the program are decoded to obtain an instruction decoding result; According to the instruction decoding result, a microcode sequence is calculated by a predefined taint propagation calculation, and the label vectors of the source operand and the destination operand are calculated by taint propagation calculation to obtain the label vectors after taint propagation, specifically comprising: determining the microcode instruction sequence corresponding to the current instruction according to the instruction decoding result; reading the first label vector corresponding to the source operand from the taint record area, and reading the second label vector corresponding to the destination operand from the taint record area; inputting the first label vector and the second label vector into the vector calculation module; performing logical operation on the first label vector and / or the second label vector according to the microcode instruction sequence to generate a third label vector of the destination operand; writing the third label vector back to the position corresponding to the destination operand in the taint record area to update the taint state thereof; Starting from the specified position of the program, the region corresponding to the set bit in the label vector of the instruction operand after taint propagation is traced back as a taint region; If the size of the taint region is less than or equal to a preset threshold, a label vector is assigned to each byte or bit, and the taint propagation calculation is continued according to the assigned label vector to determine the corresponding taint region; If the size of the taint region is greater than the preset threshold, the taint region is further divided into a plurality of fixed-size sub-blocks, and the label vector assignment and taint propagation calculation are repeated to determine the corresponding taint region until the target accuracy is reached.

2. The hardware-implemented multi-tag dataflow tracing method of claim 1, wherein, Before decoding the received external instruction, a microcode-based taint propagation rule is constructed, comprising: Traverse the target instruction set to extract the operation code, operand type and length information of each instruction; According to the semantics of the operation code, determine the data flow between the source operand and the destination operand; According to the data flow, generate one or more microcode instructions for each instruction, the microcode instructions including assignment instructions, shift instructions, logical operation instructions and control flow transfer instructions; Map the microcode instructions and the corresponding operation codes, generate a taint propagation rule table according to the mapping relationship and store it in a preset format.

3. The hardware-implemented multi-tag dataflow tracing method of claim 1, wherein, The hardware parallel bit processing unit synchronously performs logical operation on the N-bit label vector; the logical operation includes or operation, and operation, exclusive or operation and bit shift operation; The vector calculation module is a microcode interpretation execution unit or a configurable logic circuit, wherein: The microcode interpretation execution unit converts the microcode instruction sequence into micro-operation signals through a decoder and then executes; The configurable logic circuit solidifies the microcode instruction sequence into a hardware logic gate array to complete the logical operation of the tag vector in a single cycle.

4. The hardware-implemented multi-tag dataflow tracing method of claim 1, wherein, The target precision includes byte-level precision or bit-level precision, and the division is stopped when the size of any divided taint region is equal to the user-defined precision.

5. A multi-label data stream tracking system, characterized by, The marking module is configured to divide the input data into a plurality of fixed-size regions and assign a unique tag vector to each region, wherein the tag vector is marked by bit offset, and specifically includes: taking the starting address of the input data in the memory as a reference address; dividing the input data in the hardware parallel processing bit width units sequentially from the reference address to obtain a plurality of fixed-size regions; generating an N-bit binary tag vector for each region, where N is equal to the hardware parallel processing bit width; and only the i-th bit of the tag vector of the i-th region is set to 1, and the remaining N-1 bits are set to 0, where i ranges from 0 to N-1. The decoding module is configured to decode the instructions actually executed by the program according to the data operation semantics of the instructions to obtain instruction decoding results. The vector calculation module is configured to perform taint propagation calculation on the tag vectors of the source operand and the destination operand according to the instruction decoding results and a predefined taint propagation calculation microcode sequence to obtain tag vectors after taint propagation, and specifically includes: determining the microcode instruction sequence corresponding to the current instruction according to the instruction decoding results; reading a first tag vector corresponding to the source operand from a taint record area and reading a second tag vector corresponding to the destination operand from the taint record area; inputting the first tag vector and the second tag vector into the vector calculation module; performing logical operation on the first tag vector and / or the second tag vector according to the microcode instruction sequence to generate a third tag vector of the destination operand; and writing the third tag vector back to a position in the taint record area corresponding to the destination operand to update the taint state thereof. The taint backtracking module is configured to backtrack the corresponding region as a taint region according to the bit set to 1 in the tag vector corresponding to the instruction operand after taint propagation, starting from a specified position of the program. The taint positioning module is configured to assign a tag vector to each byte or bit if the size of the taint region is less than or equal to a preset threshold, and then continue to perform taint propagation calculation according to the assigned tag vector to determine the corresponding taint region; and if the size of the taint region is greater than the preset threshold, the taint region is further divided into a plurality of fixed-size sub-blocks, and the tag vector assignment and taint propagation calculation are repeated to determine the corresponding taint region until the target precision is reached. The processor executes the computer program to implement the multi-tag data flow tracking method according to any one of claims 1 to 4.

6. An electronic device comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, characterized in that, ​ 7. A non-transitory computer-readable storage medium having stored thereon a computer program, characterized in that, The computer program, when executed by a processor, implements the multi-tag data stream tracking method according to any one of claims 1 to 4.

8. A computer program product comprising a computer program, characterized in that, The computer program, when executed by a processor, implements the multi-tag data stream tracking method according to any one of claims 1 to 4.

Images