Data Flow Analysis Using Collapsed Contexts for Taint Tracking
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current data flow analysis methods often result in false positives and high computational complexity due to the lack of consideration for calling contexts, particularly when analyzing functions with multiple arguments, leading to inefficient taint analysis in software programs.
Innovation Solution
The implementation of collapsed contexts in data flow analysis, which reduces complexity from exponential to constant by collapsing all non-default contexts into two categories: default and collapsed contexts, allowing each tainted argument to be analyzed only once.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If Cartesian Product calling contexts are used to reduce false positives, then measurement precision is improved, but device complexity increases exponentially
Solution Approach 1:
The patent merges multiple Cartesian Product calling contexts into a single collapsed context by combining the taintedness information of all arguments. Instead of maintaining separate contexts for each combination of tainted/untainted arguments, the invention consolidates them into one context that tracks whether any argument is tainted, thereby reducing false positives without incurring exponential complexity
Solution Approach 2:
The collapsed context serves multiple functions simultaneously: it tracks taintedness for all arguments of a function call regardless of the specific combination of tainted/untainted arguments, making the data flow analysis applicable to all calling contexts universally without requiring separate analysis for each Cartesian Product combination
2Measurement precision
If Cartesian Product calling contexts are used to analyze functions with multiple arguments, then measurement precision is improved, but loss of time increases exponentially
Solution Approach 1:
The patent merges multiple Cartesian Product calling contexts into a single collapsed context by combining the taintedness information of all arguments. Instead of maintaining separate contexts for each combination of tainted/untainted arguments, the invention consolidates them into one context that tracks whether any argument is tainted, thereby reducing false positives without incurring exponential complexity
Solution Approach 2:
The collapsed context performs a simplified form of context tracking that is sufficient for the security analysis goal. Rather than exactly tracking every possible combination of argument taintedness (excessive action), the invention uses a partial approximation that tracks only whether any argument is tainted, which is adequate for detecting potential security vulnerabilities without the exponential time cost
3Device complexity
If no calling contexts are considered in data flow analysis, then device complexity is reduced, but measurement precision deteriorates due to false positives
Solution Approach 1:
The patent merges multiple Cartesian Product calling contexts into a single collapsed context by combining the taintedness information of all arguments. Instead of maintaining separate contexts for each combination of tainted/untainted arguments, the invention consolidates them into one context that tracks whether any argument is tainted, thereby reducing false positives without incurring exponential complexity
Data Source
Figure 1
Figure 2A
Figure 2B
AI summary
Methods, systems, and apparatus, including computer programs encoded on computer storage media, for performing data flow analysis using collapsed contexts. One of the methods includes obtaining data representing a plurality of software elements, wherein one or more software elements are initially designated as elements having the particular property; iteratively designating other software elements to which data of the one or more elements having the particular property can flow, including: whenever the program includes multiple calls to a function, analyzing the function in a collapsed context to determine whether any argument can flow to a return value of the function, and whenever any data in an argument that has the particular property according to the collapsed context can flow to a return value of the function, adding each call to the function throughout the program having one argument having the particular property; and providing the set of software elements having the particular property.