Modular Taint Analysis via Access Paths for Memory Efficiency
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing taint analysis methods do not support modular analysis, which is necessary for efficient detection of security vulnerabilities like SQL injections and cross-site-scripting, as they do not effectively reason about taint flows through the memory heap.
Innovation Solution
A method and system that extract left-hand side and right-hand side access paths from instructions in source code, determine if an incoming access path subsumes the left-hand side access path, and generate a specialized outgoing access path by appending fields, allowing identification of potential taint flows between entry and exit access paths.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional taint analysis is applied to entire programs, then complete security vulnerability detection is achieved, but memory usage increases and analysis efficiency decreases
Solution Approach 1:
The patent divides the program into independent modules or functions, analyzing each separately with its own access path context. This segmentation allows the analysis to focus on local taint flows within each module rather than tracking all possible paths through the entire program, significantly reducing memory consumption while maintaining detection effectiveness for module-level vulnerabilities.
Solution Approach 2:
The patent introduces access paths as intermediary representations that capture the contextual information needed for taint analysis without requiring the full program state. These access paths serve as mediators between the taint analysis engine and the program structure, enabling efficient tracking of data flows through heap operations without loading or processing the entire program into memory.
2Reliability
If traditional taint analysis is applied to entire programs, then complete security vulnerability detection is achieved, but analysis time increases
Solution Approach 1:
By segmenting the analysis into independent module-level analyses, the patent enables parallel processing of multiple modules and avoids the exponential complexity of whole-program analysis. Each module can be analyzed separately and quickly, with results combined to provide comprehensive coverage, significantly reducing total analysis time.
Solution Approach 2:
The patent performs preliminary analysis at the module level before combining results for whole-program assessment. This preliminary action of analyzing individual modules with their specific access path contexts allows the system to identify and report vulnerabilities early without waiting for complete whole-program analysis, reducing overall analysis time.
3Measurement precision
If contextual information is fully retained for each function analysis, then accurate taint flow detection is achieved, but memory usage increases
Solution Approach 1:
The patent extracts only the essential contextual information needed for taint analysis into access path representations, discarding unnecessary program state details. This extraction process retains the critical information about variable relationships and heap operations while eliminating redundant data, achieving accurate taint flow detection with minimal memory footprint.
Solution Approach 2:
The patent applies local quality by maintaining detailed access path context only where needed for specific taint analysis operations, rather than uniformly retaining all contextual information throughout the program. This allows high-precision tracking of taint flows at critical points while using simplified representations elsewhere, optimizing the balance between accuracy and memory usage.
Data Source
AI summary
A method may include extracting, from an instruction of a function in source code, (i) a left-hand side (LHS) access path including a first variable and a first sequence of fields and (ii) a right-hand side (RHS) access path including a second variable and a second sequence of fields, determining, using an incoming access path, an outgoing access path for the instruction, determining that the incoming access path subsumes the LHS access path, generating a specialized outgoing access path by appending a field of the LHS access path to the outgoing access path, determining, using the specialized outgoing access path, that an entry access path of the function is reachable from an exit access path of the function, in response to determining that the entry access path is reachable from the exit access path, identifying a potential taint flow from the entry access path to the exit access path.