Staged Dynamic Taint Flow Inference for Runtime Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Dynamic taint analysis in dynamic languages faces challenges in tracking taint flows through primitive values and native code due to the need for heavyweight instrumentation and imprecise models of program behavior, leading to potential unsound results.
Innovation Solution
A method involving a staged approach with taint inferences and checks to determine actual taint flows by correlating source and sink values, using techniques like substring matching and similarity scores, and analyzing execution traces to rule out false positives, thereby improving precision and efficiency.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If source code-level instrumentation is used for dynamic taint tracking, then the analysis can run on multiple engines simplifying maintenance, but it is difficult to track taint flowing through primitive values, built-in functions, and native code requiring additional boxing and unboxing
Solution Approach 1:
The patent introduces an intermediary approach by using engine-level instrumentation as a mediator between the taint tracking requirement and the code execution. Instead of directly instrumenting source code which requires boxing/unboxing operations, the solution instruments at the engine level where primitive values and native code can be tracked natively without additional complexity
Solution Approach 2:
The patent creates copies of the runtime system with instrumentation embedded at the engine level. These instrumented runtime copies can track taint flows through primitive values and native code directly, avoiding the need for source code modification and the associated boxing/unboxing complexity while maintaining multi-engine compatibility
2Adaptability or versatility
If source code-level dynamic taint tracking is used, then it can run on multiple engines, but the intended behavior of the program might accidentally be altered due to instrumentation
Solution Approach 1:
The runtime system acts as an intermediary layer between the instrumented code and the actual execution engine. By performing taint tracking at the runtime level rather than through source code instrumentation, the original program semantics are preserved while still enabling cross-engine taint analysis capability
Solution Approach 2:
The patent replaces the mechanical source code instrumentation approach with a runtime-based taint tracking mechanism. This substitution eliminates the need to modify source code and thus prevents accidental alteration of program behavior, while still achieving the goal of multi-engine taint tracking
3Measurement precision
If traditional dynamic taint analysis with heavyweight instrumentation is used, then it can track taint flows, but it generates unsound results due to imprecise model of program behavior and produces false positives
Solution Approach 1:
The patent segments the taint analysis into multiple stages: first-stage taint tracking at the runtime level to identify potential taint flows, and second-stage verification through taint checks to confirm actual taint flows. This segmentation allows the system to reduce false positives by verifying taint flows through multiple independent checks, improving both precision and soundness
Solution Approach 2:
The patent implements feedback mechanisms where taint checks verify the results of taint tracking. The verification stage uses the execution trace and taint propagation information to confirm whether detected taint flows are actual vulnerabilities or false positives, providing feedback that improves the reliability and soundness of the analysis
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A method may include obtaining, from a runtime system that executes code, a source value at a source point of the code and a sink value at a sink point of the code, identifying a potential taint flow from the source point to the sink point by performing a series of taint inferences that each infer a relationship between the source value and the sink value, and determining whether the potential taint flow is an actual taint flow by performing a series of taint checks that each analyze the execution of the code using the source value and the sink value.