Taint Analysis Access Path Propagation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for analyzing unvalidated dataflows in computer networks, such as taint analysis, are computationally expensive and lack scalability, making them inefficient in preventing injection attacks like SQL injection and XSS attacks.
Innovation Solution
A method involving the generation of nodes for source code statements, identification of source and sink nodes, and determination of backward reachability to identify potential taint flows through a supergraph-based access path propagation, allowing for efficient and scalable taint analysis.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If comprehensive alias analysis is used for taint analysis, then measurement precision is improved, but computational complexity increases
Solution Approach 1:
The patent segments the dataflow analysis into two distinct phases: a fast forward phase that propagates access paths through the program, and a backward phase that only processes potential taint flows identified by the forward phase. This segmentation allows the system to achieve comprehensive taint analysis accuracy while avoiding the computational complexity of analyzing all possible dataflows equally.
Solution Approach 2:
The patent applies partial action by performing complete forward dataflow analysis only on access paths that are potentially tainted, rather than analyzing all dataflows in the program. The forward phase propagates access paths selectively, and the backward phase focuses only on identified potential taint flows, reducing overall computational complexity while maintaining precision for relevant paths.
2Reliability
If comprehensive taint analysis is performed, then security detection capability is improved, but processing time increases
Solution Approach 1:
The patent performs preliminary forward dataflow analysis to identify potential taint flows before conducting the backward analysis. By pre-processing the program to propagate access paths and identify which dataflows are potentially tainted, the system avoids performing expensive backward analysis on all possible dataflows, thus reducing processing time while maintaining comprehensive security detection.
Solution Approach 2:
The patent skips the backward analysis step for dataflows that are not identified as potential taint flows by the forward phase. The two-phase approach allows the system to rush through the identification of relevant taint paths using efficient forward analysis, then focus computational resources only on verifying and analyzing the potentially problematic dataflows, significantly reducing overall processing time.
3Measurement precision
If alias analysis is used to track dataflows, then measurement precision is improved, but scalability deteriorates
Solution Approach 1:
The patent segments the alias analysis into a forward propagation phase that builds access path information incrementally, and a backward verification phase that uses this pre-computed information. This segmentation allows the system to scale better because the forward phase can process large programs efficiently by propagating access paths in a single direction, while the backward phase operates only on the reduced set of potential taint flows.
Solution Approach 2:
The patent applies partial action by performing complete alias analysis only for access paths that are potentially tainted, rather than computing alias information for all variables in the program. The forward phase selectively propagates access paths, and the backward phase performs detailed alias analysis only where needed, improving scalability while maintaining precision for the relevant dataflows.
Data Source
AI summary
A method that involves generating, for source code, a set of nodes for a set of statements comprising a first statement and a second statement, wherein each node of the set of nodes comprises a dataflow fact and a statement of the set of statements; identifying a source node and a sink node of the set of nodes; determining that the source node is backward reachable from the sink node by analyzing an incoming access path; and, in response to the determination, identifying a potential taint flow from the source node to the sink node.