基于指令优化分析的细粒度动态污点分析方法

FINE-GRAINED DYNAMIC TAINT ANALYSIS METHOD BASED ON INSTRUCTION OPTIMIZATION ANALYSIS

  • 摘要: 在动态污点分析(DTA)中,利用源程序插桩的方法在对应用程序分析时极不方便,粗粒度DTA方法的效率很高但准确度不高,而一些细粒度DTA方法误报率更低但效率不理想。针对上述问题,提出一种面向Java目标代码的DTA方法,以优化的指令分析实施细粒度污点分析。构建一个注解解析器,用于控制污点标记与传播的范围,实现污点分析的优化;对用户输入的数据进行污点标记;基于无状态和有状态转换原理实施指令级的污点传播分析。使用ASM框架实现了一个原型系统。在开销实验中,插桩系统的平均额外开销优于典型DTA工具Phosphor。在准确性测试中,测试了字符级的污点传播能力,同时该系统检测污染路径的准确率达到97.1%,同样优于Phosphor。

     

    Abstract: In dynamic taint analysis(DTA), source program instrumentation is inconvenient for analyzing applications. Coarse-grained DTA method has high efficiency but low accuracy, while some fine-grained DTA methods produce few false positives but low efficiency. A DTA method for Java target code is proposed to implement fine-grained taint analysis with optimized instruction analysis. An annotation parser was constructed to control the scope of taint marking and propagation and optimize taint analysis. Data input by users were marked as tainted. Stateless and stateful transformation principles were used to implement instruction-level taint propagation analysis. A prototype system was implemented using ASM framework. In overhead experiments, the average extra overhead of the instrumentation system is better than typical DTA tool Phosphor. In accuracy test, character-level taint propagation ability was tested, and the system’s detection accuracy of pollution path reaches 97.1%, which is also better than Phosphor.

     

/

返回文章
返回