Abstract:
In dynamic taint analysis(DTA), source program instrumentation is inconvenient for analyzing applications. Coarse-grained DTA method has high efficiency but low accuracy, while some fine-grained DTA methods produce few false positives but low efficiency. A DTA method for Java target code is proposed to implement fine-grained taint analysis with optimized instruction analysis. An annotation parser was constructed to control the scope of taint marking and propagation and optimize taint analysis. Data input by users were marked as tainted. Stateless and stateful transformation principles were used to implement instruction-level taint propagation analysis. A prototype system was implemented using ASM framework. In overhead experiments, the average extra overhead of the instrumentation system is better than typical DTA tool Phosphor. In accuracy test, character-level taint propagation ability was tested, and the system’s detection accuracy of pollution path reaches 97.1%, which is also better than Phosphor.