Home

Capturing Information Flow with Concatenated Dynamic Taint Analysis

Hyung Chan Kim; Angelos D. Keromytis; Michael Covington; Ravi Sahita

Title:
Capturing Information Flow with Concatenated Dynamic Taint Analysis
Author(s):
Kim, Hyung Chan
Keromytis, Angelos D.
Covington, Michael
Sahita, Ravi
Date:
Type:
Articles
Department:
Computer Science
Permanent URL:
Book/Journal Title:
Proceedings: International Conference on Availability, Reliability and Security: ARES 2009: 16-19 March 2009, Fukuoka, Fukuoka Prefecture, Japan
Publisher:
IEEE
Publisher Location:
Los Alamitos, Calif.
Abstract:
Dynamic taint analysis (DTA) is a technique used for tracking information flow by propagating taint propagation across memory locations during program execution. Most implementations of DTA are based on dynamic binary instrumentation (DBI) frameworks or whole-system emulators/virtual machine monitors. The boundary of information tracking with DBI frameworks is a single process, while system emulators can cover a host, including the OS. Using system emulators, it may be possible to consider taint propagation across multiple processes executing locally, within the emulator. However, there is an increasing need for tracking information flow across single-system boundaries and across the whole enterprise. We describe a proof-of-concept architecture for tracking multiple mixed-information flows among several processes across a distributed enterprise. Our DTA tool is based on PIN, a DBI framework by Intel, and the concatenated DTA processing is realized with per-host flow managers. We have tested our prototype with typical enterprise applications. As a motivating example, we track information leakage due to a SQL injection attack from a web-based database server query. Our work is of an exploratory nature, aiming to expose our early findings and identify areas where additional research is needed in improving usability and performance.
Subject(s):
Computer science
Publisher DOI:
http://dx.doi.org/10.1109/ARES.2009.56
Item views:
290
Metadata:
View

In Partnership with the Center for Digital Research and Scholarship at Columbia University Libraries/Information Services.