Iodine: Fast Dynamic Taint Tracking Using Rollback-free Optimistic Hybrid Analysis

Abstract

Dynamic information-flow tracking (DIFT) is useful for enforcing security policies, but rarely used in practice, as it can slow down a program by an order of magnitude. Static program analyses can be used to prove safe execution states and elide unnecessary DIFT monitors, but the performance improvement from these analyses is limited by their need to maintain soundness.In this paper, we present a novel optimistic hybrid analysis (OHA) to significantly reduce DIFT overhead while still guaranteeing sound results. It consists of a predicated whole-program static taint analysis, which assumes likely invariants gathered from profiles to dramatically improve precision. The optimized DIFT is sound for executions in which those invariants hold true, and recovers to a conservative DIFT for executions in which those invariants are false. We show how to overcome the main problem with using OHA to optimize live executions, which is the possibility of unbounded rollbacks. We eliminate the need for any rollback during recovery by tailoring our predicated static analysis to eliminate only safe elisions of noop monitors. Our tool, Iodine, reduces the overhead of DIFT for enforcing security policies to 9%, which is 4.4× lower than that with traditional hybrid analysis, while still being able to be run on live systems.

The Taint Rabbit: Optimizing Generic Taint Analysis with Dynamic Fast Path Generation

“…To aid validate this claim, we ran the same experiments but randomly sampled taint introduction based on various probabilities. For instance, on SPEC CPU, overall overhead is reduced to 12.5x from 22.4x when the odds of introducing taint is set to 1 25 .…”

“…Iodine [1] also uses dynamic information to drive static analysis. Instrumentation is optimistically pruned such that it avoids rollbacks upon violations of likely runtime invariants.…”

A Reverse Modification Method for Binary Code and Data

“…Taint analysis [ 12 ] are technologies to analyze program information flow to detect vulnerabilities or malware. Dynamic taint analysis has been applied to android systems [ 13 , 14 ]. For boosting taint analysis, Chen et al [ 15 ] used dynamic taint analysis with neural networks.…”

BAHK: Flexible Automated Binary Analysis Method with the Assistance of Hardware and System Kernel

“…After that, the similar offline scheme StraightTaint is also proposed [26], and Wang et al also proposed another offline analysis method [27]. Recently, Banerjee et al proposed the new analysis tool Iodine [28], which can avoid the frequent rollbacks in the optimistic dynamic analysis. Most of the researches were based on dynamic binary instrumentation methods that are easily to be detected by the program being analyzed and may also have applicability problems, especially the fact that the target program is graphically intensive.…”

“…(11) Check and mark the loops in the traversed nodes. (12) end (13) else (14) Disassemble and parse block (15) while Get instruction ins from block successfully do (16) if ins is a system call instruction or has memory operations then (17) Mark block as abort (18) break (19) else if ins is a direct unconditional jump instruction then (20) Construct the node of target block, and push it to stack_dfs (21) break (22) else if ins is a conditional branch instruction then (23) Construct all successor nodes of block, and push them to stack_dfs (24) break (25) else if ins is an indirect branch instruction or other transfers then (26) Mark block as pending, and save the traversed nodes and execution paths (27) break (28) else if ins is the end_ins then (29) Mark block as the end (30) break (31) else (32) Save the parse result to block en we still need to reexecute part of the instructions in the paths to obtain the real execution path. For two possible…”