On the Deployment of Dynamic Taint Analysis for Application Communities

Abstract

SUMMARYAlthough software-attack detection via dynamic taint analysis (DTA) supports high coverage of program execution, it prohibitively degrades the performance of the monitored program. This letter explores the possibility of collaborative dynamic taint analysis among members of an application community (AC): instead of full monitoring for every request at every instance of the AC, each member uses DTA for some fraction of the incoming requests, thereby loosening the burden of heavyweight monitoring. Our experimental results using a test AC based on the Apache web server show that speedy detection of worm outbreaks is feasible with application communities of medium size (i.e., 250-500). key words: dynamic taint analysis, 0-day attack detection, application community, software security

The MINESTRONE Architecture Combining Static and Dynamic Analysis Techniques for Software Security

“…When source code is available, we will insert the instrumentation through source-code transformations [16], [17]. Otherwise, we will inject our instrumentation in program binaries using the PIN binary rewriting tool (which is neither as efficient nor as effective, due to the various challenges in working with binaries) [18], [4]. The specific vulnerability types we are protecting against include number handling, error handling, concurrency handling, memory safety errors (e.g., buffer overflows/underflows), null pointer and tainted data/input validation errors.…”