FlowTwist: efficient context-sensitive inside-out taint analysis for large codebases
FlowTwist: efficient context-sensitive inside-out taint analysis for large codebases
复制标题
FlowTwist：针对大型代码库的高效上下文相关的由内而外的污点分析
DOI：
10.1145/2635868.2635878
复制
发表时间：
2014
期刊：
影响因子：
--
通讯作者：
Mira Mezini
中科院分区：
文献类型：
--
作者：
Johannes Lerch;Ben Hermann;Eric Bodden;Mira Mezini
在过去的几年里，广泛使用的平台（例如 Java 类库）一直受到涉及两个污点分析问题组合的漏洞的攻击：完整性问题允许攻击者在平台内触发敏感操作，机密性问题允许攻击者从这些操作的结果中检索敏感信息或指针。虽然现有的静态污点分析能够很好地解决这些问题中的任何一个，但我们表明，当应用于需要结合利用完整性和机密性问题的情况时，它们的扩展性非常糟糕。主要问题是 Java 类库等库的巨大攻击面，它暴露了攻击者可能控制的数千种方法。因此，在这项工作中，我们提出了 FlowTwist，这是一种由内而外工作的新型污点分析方法，即跟踪从潜在易受攻击的调用到攻击者可能控制的 API 外部级别的数据流。这种由内而外的分析需要对向后和向前污点分析进行仔细的、上下文相关的协调。在这项工作中，我们公开了一种基于 IFDS 算法的分析方法的设计，并解释了 IFDS 的几种扩展，这些扩展不仅可以实现这种协调，还可以向安全分析师报告错误情况。对 Java 类库的实验表明，虽然简单的前向污点分析方法即使在机器能力很强的情况下也无法扩展，但 FlowTwist 的算法能够在 10 分钟内完全分析该库。
Over the past years, widely used platforms such as the Java Class Library have been under constant attack through vulnerabilities that involve a combination of two taint-analysis problems: an integrity problem allowing attackers to trigger sensitive operations within the platform, and a confidentiality problem allowing the attacker to retrieve sensitive information or pointers from the results of those operations. While existing static taint analyses are good at solving either of those problems, we show that they scale prohibitively badly when being applied to situations that require the exploitation of both an integrity and confidentiality problem in combination. The main problem is the huge attack surface of libraries such as the Java Class Library, which exposes thousands of methods potentially controllable by an attacker. In this work we thus present FlowTwist, a novel taint-analysis approach that works inside-out, i.e., tracks data flows from potentially vulnerable calls to the outer level of the API which the attacker might control. This inside-out analysis requires a careful, context-sensitive coordination of both a backward and a forward taint analysis. In this work, we expose a design of the analysis approach based on the IFDS algorithm, and explain several extensions to IFDS that enable not only this coordination but also a helpful reporting of error situations to security analysts. Experiments with the Java Class Library show that, while a simple forward taint-analysis approach does not scale even with much machine power, FlowTwist's algorithm is able to fully analyze the library within 10 minutes.
一种低确定性安全的新算法
影响因子：
3.2
作者：
Dennis Giffhorn;G. Snelting
通讯作者：
G. Snelting