D2Taint: Differentiated and dynamic information flow tracking on smartphones for numerous data sources
D2Taint: Differentiated and dynamic information flow tracking on smartphones for numerous data sources
复制标题
D2Taint：智能手机上针对众多数据源的差异化动态信息流跟踪
DOI：
--
复制
发表时间：
2013
期刊：
影响因子：
--
通讯作者：
D. Xuan
中科院分区：
文献类型：
--
作者：
Boxuan Gu;Xinfeng Li;Gang Li;Adam C. Champion;Zhezhe Chen;Feng Qin;D. Xuan
随着近年来智能手机的飞速发展，从智能手机泄露敏感信息已成为一个日益严重的问题。这些敏感信息可能来自智能手机本身（例如，位置信息），也可能来自许多互联网来源（例如，银行账户、电子邮件）。虽然之前的工作已经证明了信息流跟踪（IFT）在检测智能手机信息泄露方面的有效性，但它只能处理有限数量的敏感信息源。本文提出了一种基于差异化和动态标注的IFT标注策略。我们将信息源划分为不同的类，并将它们存储在固定长度的标签中。我们根据时变的接收信息源调整标签结构。我们的标记策略使我们能够在运行时跟踪多个类中的众多信息源，并快速检测来自这些信息源的信息泄漏。我们在现实世界的智能手机上使用我们的标签策略设计并实现了d2tint，这是一个IFT系统。我们用从b谷歌Play下载的84个实际应用程序实验评估了D2Taint的有效性。D2Taint报告称，其中超过80%的人将数据泄露给第三方目的地；14%泄露高度敏感数据。我们使用标准基准测试工具进行的实验评估说明了D2Taint在智能手机上处理许多信息源时的有效性，并且运行时和空间开销适中。
With smartphones' meteoric growth in recent years, leaking sensitive information from them has become an increasingly critical issue. Such sensitive information can originate from smartphones themselves (e.g., location information) or from many Internet sources (e.g., bank accounts, emails). While prior work has demonstrated information flow tracking's (IFT's) effectiveness at detecting information leakage from smartphones, it can only handle a limited number of sensitive information sources. This paper presents a novel IFT tagging strategy using differentiated and dynamic tagging. We partition information sources into differentiated classes and store them in fixed-length tags. We adjust tag structure based on time-varying received information sources. Our tagging strategy enables us to track at runtime numerous information sources in multiple classes and rapidly detect information leakage from any of these sources. We design and implement D2Taint, an IFT system using our tagging strategy on real-world smartphones. We experimentally evaluate D2Taint's effectiveness with 84 real-world applications downloaded from Google Play. D2Taint reports that over 80% of them leak data to third-party destinations; 14% leak highly sensitive data. Our experimental evaluation using a standard benchmark tool illustrates D2Taint's effectiveness at handling many information sources on smartphones with moderate runtime and space overhead.