A dynamic taint analyzer for distributed systems
A dynamic taint analyzer for distributed systems
复制标题
DOI：
10.1145/3338906.3341179
复制
发表时间：
2019-08
期刊：
影响因子：
--
通讯作者：
Xiaoqin Fu;Haipeng Cai
中科院分区：
文献类型：
--
作者：
Xiaoqin Fu;Haipeng Cai
与其他软件领域一样，信息流安全是分布式系统中代码安全的一个基本方面。然而，大多数现有的信息流安全解决方案仅限于集中式软件。对于分布式系统，这样的解决方案面临着多重挑战，包括技术适用性、工具可移植性和分析可伸缩性。为了克服这些挑战，我们提出了DistTaint，一个用于分布式系统的动态信息流(TRANT)分析器。DistTaint通过对方法执行事件的偏序来推断分布式程序中的隐式依赖关系，从而解决了适用性问题。它完全在应用程序级别工作，而无需定制运行时平台，从而解决了可移植性挑战。为了实现可伸缩性，它使用多阶段分析来降低分析成本，其中分析前阶段生成方法级结果，以缩小后续语句级分析的范围。我们针对八个真实的分布式系统对DistTaint进行了评估。实验结果表明，DistTaint对行业规模的分布式系统的适用性、可移植性和可伸缩性，以及发现已知和未知漏洞的能力。DistTaint的演示视频可以从https://www.dropbox.com/l/scl/AAAkrm4p63Ffx0rZqblY3zlLFuaohbRxs0下载或点击此处https://youtu.be/fy4yMIaKzPE Online观看。工具包在这里：https://www.dropbox.com/sh/kfr9ixucyny1jp2/AAC00aI-I8Od4ywZCqwZ1uaa?dl=0
As in other software domains, information flow security is a fundamental aspect of code security in distributed systems. However, most existing solutions to information flow security are limited to centralized software. For distributed systems, such solutions face multiple challenges, including technique applicability, tool portability, and analysis scalability. To overcome these challenges, we present DistTaint, a dynamic information flow (taint) analyzer for distributed systems. By partial-ordering method-execution events, DistTaint infers implicit dependencies in distributed programs, so as to resolve the applicability challenge. It resolves the portability challenge by working fully at application level, without customizing the runtime platform. To achieve scalability, it reduces analysis costs using a multi-phase analysis, where the pre-analysis phase generates method-level results to narrow down the scope of the following statement-level analysis. We evaluated DistTaint against eight real-world distributed systems. Empirical results showed DistTaint’s applicability to, portability with, and scalability for industry-scale distributed systems, along with its capability of discovering known and unknown vulnerabilities. A demo video for DistTaint can be downloaded from https://www.dropbox.com/l/scl/AAAkrm4p63Ffx0rZqblY3zlLFuaohbRxs0 or viewed here https://youtu.be/fy4yMIaKzPE online. The tool package is here: https://www.dropbox.com/sh/kfr9ixucyny1jp2/AAC00aI-I8Od4ywZCqwZ1uaa?dl=0