Multi-language dynamic taint analysis in a polyglot virtual machine
Multi-language dynamic taint analysis in a polyglot virtual machine
复制标题
DOI：
10.1145/3426182.3426184
复制
发表时间：
2020-11
期刊：
影响因子：
--
通讯作者：
Jacob Kreindl;Daniele Bonetta;Lukas Stadler;David Leopoldseder;H. Mössenböck
中科院分区：
文献类型：
--
作者：
Jacob Kreindl;Daniele Bonetta;Lukas Stadler;David Leopoldseder;H. Mössenböck
动态污点分析是一种流行的程序分析技术，其中敏感数据被标记为污染，并跟踪污染数据的传播，以确定该数据是否达到关键程序位置。分析，测试和调试以及许多其他领域。目标本地代码都不适合分析应用数据流的其他语言，因此可以导致分析在本文中，我们介绍了Truffletaint，这是一个多语言动态污点的平台传播污点标签以克服语言边界的技术，但仍允许基于针对编程语言的运行时间的松露框架进行特定语言的污点传播规则。可以轻松扩展以支持其他语言。我们作为C，JavaScript和Python代码的组合实现的计算机语言基准游戏，我们适应了在各种语言交互情况下传播污点。在ART动态污点分析平台中，当引入污点时，只有高达约40倍的放缓。
Dynamic taint analysis is a popular program analysis technique in which sensitive data is marked as tainted and the propagation of tainted data is tracked in order to determine whether that data reaches critical program locations. This analysis technique has been successfully applied to software vulnerability detection, malware analysis, testing and debugging, and many other fields. However, existing approaches of dynamic taint analysis are either language-specific or they target native code. Neither is suitable for analyzing applications in which high-level dynamic languages such as JavaScript and low-level languages such as C interact.In these approaches, the language boundary forms an opaque barrier that prevents a sound analysis of data flow in the other language and can thus lead to the analysis being evaded. In this paper we introduce TruffleTaint, a platform for multi-language dynamic taint analysis that uses language-independent techniques for propagating taint labels to overcome the language boundary but still allows for language-specific taint propagation rules. Based on the Truffle framework for implementing runtimes for programming languages, TruffleTaint supports propagating taint in and between a selection of dynamic and low-level programming languages and can be easily extended to support additional languages. We demonstrate TruffleTaint’s propagation capabilities and evaluate its performance using several benchmarks from the Computer Language Benchmarks Game, which we implemented as combinations of C, JavaScript and Python code and which we adapted to propagate taint in various scenarios of language interaction. Our evaluation shows that TruffleTaint causes low to zero slowdown when no taint is introduced, rivaling state-of-the-art dynamic taint analysis platforms, and only up to ∼40x slowdown when taint is introduced.