一句话：提出首个面向 JVM 微服务的实用非侵入式动态污点分析技术 MirrorTaint，通过镜像空间实现高精度低开销跟踪。
现有静态与动态污点分析难以直接应用于工业级微服务系统。本文提出首个实用的非侵入式动态污点分析技术 MirrorTaint：通过插桩在镜像空间中构建带策略的数据结构来标记与传播污点，且不修改程序元数据或运行时系统；执行时在线复现基于栈的 JVM 指令以跟踪污点。在多个开源微服务系统上，其兼容性优于 Phosphor 与 FlowDroid，精度相近而召回率更高（97.9%/100.0% 对比 100%/9.9% 与 100%/28.2%），运行开销低于 Phosphor。蚂蚁集团案例研究显示，MirrorTaint 以 100% 精度自动发现 99.0% 的数据关系（开发者经验系统仅覆盖 84.0%），并成功检测 Log4j2 漏洞。
Taint analysis, i.e., labeling data and propagating the labels through data flows, has been widely used for analyzing program information flows and ensuring system/data security. Due to its important applications, various taint analysis techniques have been proposed, including static and dynamic taint analysis. However, existing taint analysis techniques can be hardly applied to the rising microservice systems for industrial applications. To address such a problem, in this paper, we proposed the first practical non-intrusive dynamic taint analysis technique MirrorTaint for extensively supporting microservice systems on JVMs. In particular, by instrumenting the microservice systems, MirrorTaint constructs a set of data structures with their respective policies for labeling/propagating taints in its mirrored space. Such data structures are essentially non-intrusive, i.e., modifying no program meta-data or runtime system. Then, during program execution, MirrorTaint replicates the stack-based JVM instruction execution in its mirrored space on-the-fly for dynamic taint tracking. We have evaluated MirrorTaint against state-of-the-art dynamic and static taint analysis systems on various popular open-source microservice systems. The results demonstrate that MirrorTaint can achieve better compatibility, quite close precision and higher recall (97.9%/100.0%) than state-of-the-art Phosphor (100.0%/9.9%) and FlowDroid (100%/28.2%). Also, MirrorTaint incurs lower runtime overhead than Phosphor (although both are dynamic techniques). Moreover, we have performed a case study in Ant Group, a global billion-user FinTech company, to compare MirrorTaint and their mature developer-experience-based data checking system for automatically generated fund documents. The result shows that the developer experience can be incomplete, causing the data checking system to only cover 84.0% total data relations, while MirrorTaint can automatically find 99.0% relations with 100.0% precision. Lastly, we also applied MirrorTaint to successfully detect a recently wide-spread Log4j2 security vulnerability.
@inproceedings{OuyangSCSCXZZ23,
title = {MirrorTaint: Practical Non-intrusive Dynamic Taint Tracking for JVM-based Microservice Systems},
author = {Yicheng Ouyang and Kailai Shao and Kunqiu Chen and Ruobing Shen and Chao Chen and Mingze Xu and Yuqun Zhang and Lingming Zhang},
booktitle = {ICSE},
year = {2023},
doi = {10.1109/icse48619.2023.00210}
}