一句话：提出 HardTaint，结合静态分析、选择性硬件追踪与并行图处理，使生产运行动态污点分析开销降至约 8%。
动态污点分析（DTA）广泛用于安全、隐私与诊断等领域，但因其需要在线收集并分析海量污点数据，运行时开销极高，通常仅适用于调试或测试场景。现有降低开销的尝试收效有限。本文提出并实现 HardTaint，一个能够支持生产运行动态污点追踪的系统。HardTaint 采用混合且系统化的设计，融合静态分析、选择性硬件追踪与并行图处理技术。综合评估表明，HardTaint 仅引入约 8% 的运行时开销，比当前最先进方法低一个数量级，同时不牺牲任何污点检测能力。
Dynamic taint analysis (DTA), as a fundamental analysis technique, is widely used in security, privacy, and diagnosis, etc. As DTA demands to collect and analyze massive taint data online, it suffers extremely high runtime overhead. Over the past decades, numerous attempts have been made to lower the overhead of DTA. Unfortunately, the reductions they achieved are marginal, causing DTA only applicable to the debugging/testing scenarios. In this paper, we propose and implement HardTaint, a system that can realize production-run dynamic taint tracking. HardTaint adopts a hybrid and systematic design which combines static analysis, selective hardware tracing and parallel graph processing techniques. The comprehensive evaluations demonstrate that HardTaint introduces only around 8% runtime overhead which is an order of magnitude lower than the state-of-the-arts, while without sacrificing any taint detection capability.
DOI 原文 · arXiv · PDF（开放获取） · DBLP
@article{abs-2402-17241,
title = {HardTaint: Production-Run Dynamic Taint Analysis via Selective Hardware Tracing},
author = {Yiyu Zhang and Tianyi Liu and Yueyang Wang and Yun Qi and Kai Ji and Jian Tang and Xiaoliang Wang and Xuandong Li and Zhiqiang Zuo},
journal = {Proceedings of the ACM on Programming Languages},
volume = {8},
number = {OOPSLA2},
year = {2024},
doi = {10.1145/3689768}
}