一句话：提出 DistTaint，一种兼顾适用性、可移植性与可扩展性的分布式系统动态污点分析。
针对分布式系统隐私保护与敏感数据泄露检测需求，现有污点分析面临适用性、可移植性与可扩展性挑战。本文提出 DistTaint 动态污点分析。它从执行中偏序方法事件推断隐式依赖以提升适用性；完全在应用层工作，无需定制平台，从而具备可移植性；采用多阶段分析并引入预分析缩小后续细粒度分析范围，以显著降低整体开销。实证结果表明，DistTaint 对工业规模分布式程序具有实用性、可移植性与可扩展性，并能在真实分布式系统中发现安全漏洞。
To protect the privacy and search sensitive data leaks, we must solve multiple challenges (e.g., applicability, portability, and scalability) for developing an appropriate taint analysis for distributed systems.We hence present DistTaint, a dynamic taint analysis for distributed systems against these challenges. It could infer implicit dependencies from partial-ordering method events in executions to resolve the applicability challenge. DistTaint fully works at application-level without any customization of platforms to overcome the portability challenge. It exploits a multi-phase analysis to achieve scalability. By proposing a pre-analysis, DistTaint narrows down the following fine-grained analysis’ scope to reduce the overall cost significantly. Empirical results showed DistTaint’s practical applicability, portability, and scalability to industry-scale distributed programs, and its capability of discovering security vulnerabilities in real-world distributed systems. The tool package can be downloaded here: https://www.dropbox.com/sh/kfr9ixucyny1jp2/AAC00aI-I8O-d4ywZCqwZ1uaa?dl=0
DOI 原文 ·
@inproceedings{paperbot5030,
title = {On the scalable dynamic taint analysis for distributed systems},
author = {Xiaoqin Fu},
booktitle = {FSE},
year = {2019},
doi = {10.1145/3338906.3342506}
}