paperbot · PL 论文追踪

全部论文 待读 收藏

P1 Scaling static taint analysis to industrial SOA applications: a case study at Alibaba

将静态污点分析扩展到工业 SOA 应用：阿里巴巴案例研究
FSE Proceedings of the 28th ACM Joint Meeting on European Software Engineering Conference and Symposium on the Foundations of Software Engineering2020匹配度 5/10 · 该论文属于静态分析（污点分析）的工业落地案例，符合用户对工业应用、问题驱动和工具在真实场景中失效分析的偏好；但未涉及 LLM/Agent、浮点程序分析或贝叶斯程序分析，与用户核心研究方向的交叉有限。引用 22 inbox
Jie Wang, Yunguang Wu, Gang Zhou, Yiming Yu, Zhenyu Guo, Yingfei Xiong
程序分析与抽象解释安全与隐私
crossref: 2026-09-12

AI 速览

一句话：提出 ANTaint，通过按需污点传播与健全调用图，解决 Alibaba SOA 应用静态污点分析的扩展性与隐式依赖问题。

在阿里巴巴，数据泄漏检测、变更治理和数据一致性检查等场景需要对数据流进行追踪，静态污点分析是其中关键技术。然而，现有工具 FlowDroid 在工业 SOA 应用中表现不佳：应用大量使用库、native 方法和企业特定框架，带来可扩展性与隐式依赖两大挑战。本文提出 ANTaint：针对库代码扩展调用图，并按需传播污点，因为库占执行大部分但仅少部分传播污点；同时构建健全调用图并保证核心部分精度，采用更精确的污点传播模型。基于 60 个生产案例的评估显示，ANTaint 的精确率为 95%、召回率为 98%，而 FlowDroid 为 13%；ANTaint 耗时减少 65%，且在 32 GB 内存限制下无案例发生内存溢出。

问题
工业 SOA 应用中大量使用库、native 方法和企业框架，现有静态污点分析工具面临可扩展性差和隐式依赖难以处理的问题，FlowDroid 在实际场景中效果不佳。
方法
提出 ANTaint，通过扩展调用图并对库代码按需进行污点传播来提升可扩展性，同时构建健全且核心部分精确的调用图，并使用更精确的污点传播模型提升准确性。
评估
在阿里巴巴 60 个生产案例上与 FlowDroid 对比；ANTaint 精确率 95%、召回率 98%，FlowDroid 为 13%，耗时减少 65%，32 GB 限制下无内存溢出。
原文摘要（Abstract）

In Alibaba, we have seen a growing demand for tracing data flow for scenarios such as data leak detection, change governance, and data consistency checking. Static taint analysis is a technique for such problems, and many approaches are proposed for high scalability and precision. This paper shares our experience in applying taint analysis in Alibaba. In particular, we find that the state-of-the-art taint analysis tool, FlowDroid, does not work well in our cases because our applications make heavy use of libraries, native methods and enterprise-specific frameworks, which impose two major challenges, scalability and implicit dependency, to FlowDroid. This paper presents ANTaint to address these problems. ANTaint improves scalability by expanding the call graph and applying taint propagation on demand for libraries, which account for majority of the program execution but only a small fraction propagates taints. To improve accuracy, we ensure to build a sound call graph with its core part having certain accuracy, and providing a more precise taint propagation model. The practice of applying ANTaint in the company workload validates the idea. According to an experiment on 60 production cases, ANTaint is correct for 95% of the cases (precision: 95%, recall: 98%) while FlowDroid is 13%. ANTaint takes 65% less time and none of the cases run out of memory with 32 GB limitation.

链接与引用

DOI 原文 ·

BibTeX 
@inproceedings{paperbot5832,
  title = {Scaling static taint analysis to industrial SOA applications: a case study at Alibaba},
  author = {Jie Wang and Yunguang Wu and Gang Zhou and Yiming Yu and Zhenyu Guo and Yingfei Xiong},
  booktitle = {FSE},
  year = {2020},
  doi = {10.1145/3368089.3417059}
}