1. Dytan:A Generic
Dynamic Taint Analysis
Framework
James Clause,Wanchun (Paul) Li,
and Alessandro Orso
College of Computing
Georgia Institute of Technology
Partially supported by:
NSF awards CCF-0541080 and CCR-0205422 to Georgia Tech,
DHS and US Air Force Contract No. FA8750-05-2-0214

2. C
A
B Z
Dynamic taint analysis
(aka dynamic information-flow analysis)

3. C
A
B
312
Z
Dynamic taint analysis
(aka dynamic information-flow analysis)

4. C
A
B
312
Z
Dynamic taint analysis
(aka dynamic information-flow analysis)

5. C
A
B
312
Z
3
Dynamic taint analysis
(aka dynamic information-flow analysis)

6. Dynamic tainting applications
Information policy enforcement
Attack detection / prevention
Testing
Data lifetime / scope

7. Dynamic tainting applications
Information policy enforcement
Attack detection / prevention
Testing
Data lifetime / scope
Attack detection / prevention
Detect / prevent attacks such as SQL injection, buffer overruns,
stack smashing, cross site scripting
e.g., Suh et al. 04, Newsome and Song 05,
Halfond et al. 06, Kong et al. 06, Qin et al. 06

8. Dynamic tainting applications
Information policy enforcement
Attack detection / prevention
Testing
Data lifetime / scope
Information policy enforcement
ensure classified information does not leak outside the system
e.g.,Vachharajani et al. 04, McCamant and Ernst 06

9. Dynamic tainting applications
Information policy enforcement
Attack detection / prevention
Testing
Data lifetime / scope
Testing
Coverage metrics, test data generation heuristic, ...
e.g., Masri et al 05, Leek et al. 07

10. Dynamic tainting applications
Information policy enforcement
Attack detection / prevention
Testing
Data lifetime / scopeData lifetime / scope
track how long sensitive data, such as passwords or account
numbers, remain in the application
e.g., Chow et al. 04

11. Dynamic tainting applications
Information policy enforcement
Attack detection / prevention
Testing
Data lifetime / scope

12. Motivation
Ad-hoc taint analysis
implementation
Results
Ad-hoc taint analysis
implementation
Ad-hoc taint analysis
implementation
Results
Results

13. Motivation
Ad-hoc taint analysis
implementation
Results
Ad-hoc taint analysis
implementation
Ad-hoc taint analysis
implementation
Results
Results
Ad-hoc taint analysis
implementation
Results

14. Motivation
Ad-hoc taint analysis
implementation
Results
Ad-hoc taint analysis
implementation
Ad-hoc taint analysis
implementation
Results
Results
Ad-hoc taint analysis
implementation
Results

15. Motivation
Configuration
Dytan Generic
Framework
Custom Dynamic
Taint Analysis Results

16. Motivation
•Flexible
Configuration
Dytan Generic
Framework
Custom Dynamic
Taint Analysis Results

17. Motivation
•Flexible
•Easy to use
Configuration
Dytan Generic
Framework
Custom Dynamic
Taint Analysis Results

18. Motivation
•Flexible
•Easy to use
•Accurate
Configuration
Dytan Generic
Framework
Custom Dynamic
Taint Analysis Results

19. Outline
✓Motivation & overview
• Framework (Dytan)
• flexibility
• ease of use
• accuracy
• Empirical evaluation
• Conclusions

20. Framework: flexibility
Taint
sources
Propagation
policy
Taint
sinksConfiguration

21. Framework: flexibility
Taint
sources
Propagation
policy
Taint
sinks

22. Framework: flexibility
Taint
sources
Taint
sources
Propagation
policy
Taint
sinks
Which data to tag, and how to tag it

23. Framework: flexibility
Propagation
policy
Taint
sources
Propagation
policy
Taint
sinks
How tags should be propagated at runtime

24. Framework: flexibility
Taint
sinks
Taint
sources
Propagation
policy
Taint
sinks
Where and how tags should be checked

25. Framework: flexibility
Taint
sources
Propagation
policy
Taint
sinks

26. Taint sources
What to tag How to tag

27. Taint sources
What to tag How to tag
Identify what program data
should be assigned tags

28. Taint sources
What to tag How to tag
Identify what program data
should be assigned tags
• Variables (local or global)
• Function parameters
• Function return values
• Data from an input stream
network, filesystem,
keyboard, ...
• Specific input stream
141.195.121.134:80, a.txt,...

29. Taint sources
What to tag How to tag
Identify what program data
should be assigned tags
• Variables (local or global)
• Function parameters
• Function return values
• Data from an input stream
network, filesystem,
keyboard, ...
• Specific input stream
141.195.121.134:80, a.txt,...
Describe how tags should be
assigned for identified data

30. Taint sources
What to tag How to tag
Identify what program data
should be assigned tags
• Variables (local or global)
• Function parameters
• Function return values
• Data from an input stream
network, filesystem,
keyboard, ...
• Specific input stream
141.195.121.134:80, a.txt,...
Describe how tags should be
assigned for identified data
• Single tag
• One tag per source
• Multiple tags per source

31. Taint sources
What to tag How to tag
Identify what program data
should be assigned tags
• Variables (local or global)
• Function parameters
• Function return values
• Data from an input stream
network, filesystem,
keyboard, ...
• Specific input stream
141.195.121.134:80, a.txt,...
Describe how tags should be
assigned for identified data
• Single tag
• One tag per source
• Multiple tags per source
• ...

32. a.txt
Taint sources
What to tag: a.txt
How to tag: single tag

33. a.txt
Taint sources
What to tag: a.txt
How to tag: single tag

34. Taint sources
What to tag: a.txt
How to tag: single tag
a.txt

35. Taint sources
What to tag: a.txt
How to tag: single tag
a.txt
1 1 1 1 1 1

36. Taint sources
What to tag: a.txt
How to tag: single tag
a.txt

37. Taint sources
What to tag: a.txt
a.txt
How to tag: multiple tags

38. Taint sources
What to tag: a.txt
a.txt
2 31 4 5 n
How to tag: multiple tags

39. Propagation policy
3
B
A12
3
C

40. Affecting data Mapping function
Propagation policy
3
B
A12
3
C

41. Affecting data Mapping function
Data that affects the outcome of a
statement through
Propagation policy
3
B
A12
3
C

42. Affecting data Mapping function
Data that affects the outcome of a
statement through
• Data dependencies
Propagation policy
3
B
A12
3
C

43. Affecting data Mapping function
Data that affects the outcome of a
statement through
• Data dependencies
• Control dependencies
Propagation policy
3
B
A12
3
C

44. Affecting data Mapping function
Data that affects the outcome of a
statement through
• Data dependencies
• Control dependencies
A policy can consider both or only
data dependencies
Propagation policy
3
B
A12
3
C

45. Affecting data Mapping function
Data that affects the outcome of a
statement through
• Data dependencies
• Control dependencies
A policy can consider both or only
data dependencies
Define how tags associated with
affecting data should be combined
Propagation policy
3
B
A12
3
C

46. Affecting data Mapping function
Data that affects the outcome of a
statement through
• Data dependencies
• Control dependencies
A policy can consider both or only
data dependencies
Define how tags associated with
affecting data should be combined
• Union
Propagation policy
3
B
A12
3
C

47. Affecting data Mapping function
Data that affects the outcome of a
statement through
• Data dependencies
• Control dependencies
A policy can consider both or only
data dependencies
Define how tags associated with
affecting data should be combined
• Union
• Max
Propagation policy
3
B
A12
3
C

48. Affecting data Mapping function
Data that affects the outcome of a
statement through
• Data dependencies
• Control dependencies
A policy can consider both or only
data dependencies
Define how tags associated with
affecting data should be combined
• Union
• Max
• ...
Propagation policy
3
B
A12
3
C

49. if(X) {
C = A + B;
}
Propagation policy

50. 3
if(X) {
C = A + B;
}
1 2
Propagation policy

51. 3
if(X) {
C = A + B;
}
1 2
Propagation policy
Affecting data:
control dependence
Mapping function:
data dependence
union
max

52. 3
if(X) {
C = A + B;
}
1 2
Propagation policy
Affecting data:
control dependence
Mapping function:
data dependence✔
union
max

53. 3
if(X) {
C = A + B;
}
1 2
Propagation policy
Affecting data:
control dependence
Mapping function:
data dependence✔
union
max
✔

54. 3
if(X) {
C = A + B;
}
1 2
Propagation policy
Affecting data:
control dependence
Mapping function:
data dependence✔
union
max
✔

55. 3
if(X) {
C = A + B;
}
1 2
Propagation policy
Affecting data:
control dependence
Mapping function:
data dependence✔
union
max
✔
1 2

56. 3
if(X) {
C = A + B;
}
1 2
Propagation policy
Affecting data:
control dependence
Mapping function:
data dependence
union
max

57. 3
if(X) {
C = A + B;
}
1 2
Propagation policy
Affecting data:
control dependence
Mapping function:
data dependence
union
max
✔
✔

58. 3
if(X) {
C = A + B;
}
1 2
Propagation policy
Affecting data:
control dependence
Mapping function:
data dependence
union
max
✔
✔
✔

59. 3
if(X) {
C = A + B;
}
1 2
Propagation policy
Affecting data:
control dependence
Mapping function:
data dependence
union
max
✔
✔
✔

60. 3
if(X) {
C = A + B;
}
1 2
Propagation policy
Affecting data:
control dependence
Mapping function:
data dependence
union
max
✔
✔
✔
3

61. Where to check What to check
Taint Sinks
How to check

62. Where to check What to check
Location in the program to
perform a check
Taint Sinks
How to check

63. Where to check What to check
Location in the program to
perform a check
• Function entry / exit
• Statement type
• Specific program point
Taint Sinks
How to check

64. Where to check What to check
Location in the program to
perform a check
• Function entry / exit
• Statement type
• Specific program point
The data whose tags should
be checked
Taint Sinks
How to check

65. Where to check What to check
Location in the program to
perform a check
• Function entry / exit
• Statement type
• Specific program point
The data whose tags should
be checked
• Variables
• Function parameters
• Function return value
Taint Sinks
How to check

66. Where to check What to check
Location in the program to
perform a check
• Function entry / exit
• Statement type
• Specific program point
The data whose tags should
be checked
• Variables
• Function parameters
• Function return value
Taint Sinks
How to check
Set of conditions to check and a set of actions to perform if the
conditions are not met.

67. Where to check What to check
Location in the program to
perform a check
• Function entry / exit
• Statement type
• Specific program point
The data whose tags should
be checked
• Variables
• Function parameters
• Function return value
Taint Sinks
How to check
Set of conditions to check and a set of actions to perform if the
conditions are not met.
• validate presence of tags (exit or log)
• ensure absence of tags (exit or log)
• ...

68. Taint Sinks
cmd = read(file);
args = read(socket);
cmd = trim(cmd + args);
...
tok[] = parse(cmd);
exec(tok[0], tok[1]);

69. Taint Sinks
cmd = read(file);
args = read(socket);
cmd = trim(cmd + args);
...
tok[] = parse(cmd);
exec(tok[0], tok[1]);
2

70. Taint Sinks
cmd = read(file);
args = read(socket);
cmd = trim(cmd + args);
...
tok[] = parse(cmd);
exec(tok[0], tok[1]);
2
3

71. validate presence of:
validate absence of:
Taint Sinks
function: exec, param: 0
Where / what to check:
How to check:
Result:
cmd = read(file);
args = read(socket);
cmd = trim(cmd + args);
...
tok[] = parse(cmd);
exec(tok[0], tok[1]);
2
3
2
3

72. validate presence of:
validate absence of:
Taint Sinks
function: exec, param: 0
Where / what to check:
How to check:
Result:
cmd = read(file);
args = read(socket);
cmd = trim(cmd + args);
...
tok[] = parse(cmd);
exec(tok[0], tok[1]);
2
3
2
3
2 3

73. validate presence of:
validate absence of:
Taint Sinks
function: exec, param: 0
Where / what to check:
How to check:
Result:
cmd = read(file);
args = read(socket);
cmd = trim(cmd + args);
...
tok[] = parse(cmd);
exec(tok[0], tok[1]);
✘
2
3
2
3
2 3

74. Framework: ease of use
Provide two ways to configure the framework

75. Framework: ease of use
• Basic
• Select sources, propagation policies, and sinks
from a set of predefined options
• XML based configuration
Provide two ways to configure the framework

76. Framework: ease of use
• Basic
• Select sources, propagation policies, and sinks
from a set of predefined options
• XML based configuration
• Advanced
• Suitable for more esoteric applications
• Extend OO implementation
Provide two ways to configure the framework

77. Framework: accuracy
• Dytan operates at the binary level
• consider the actual program semantics
• transparently handle libraries
• Dytan accounts for both data- and control-
flow dependencies

78. Framework: accuracy
The most common source of inaccuracy is
incorrectly identifying the information
produced and consumed by a statement

79. Two common examples:
Framework: accuracy
The most common source of inaccuracy is
incorrectly identifying the information
produced and consumed by a statement

80. Two common examples:
• Implicit operands
add %eax, %ebx // A = A + B
Framework: accuracy
The most common source of inaccuracy is
incorrectly identifying the information
produced and consumed by a statement

81. Two common examples:
• Implicit operands
add %eax, %ebx // A = A + B
produced: %eax
Framework: accuracy
The most common source of inaccuracy is
incorrectly identifying the information
produced and consumed by a statement

82. Two common examples:
• Implicit operands
add %eax, %ebx // A = A + B
produced: %eax, %eflags
Framework: accuracy
The most common source of inaccuracy is
incorrectly identifying the information
produced and consumed by a statement

83. • Address Generators
add %eax, %ebx // A = A + B
Two common examples:
• Implicit operands
add %eax, %ebx // A = A + B
produced: %eax, %eflags
Framework: accuracy
The most common source of inaccuracy is
incorrectly identifying the information
produced and consumed by a statement

84. • Address Generators
add %eax, %ebx // A = A + B
Two common examples:
• Implicit operands
add %eax, %ebx // A = A + B
produced: %eax, %eflags
Framework: accuracy
The most common source of inaccuracy is
incorrectly identifying the information
produced and consumed by a statement
[ ] *

85. • Address Generators
add %eax, %ebx // A = A + B
consumed: %eax, [%ebx]
Two common examples:
• Implicit operands
add %eax, %ebx // A = A + B
produced: %eax, %eflags
Framework: accuracy
The most common source of inaccuracy is
incorrectly identifying the information
produced and consumed by a statement
[ ] *

86. • Address Generators
add %eax, %ebx // A = A + B
consumed: %eax, [%ebx], %ebx
Two common examples:
• Implicit operands
add %eax, %ebx // A = A + B
produced: %eax, %eflags
Framework: accuracy
The most common source of inaccuracy is
incorrectly identifying the information
produced and consumed by a statement
[ ] *

87. Outline
✓Motivation & overview
✓Framework
✓flexibility
✓ease of use
✓accuracy
• Empirical evaluation
• Conclusions

88. Empirical evaluation
• RQ1: Can Dytan be used to (easily) implement
existing dynamic taint analyses?
• RQ2: How do inaccurate propagation policies
affect the analysis results?
• In addition: discussion on performance

89. RQ1: flexibility
• Selected two techniques:
• Overwrite attack detection [Qin et al. 04]
• SQL injection detection [Halfond et al. 06]
• Used Dytan to re-implement both techniques
• Measure implementation time
• Validate against the original implementation
Goal: show that Dytan can be used to (easily)
implement existing dynamic taint analyses

90. RQ1: results
• Implementation time:
• Overwrite attack detection: < 1 hour
• SQL injection detection: < 1 day
• Comparison with original implementations:
• Successfully stopped same attacks as the
original implementations

91. RQ2: accuracy impact
Goal: measure the effect of inaccurate propagation
policies on analysis results

92. RQ2: accuracy impact
• Selected two subjects:
• Gzip (75kb w/o libraries)
• Firefox (850kb w/o libraries)
Goal: measure the effect of inaccurate propagation
policies on analysis results

93. RQ2: accuracy impact
• Selected two subjects:
• Gzip (75kb w/o libraries)
• Firefox (850kb w/o libraries)
• Use Dytan to taint program inputs and measure the
amount of heap data tainted at program exit
Goal: measure the effect of inaccurate propagation
policies on analysis results

94. RQ2: accuracy impact
• Selected two subjects:
• Gzip (75kb w/o libraries)
• Firefox (850kb w/o libraries)
• Use Dytan to taint program inputs and measure the
amount of heap data tainted at program exit
• Compare Dytan against inaccurate policies
• no implicit operands (no IM)
• no address generators (no AG)
• no implicit operands, no address generators (no
IM, no AG)
Goal: measure the effect of inaccurate propagation
policies on analysis results

95. RQ2: results
0%
25%
50%
75%
100%
Firefox (1 page) Firefox (3 pages) Gzip
Dytan No IM No AG No IM, no IG

96. Performance
• Measured for gzip:
≈30x for data flow
≈50x for data and control flow
• High overhead, but...

97. Performance
• In line with existing implementations
• Measured for gzip:
≈30x for data flow
≈50x for data and control flow
• High overhead, but...

98. Performance
• In line with existing implementations
• Designed for experimentation
• Favors flexibility over performance
• Measured for gzip:
≈30x for data flow
≈50x for data and control flow
• High overhead, but...

99. Performance
• In line with existing implementations
• Designed for experimentation
• Favors flexibility over performance
• Implementation can be further optimized
• Measured for gzip:
≈30x for data flow
≈50x for data and control flow
• High overhead, but...

100. Related work
• Existing dynamic tainting approaches
[Suh et al. 04, Newsome and Song 05, Halfond et al. 06, Kong et al. 06, ...]
• Ad-hoc
• Other dynamic taint analysis frameworks
[Xu et al. 06 and Lam and Chiueh 06]
• Focused on security applications
• Single taint mark
• No control-flow propagation
• Operate at the source code level

101. Conclusions
• Dytan
• a general framework for dynamic tainting
• allows for instantiating and experimenting with
different dynamic taint analysis approaches
• Initial evaluation
• flexible
• easy to use
• accurate

102. Future directions
• Tool release (documentation, code cleanup)
http://www.cc.gatech.edu/~clause/dytan/
(pre-release on request)
• Optimization (general and specific)
• Applications
• Memory protection
• Debugging

103. Questions?
http://www.cc.gatech.edu/~clause/dytan/