JISE


  [1] [2] [3] [4] [5] [6] [7] [8] [9] [10] [11] [12] [13] [14] [15] [16] [17] [18]


Journal of Information Science and Engineering, Vol. 31 No. 4, pp. 1413-1429


 

SWIFT: Decoupled System-Wide Information Flow Tracking and its Optimizations


CHIWEI WANG AND SHIUHPYNG WINSTON SHIEH 
Taiwan Information Security Center 
National Chiao Tung University 
Hsinchu, 300 Taiwan 
E-mail: cwwangabc@gmail.com; ssp@cs.nctu.edu.tw


    Information flow analysis is a widely-adopted technique in software testing and malware analysis. For information flow analysis, a system-level emulator equipped with dynamic information flow tracking capability, DIFT, is needed. However, its effectiveness comes at a price of severe performance degradation due to interleaved system emulation and DIFT analysis. In this paper, a decoupled system-wide information flow tracking scheme, SWIFT, is proposed. Through decoupling system-wide information flow tracking from emulation, SWIFT regains the memory locality and code optimization. The proposed methods are able to aggressively eliminate dependency between the systemlevel emulator and the analysis thread. Our performance evaluation indicates that, under the same hardware specifications, SWIFT runs 2.74~7.48 times faster than the conventional interleaved design while being benchmarked by PassMark Performance Test 6.0. The performance improvement consequently makes the online analysis feasible in practice.


Keywords: binary translation, emulator optimization, information flow tracking

  Retrieve PDF document (JISE_201504_15.pdf)