Previous [ 1] [ 2] [ 3] [ 4] [ 5] [ 6] [ 7] [ 8] [ 9] [ 10] [ 11] [ 12] [ 13] [ 14] [ 15] [ 16] [ 17] [ 18]

@

Journal of Information Science and Engineering, Vol. 31 No. 4, pp. 1413-1429 (July 2015)


SWIFT: Decoupled System-Wide Information Flow Tracking and its Optimizations


CHIWEI WANG AND SHIUHPYNG WINSTON SHIEH
Taiwan Information Security Center
National Chiao Tung University
Hsinchu, 300 Taiwan
E-mail: cwwangabc@gmail.com; ssp@cs.nctu.edu.tw

Information flow analysis is a widely-adopted technique in software testing and malware analysis. For information flow analysis, a system-level emulator equipped with dynamic information flow tracking capability, DIFT, is needed. However, its effectiveness comes at a price of severe performance degradation due to interleaved system emulation and DIFT analysis. In this paper, a decoupled system-wide information flow tracking scheme, SWIFT, is proposed. Through decoupling system-wide information flow tracking from emulation, SWIFT regains the memory locality and code optimization. The proposed methods are able to aggressively eliminate dependency between the systemlevel emulator and the analysis thread. Our performance evaluation indicates that, under the same hardware specifications, SWIFT runs 2.74~7.48 times faster than the conventional interleaved design while being benchmarked by PassMark Performance Test 6.0. The performance improvement consequently makes the online analysis feasible in practice.

Keywords: binary translation, emulator optimization, information flow tracking

Full Text () Retrieve PDF document (201507_15.pdf)

Received December 27, 2013; revised March 1, 2014; accepted March 16, 2014.
Communicated by Hahn-Ming Lee.