Please enable JavaScript.

Coggle requires JavaScript to display documents.

2010 - All You Ever Wanted to Know About Dynamic Taint Analysis and…

- - - - Taint Propagation
        
        Specify the taint status for data derived from tainted or untainted operands
      - Taint Checking
        
        Taint status values are often used to determine the runtime behavior of a program, e.g., an attack detector may halt execution if a jump target address is tainted.
      - Taint Introduction
        
        Specify how taint is introduced into a system.
        
        Typically distinguish between different input sources
    - - Undertainting
        
        Dynamic taint analysis does not properly handle some types of information flow and misses some data flow that should be tainted.
        
        Solution
      - Overtainting
        
        False positive in tainting
        
        Solution
        
        Sanitation
        
        A significant challenge in taint analysis is to identify when
        taint can be removed from a value
      - Time of Detection vs. Time of Attack
        
        When used for attack detection, dynamic taint analysis may raise an alert too late
      - Tainted Addresses
        
        Memory operations involve two values: the address of the memory cell being referenced, and the value stored in that cell.
        
        Solution
  - - - Multiple inputs
        
        It can be used to reason about more than one
        input at once, inputs that take the true branch, and those
        that take the false branch
  - - - Automatic Input Filter Generation
        
        Forward symbolic execution can be used to automatically generate input filters that detect and remove exploits from the input stream
      - Malware Analysis
        
        Analyze how information flows through a malware binary , explore trigger-based behavior, and detect emulators.
      - Unknown Vulnerability Detection
        
        Dynamic taint analysis can look for misuses of user input during an execution
      - Test Case Generation
        
        Automatically generate inputs to test programs