LDX
Abstract
Causality inference, such as dynamic taint anslysis, has many applications (e.g., information leak detection). It determines whether an event e is causally dependent on a preceding event c during execution. We develop a new causality inference engine LDX. Given an execution, it spawns a slave execution, in which it mutates c and observes whether any change is induced at e. To preclude non-determinism, LDX couples the executions by sharing syscall outcomes. To handle path differences induced by the perturbation, we develop a novel on-the-fly execution alignment scheme that maintains a counter to reflect the progress of execution. The scheme relies on program analysis and compiler transformation. LDX can effectively detect information leak and security attacks with an average overhead of 6.08% while running the master and the slave concurrently on separate CPUs, much lower than existing systems that require instruction level monitoring. Furthermore, it has much better accuracy in causality inference.
Document Details
- Document Type
- Pub Defense Publication
- Publication Date
- Mar 25, 2016
- Source ID
- 10.1145/2980024.2872395
Entities
People
- Brendan Saltaformaggio
- Dohyeong Kim
- Dongyan Xu
- Kyungtae Kim
- William Nick Sumner
- Xiangyu Zhang
- Yonghwi Kwon
Organizations
- Defense Advanced Research Projects Agency
- National Science Foundation
- Office of Naval Research
- Purdue University
- Simon Fraser University