Dynamic Taint Analysis for Automatic Detection, Analysis, and SignatureGeneration of Exploits on Commodity Software

By James Newsome, Dawn Song. Network and Distributed System Security Symposium, 2005

1,371 citations recorded by the source corpus.

View Paper: https://www.semanticscholar.org/paper/5803709632cf010d3923e8f85416bb95db0dd8ea

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

Citations in the corpus

All You Ever Wanted to Know about Dynamic Taint Analysis and Forward Symbolic Execution (but Might Have Been Afraid to Ask) (2010, background): “Current taint-based attack detectors [7, 20, 49, 63] typically exhibit time of detection to time of attack gaps.”
Paranoid Android: versatile protection for smartphones (2010, methodology): “We modified the Android emulator to apply dynamic taint analysis (DTA) on the replica [10, 27].”
ROPecker: A Generic and Practical Approach For Defending Against ROP Attacks (2014, methodology): “For instance, the preliminary performance measurements for DROP range from 1.9X to 21X, and the performance overhead for TaintCheck is over 20X.”
Hamsa: fast signature generation for zero-day polymorphic worms with provable attack resilience (2006, background): “TaintCheck [17] and DACODA [5] dynamically traces and correlates the network input to control flow change to find the malicious input and infer the properties of worms.”
Fuzzing: A Survey for Roadmap (2022, methodology): “Fuzzers [37, 38, 67, 157, 160, 187] utilize 230:15 DTA to build relationships between input bytes and security-sensitive points (e.g., system/library calls or conditional jumps).”
When good instructions go bad: generalizing return-oriented programming to RISC (2008, background): “For example, dynamic taint checking system s can prevent the transfer of control through stack cells compute d from an input [15].”
Limits of Learning-based Signature Generation with Adversaries (2008, background): “It holds even if host-monitoring techniques like taint analysis [9,11,27,30] are used to identify exact ly which packets are malicious and which are not.”
N-Variant Systems: A Secretless Framework for Security through Diversity (2006, background): “For example, no execute pages (as provided by OpenBSD’s W^X and Windows XP Service Pack 2) prevent many code injection attacks [2], dynamic taint analysis tracks information flow to identify memory corruption attacks [43], and control-flow integrity can detect attacks that corrupt an application to ”
SLEUTH: Real-time Attack Scenario Reconstruction from COTS Audit Data (2018, background): “, fine-grained taint tags [42, 58], if they are available.”
Jalangi: a selective record-replay and dynamic analysis framework for JavaScript (2013, methodology): “• Dynamic taint analysis [21, 9]: a dynamic taint analysis is a form of information flow analysis which checks if information can flow from a specific set of memory locations, called sources, to another set of memory locations, called sinks.”
Return-Oriented Programming: Systems, Languages, and Applications (2012, methodology): “For example, dynamic taint checking systems can prevent the transfer of control through stack cells computed from an input [Newsome and Song 2005].”
Taint-based directed whitebox fuzzing (2009, methodology): “The idea is to use the taint information to detect situations in which the program uses input data in a potentially dangerous way (such as the target of a branch instruction) [13, 19, 20].”
Just-In-Time Code Reuse: On the Effectiveness of Fine-Grained Address Space Layout Randomization (2013, unknown): “For instance, dynamic binary instrumentation-based tools used for taint analysis [42] or for the sake of preventing code reuse attacks [13, 17, 30] can impose slow downs of more than 2x.”
Argos: an emulator for fingerprinting zero-day attacks for advertised honeypots with automatic signature generation (2006, methodology): “Like Argos both employ taint analysis to discover illegitimate use of ‘foreign’ data [31].”
Panorama: capturing system-wide information flow for malware detection and analysis (2007, background): “Many systems [26, 13, 28, 12, 35] detect exploits by tracking the data from untrusted sources such as the network being misused to alter the control flow.”
Baggy Bounds Checking: An Efficient and Backwards-Compatible Defense against Out-of-Bounds Errors (2009, background): “Techniques such as control-ﬂow integrity [20, 1] or taint tracking (e.g. [10, 26, 11, 35]) detect broad classes of errors, but they do not provide general protection from spatial memory errors.”
ILR: Where'd My Gadgets Go? (2012, methodology): “TaintCheck uses dynamic taint analysis and provides a comprehensive approach to thwarting ROP attacks by detecting attempts at control-flow hijacking, though it suffers from high overhead (over 20X).”