LIFT: A Low-Overhead Practical Information Flow Tracking System for Detecting Security Attacks

• Main Authors: Qin, Feng, Wang, Cheng, Li, Zhenmin, Kim, Ho-seop, Zhou, Yuanyuan, Wu, Youfeng
• Format: Conference Proceeding
• Language: English
• Subjects: Application software; Computer crime; Computer security; Computer systems organization > Embedded and cyber-physical systems > Embedded systems; Hardware; Information security; Instruments; Runtime; Security and privacy > Systems security > Information flow control; Security and privacy > Systems security > Operating systems security; Software and its engineering > Software organization and properties > Software system structures > Embedded software; Software and its engineering > Software organization and properties > Software system structures > Real-time systems software; Software tools; Switches; Target tracking
• ISSN: 1072-4451
• DOI: 10.1109/MICRO.2006.29

Computer security is severely threatened by software vulnerabilities. Prior work shows that information flow tracking (also referred to as taint analysis) is a promising technique to detect a wide range of security attacks. However, current information flow tracking systems are not very practical, because they either require program annotations, source code, non-trivial hardware extensions, or incur prohibitive runtime overheads. This paper proposes a low overhead, software-only information flow tracking system, called LIFT, which minimizes run-time overhead by exploiting dynamic binary instrumentation and optimizations for detecting various types of security attacks without requiring any hardware changes. More specifically, LIFT aggressively eliminates unnecessary dynamic information flow tracking, coalesces information checks, and efficiently switches between target programs and instrumented information flow tracking code. We have implemented LIFT on a dynamic binary instrumentation framework on Windows. Our real-system experiments with two real-world server applications, one client application and eighteen attack benchmarks show that LIFT can effectively detect various types of security attacks. LIFT also incurs very low overhead, only 6.2% for server applications, and 3.6 times on average for seven SPEC INT2000 applications. Our dynamic optimizations are very effective in reducing the overhead by a factor of 5-12 times.