Home   >   CSC-OpenAccess Library   >    Manuscript Information
Dynamic Taint Analysis Tools: A Review
Abdullah Mujawib Alashjaee, Salahaldeen Duraibi , Jia Song
Pages - 231 - 243     |    Revised - 30-11-2019     |    Published - 31-12-2019
Volume - 13   Issue - 6    |    Publication Date - December 2019  Table of Contents
Taint Analysis, Static Analysis, Dynamic Analysis.
Taint analysis is the trending approach of analysing software for security purposes. By using the taint analysis technique, tainted tags are added to the data entering from the sensitive sources into the applications, then the propagations of the tainted data are monitored carefully. Taint analysis can be done in two ways including static taint analysis where analysis is conducted without executing the program, and dynamic taint analysis where the tainted data is monitored during the program execution. This paper reviews the taint analysis technique, with a focus on dynamic taint analysis. In addition, some of the existing taint analysis tools and their application areas are reviewed. In the end, the paper summarises the defects associated with each of the tools and presents some of them.
1 refSeek 
2 BibSonomy 
3 Scribd 
4 SlideShare 
A Dinaburg, P Royal, M Sharif, W Lee "Ether: malware analysis via hardware virtualization extensions." in Proceedings of the 15th ACM conference on Computer and communications security. 2008. ACM.
A Kurniawan, BS Abbas, A Trisetyarso STA Traversal with Object Oriented Component for Web File Injection Vulnerability Pattern Detection. Procedia Computer Science, 2018. 135: p. 596-605.
A. Getman, V. Padaryan, and M. Solovyev. "Combined approach to solving problems in binary code analysis". in Proceedings of 9th International Conference on Computer Science and Information Technologies (CSIT'2013). 2013.
A.N. Moussa, N. Ithnin, and A. Zainal, "CFaaS: bilaterally agreed evidence collection." Journal of Cloud Computing, 2018. 7(1): p. 1.
A.R. Yumerefendi,, B. Mickle, and L.P. Cox. TightLip: Keeping Applications from Spilling the Beans. in NSDI. 2007.
C Chen, B Cui, J Ma, R Wu, J Guo, W Liu. "A systematic review of fuzzing techniques." Computers & Security, 2018. 75: p. 118-137.
C. Cadar, D. Dunbar, and D.R. Engler. "KLEE: Unassisted and Automatic Generation of High-Coverage Tests for Complex Systems Programs." in OSDI. 2008.
C. Feng, and X. Zhang. A Static Taint Detection Method for Stack Overflow Vulnerabilities in Binaries. in 2017 4th International Conference on Information Science and Control Engineering (ICISCE). 2017. IEEE.
CK Luk, R Cohn, R Muth, H Patil, A Klauser. "Pin: building customized program analysis tools with dynamic instrumentation." in Acm sigplan notices. 2005. ACM.
D Song, D Brumley, H Yin, J Caballero, I Jager "BitBlaze: A new approach to computer security via binary analysis." in International Conference on Information Systems Security. 2008. Springer.
D Zou, J Zhao, W Li, Y Wu, W Qiang., "A Multigranularity Forensics and Analysis Method on Privacy Leakage in Cloud Environment." IEEE Internet of Things Journal, 2018. 6(2): p. 1484-1494.
D. Boxler, and K.R. Walcott. STA Tools to Detect Information Flows. in Proceedings of the International Conference on Software Engineering Research and Practice (SERP). 2018. The Steering Committee of The World Congress in Computer Science, Computer.
D. Bruening, E. Duesterwald, and S. Amarasinghe. Design and implementation of a dynamic optimization framework for Windows. in 4th ACM Workshop on Feedback-Directed and Dynamic Optimization (FDDO-4). 2001.
DY Zhu, J Jung, D Song, T Kohno, TaintEraser: Protecting sensitive data leaks using application-level taint tracking. ACM SIGOPS Operating Systems Review, 2011. 45(1): p. 142-154.
E Zhu, X Li, F Liu, X Li, Z Ma. "Constructing a hybrid taint analysis framework for diagnosing attacks on binary programs." Journal of Computers, 2014. 9(3): p. 566-575.
F Qin, C Wang, Z Li, H Kim, Y Zhou "Lift: A low-overhead practical information flow tracking system for detecting security attacks." in 2006 39th Annual IEEE/ACM International Symposium on Microarchitecture (MICRO'06). 2006. IEEE.
F. Pauck, and H. Wehrheim. Together strong: cooperative Android app analysis. in Proceedings of the 2019 27th ACM Joint Meeting on European Software Engineering Conference and Symposium on the Foundations of Software Engineering. 2019. ACM.
Funnywei, "Bufer Overfow Vulnerability Mining Model [Z/OL]," 2003, http://xcon.xfocus.net/XCon2003/archives/ Xcon2003 funnywei.pdf.
G Venkataramani, I Doudalis, Y Solihin. "Flexitaint: A programmable accelerator for dynamic taint propagation." in 2008 IEEE 14th International Symposium on High Performance Computer Architecture. 2008. IEEE.
G Xiao, J Wang, P Liu, J Ming, D Wu "Program-object level data flow analysis with applications to data leakage and contamination forensics." in Proceedings of the Sixth ACM Conference on Data and Application Security and Privacy. 2016. ACM.
G. Portokalidis, A. Slowinska, and H. Bos."Argos: an emulator for fingerprinting zero-day attacks for advertised honeypots with automatic signature generation." in ACM SIGOPS Operating Systems Review. 2006. ACM.
GE Suh, JW Lee, D Zhang, S Devadas. "Secure program execution via dynamic information flow tracking." in ACM Sigplan Notices. 2004. ACM.
H Yin, D Song, M Egele, C Kruegel "Panorama: capturing system-wide information flow for malware detection and analysis." in Proceedings of the 14th ACM conference on Computer and communications security. 2007. ACM.
H. Yin, and D. Song, "Whole-system Fine-grained Taint Analysis for Automatic Malware Detection and Analysis." Technical paper. College of William and Mary & Carnegie Mellon University, 2006.
I. Papagiannis, and P. Pietzuch. "Cloudfilter: practical control of sensitive data propagation to the cloud." in Proceedings of the 2012 ACM Workshop on Cloud computing security workshop. 2012. ACM.
J Cai, P Zou, J Ma, J He. "Sworddta: A dynamic taint analysis tool for software vulnerability detection." Wuhan University Journal of Natural Sciences, 2016. 21(1): p. 10-20.
J Jung, A Sheth, B Greenstein, D Wetherall "Privacy oracle: a system for finding application leaks with black box differential testing." in Proceedings of the 15th ACM conference on Computer and communications security. 2008. ACM.
J Shin, H Zhang, J Lee, I Heo, YY "Chen A hardware-based technique for efficient implicit information flow tracking." in 2016 IEEE/ACM International Conference on Computer-Aided Design (ICCAD). 2016. IEEE.
J Yuan, W Qiang, H Jin, D Zou. "CloudTaint: an elastic taint tracking framework for malware detection in the cloud." The Journal of Supercomputing, 2014. 70(3): p. 1433-1450.
J. Clause, W. Li, and A. Orso. "Dytan: a generic dynamic taint analysis framework." in Proceedings of the 2007 international symposium on Software testing and analysis. 2007. ACM.
J. Kim, T. Kim, and E.G. Im. "Survey of dynamic taint analysis." in 2014 4th IEEE International Conference on Network Infrastructure and Digital Content. 2014. IEEE.
J. Newsome, and D.X. Song. Dynamic Taint Analysis for Automatic Detection, Analysis, and SignatureGeneration of Exploits on Commodity Software. in NDSS. 2005. Citeseer.
K. Liu, H.B.K. Tan, and X. Chen, "Binary code analysis. Computer," 2013. 46(8): p. 60-68.
L Li, TF Bissyande, M Papadakis, S Rasthofer. "Static analysis of android apps: A systematic literature review." Information and Software Technology, 2017. 88: p. 67-95.
L.K. Yan, and H. Yin, "SoK: On the Soundness and Precision of Dynamic Taint Analysis."
M Ahmad, V Costamagna, B Crispo "TeICC: targeted execution of inter-component communications in Android." in Proceedings of the Symposium on Applied Computing. 2017. ACM.
M Costa, J Crowcroft, M Castro, A Rowstron Vigilante: End-to-end containment of internet worms. in ACM SIGOPS Operating Systems Review. 2005. ACM.
M Egele, C Kruegel, E Kirda, H Yin, D Song. "Dynamic spyware analysis." 2007.
M Nunes, P Burnap, O Rana, P Reinecke, "Getting to the root of the problem: A detailed comparison of kernel and user level data for dynamic malware analysis" Journal of Information Security and Applications, 2019. 48: p. 102365.
M Polino, A Continella, S Mariani, S D'Alessio Measuring and defeating anti-instrumentation-equipped malware. in International Conference on Detection of Intrusions and Malware, and Vulnerability Assessment. 2017. Springer.
M Sridharan, S Artzi, M Pistoia, S Guarnieri F4F: taint analysis of framework-based web applications. in ACM SIGPLAN Notices. 2011. ACM.
M Vassena, A Russo, D Garg, V Rajani, "From fine-to coarse-grained dynamic information flow control and back." Proceedings of the ACM on Programming Languages, 2019. 3(POPL): p. 76.
M. Monga, R. Paleari, and E. Passerini. "A hybrid analysis framework for detecting web application vulnerabilities." in Proceedings of the 2009 ICSE Workshop on Software Engineering for Secure Systems. 2009. IEEE Computer Society.
M. Shudrak, and V. Zolotarev. "The technique of dynamic binary analysis and its application in the information security sphere." in Eurocon 2013. 2013. IEEE.
M. von Maltitz, C. Diekmann, and G. Carle. Privacy Assessment Using STA (Tool Paper). in International Conference on Formal Techniques for Distributed Objects, Components, and Systems. 2017. Springer.
M.L. Minsky, Computation. 1967: Prentice-Hall Englewood Cliffs.
MG Kang, S McCamant, P Poosankam, D Song Dta++: dynamic taint analysis with targeted control-flow propagation. in NDSS. 2011.
N. Rosenblum, X. Zhu, and B.P. Miller. Who wrote this code? identifying the authors of program binaries. in European Symposium on Research in Computer Security. 2011. Springer.
N. Sapountzis, R. Sun, and D. Oliveira. "DDIFT: Decentralized Dynamic Information Flow Tracking for IoT Privacy and Security." in Workshop on Decentralized IoT Systems and Security (DISS). 2018.
O Tripp, M Pistoia, P Cousot, R Cousot Andromeda: Accurate and scalable security analysis of web applications. in International Conference on Fundamental Approaches to Software Engineering. 2013. Springer.
O Tripp, M Pistoia, SJ Fink, M Sridharan, TAJ: effective taint analysis of web applications. ACM Sigplan Notices, 2009. 44(6): p. 87-97.
P. Dai, Z. Pan, and Y. Li. "A Review of Researching on Dynamic Taint Analysis Technique." in 2018 3rd Joint International Information Technology, Mechanical and Electronic Engineering Conference (JIMEC 2018). 2018. Atlantis Press.
R Baldoni, E Coppa, DC D'elia, C Demetrescu. "A survey of symbolic execution techniques." ACM Computing Surveys (CSUR), 2018. 51 (3): p. 50.
R Wang, G Xu, X Zeng, X Li, Z Feng TT-XSS: A novel taint tracking based dynamic detection framework for DOM Cross-Site Scripting. Journal of Parallel and Distributed Computing, 2018. 118: p. 100-106.
S Arzt, S Rasthofer, C Fritz, E Bodden, A Bartel "Flowdroid: Precise context, flow, field, object-sensitive and lifecycle-aware taint analysis for android apps." in Acm Sigplan Notices. 2014. ACM.
S Chen, J Xu, N Nakka, Z Kalbarczyk. "Defeating memory corruption attacks via pointer taintedness detection." in 2005 International Conference on Dependable Systems and Networks (DSN'05). 2005. IEEE.
S Guarnieri, M Pistoia, O Tripp, J Dolby Saving the world wide web from vulnerable JavaScript. in Proceedings of the 2011 International Symposium on Software Testing and Analysis. 2011. ACM.
TR Leek, GZ Baker, RE Brown, MA Zhivich, "Coverage maximization using dynamic taint tracing." 2007, MASSACHUSETTS INST OF TECH LEXINGTON LINCOLN LAB.
V Pappas, VP Kemerlis, A Zavou CloudFence: Data flow tracking as a cloud service. in International Workshop on Recent Advances in Intrusion Detection. 2013. Springer.
V. Ganesh, T. Leek, and M. Rinard. "Taint-based directed whitebox fuzzing." in Proceedings of the 31st International Conference on Software Engineering. 2009. IEEE Computer Society.
VP Kemerlis, G Portokalidis, K Jee, AD Keromytis. "libdft: Practical dynamic data flow tracking for commodity systems." in Acm Sigplan Notices. 2012. ACM.
W Enck, P Gilbert, S Han, V Tendulkar TaintDroid: an information-flow tracking system for realtime privacy monitoring on smartphones. ACM Transactions on Computer Systems (TOCS), 2014. 32(2): p. 5.
W. Aman, "A framework for analysis and comparison of dynamic malware analysis tools." arXiv preprint arXiv:1410.2131, 2014.
W. Xu, S. Bhatkar, and R. Sekar. "Taint-Enhanced Policy Enforcement: A Practical Approach to Defeat a Wide Range of Attacks." in USENIX Security Symposium. 2006.
X Lin, T Chen, T Zhu, K Yang, F Wei "Automated forensic analysis of mobile applications on Android devices." Digital Investigation, 2018. 26: p. S59-S66.
X Wang, H Ma, K Yang, H Liang "An Uneven Distributed System for Dynamic Taint Analysis Framework." in 2015 IEEE 2nd International Conference on Cyber Security and Cloud Computing. 2015. IEEE.
X Wang, R Ma, B Dou, Z Jian, H Chen, "OFFDTAN: A New Approach of Offline Dynamic Taint Analysis for Binaries." Security and Communication Networks, 2018. 2018.
X. Fu, "On the scalable dynamic taint analysis for distributed systems." in Proceedings of the 2019 27th ACM Joint Meeting on European Software Engineering Conference and Symposium on the Foundations of Software Engineering. 2019. ACM.
X. Fu, and H. Cai." A dynamic taint analyzer for distributed systems." in Proceedings of the 2019 27th ACM Joint Meeting on European Software Engineering Conference and Symposium on the Foundations of Software Engineering. 2019. ACM.
X. Meng, and B.P. Miller. "Binary code is not easy." in Proceedings of the 25th International Symposium on Software Testing and Analysis. 2016. ACM.
Y Ji, S Lee, E Downing, W Wang, M Fazzini "Rain: Refinable attack investigation with on-demand inter-process information flow tracking." in Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security. 2017. ACM.
Y Zhu, J Jung, D Song, T Kohno, D Wetherall, Privacy scope: A precise information flow tracking system for finding application leaks. 2009, Citeseer.
Z Feng, Z Wang, W Dong. "Bintaint: A STA Method for Binary Vulnerability Mining." in 2018 International Conference on Cloud Computing, Big Data and Blockchain (ICCBB). 2018. IEEE.
Z Xing, Z Bin, F Chao, Z Quan "Staticly Detect Stack Overflow Vulnerabilities with Taint Analysis." in ITM Web of Conferences. 2016. EDP Sciences.
ZB Celik, L Babun, AK Sikder, H Aksu, G Tan "Sensitive information tracking in commodity IoT." in 27th {USENIX} Security Symposium ({USENIX} Security 18). 2018.
Mr. Abdullah Mujawib Alashjaee
Computer Science Department, University of Idaho, Moscow, ID, 83844, USA
Computer Science Department, Northern Borders University, Arar, 73222, Saudi Arabia - United States of America
Mr. Salahaldeen Duraibi
Computer Science Department, University of Idaho, Moscow, ID, 83844, USA
Computer Science Department, Jazan University, Jazan, 45142, Saudi Arabia - United States of America
Dr. Jia Song
Computer Science Department, University of Idaho, Moscow, ID, 83844, USA - United States of America