Mon 20 - Fri 24 October 2014 Portland, Oregon, United States
Wed 22 Oct 2014 10:52 - 11:15 at Salon F - Runtime Systems Chair(s): Martin Hirzel

Dynamic taint analysis is a well-known information flow analysis problem with many possible applications. Taint tracking allows for analysis of application data flow by assigning labels to inputs, and then propagating those labels through data flow. Taint tracking systems traditionally compromise among performance, precision, accuracy, and portability. Performance can be critical, as these systems are typically intended to be deployed with software, and hence must have low overhead. To be deployed in security-conscious settings, taint tracking must also be accurate and precise. Dynamic taint tracking must be portable in order to be easily deployed and adopted for real world purposes, without requiring recompilation of the operating system or language interpreter, and without requiring access to application source code.

We present Phosphor, a dynamic taint tracking system for the Java Virtual Machine (JVM) that simultaneously achieves our goals of performance, accuracy, precision, and portability. Moreover, to our knowledge, it is the first portable general purpose taint tracking system for the JVM. We evaluated Phosphor’s performance on two commonly used JVM languages (Java and Scala), on two versions of two commonly used JVMs (Oracle’s HotSpot and OpenJDK’s IcedTea) and on Android’s Dalvik Virtual Machine, finding its performance to be impressive: as low as 3% (53% on average), using the DaCapo macro benchmark suite. This paper describes the approach that Phosphor uses to achieve portable taint tracking in the JVM.

Video: http://www.infoq.com/presentations/phosphor

Wed 22 Oct
Times are displayed in time zone: (GMT-07:00) Tijuana, Baja California change

10:30 - 12:00: OOPSLA - Runtime Systems at Salon F
Chair(s): Martin HirzelIBM Research
oopsla201410:30 - 10:52
Earl T. BarrUniversity College London, Mark MarronMicrosoft Research
Link to publication
oopsla201410:52 - 11:15
Jonathan BellColumbia University, Gail KaiserColumbia University, New York
Link to publication Media Attached
oopsla201411:15 - 11:37
Luís PinaTechnical University of Lisbon / INESC-ID, Luís VeigaINESC-ID / Instituto Superior Técnico, Universidade de Lisboa, Michael HicksUniversity of Maryland, College Park
Link to publication
oopsla201411:37 - 12:00
Rifat ShahriyarAustralian National University, Steve BlackburnAustralian National University , Kathryn S McKinleyMicrosoft Research
Link to publication