Tracking Address and Control Dependencies for Full-System Information Flow Measurement

Dynamic information flow tracking (DIFT) works by tagging (or tainting) data and tracking it to measure the information flow throughout the system. Existing DIFT systems have limited support for address and control dependencies, and therefore cannot track information flow within a full system without addressing these very challenging dependencies in an application-specific fashion. A general way to track address and control dependencies will allow DIFT to be applied in a much wider variety of applications than is now possible, ranging from data provenance to behavioral malware analysis. Tracking address and control dependencies is largely a problem of stability: if these flows of information are tagged then the tainting scheme becomes unstable and soon the entire system becomes tainted, but if they are not tagged then information that should be tainted is not. In this paper, we propose relaxed static stability dynamic information flow tracking as a way to track address and control dependencies in a general fashion without compromising stability of the DIFT system. To the best of our knowledge, the system presented in this paper is the first DIFT system to measure full-system information flow with general support for tracking all address and control dependencies within the system. As a motivating example, in this paper we measure the amount of information flow between tainted sources and the control path of the CPU for a variety of scenarios. Our results demonstrate that tracking address and control dependencies is both: (1) necessary for meaningful measurements of the information flow in a real system, and (2) made possible by a relaxed static stability approach. Besides tracking address and control dependencies, other key research challenges addressed in this paper include how to handle loop constructs and how to prevent memory locations that are written once and read many times from leading to DIFT system instability.