MITOS: Optimal Decisioning for the indirect Flow Propagation Dilemma in Dynamic Information Flow Tracking Systems
Technical Report,30 Jun 2015,01 Jul 2019
University of Florida Gainesville United States
Pagination or Media Count:
Dynamic Information Flow Tracking DIFT is a technique for tracking the information as it flows through a programs execution. Specifically, some inputs or data get tainted and then these taint marks tags propagate usually at the instruction-level. While DIFT has been a fundamental concept in computer and network security for the past decade, it still faces open challenges that impede its widespread application in practice one of them being the indirect flow propagation dilemma should the tags involved in an indirect flow, e.g., in a control or address dependency, be propagated Propagating all these tags, as is done for direct flows, leads to overtainting, while not propagating those leads to undertainting. In this work, we analytically model that decisioning problem for indirect flows, by optimally weighting various tradeoffs including undertainting versus overtainting. Towards tackling this problem, we design and implement MITOS, a distributed-optimization algorithm that optimally decides about the propagation of indirect flows. We also perform a case-study scenario with a real in-memory only attack and show that MITOS improves simultaneously i systems spatiotemporal overhead and ii systems fingerprint on suspected bytes up to 167 compared to traditional DIFT, even though these metrics usually conflict.
- Operations Research