TY - GEN
T1 - Minemu
T2 - 14th International Symposium on Recent Advances in Intrusion Detection Systems, RAID 2011
AU - Bosman, Erik
AU - Slowinska, Asia
AU - Bos, Herbert
PY - 2011
Y1 - 2011
N2 - Dynamic taint analysis is a powerful technique to detect memory corruption attacks. However, with typical overheads of an order of magnitude, current implementations are not suitable for most production systems. The research question we address in this paper is whether the slow-down is a fundamental speed barrier, or an artifact of bolting information flow tracking on emulators really not designed for it. In other words, we designed a new type of emulator from scratch with the goal of removing superfluous instructions to propagate taint. The results are very promising. The emulator, known as Minemu, incurs a slowdown of 1.5x-3x for real and complex applications and 2.4x for SPEC INT2006, while tracking taint at byte level granularity. Minemu's performance is significantly better than that of existing systems, despite the fact that we have not applied some of their optimizations yet. We believe that the new design may be suitable for certain classes of applications in production systems.
AB - Dynamic taint analysis is a powerful technique to detect memory corruption attacks. However, with typical overheads of an order of magnitude, current implementations are not suitable for most production systems. The research question we address in this paper is whether the slow-down is a fundamental speed barrier, or an artifact of bolting information flow tracking on emulators really not designed for it. In other words, we designed a new type of emulator from scratch with the goal of removing superfluous instructions to propagate taint. The results are very promising. The emulator, known as Minemu, incurs a slowdown of 1.5x-3x for real and complex applications and 2.4x for SPEC INT2006, while tracking taint at byte level granularity. Minemu's performance is significantly better than that of existing systems, despite the fact that we have not applied some of their optimizations yet. We believe that the new design may be suitable for certain classes of applications in production systems.
KW - dynamic taint tracking
KW - intrusion detection
KW - JIT compilation
UR - http://www.scopus.com/inward/record.url?scp=84857284621&partnerID=8YFLogxK
UR - http://www.scopus.com/inward/citedby.url?scp=84857284621&partnerID=8YFLogxK
U2 - 10.1007/978-3-642-23644-0_1
DO - 10.1007/978-3-642-23644-0_1
M3 - Conference contribution
SN - 9783642236433
T3 - Lecture Notes in Computer Science
SP - 1
EP - 20
BT - Recent Advances in Intrusion Detection
A2 - Sommer, Robin
A2 - Balzarotti, Davide
A2 - Maier, Gregor
CY - Berlin
Y2 - 20 September 2011 through 21 September 2011
ER -
