Article
Efficient purely-dynamic information flow analysis
Proceedings of the ACM SIGPLAN Fourth Workshop on Programming Languages and Analysis for Security
(2009)
Abstract
We present a novel approach for efficiently tracking information flow in a dynamically-typed language such as JavaScript. Our approach is purely dynamic, and it detects problems with implicit paths via a dynamic check that avoids the need for an approximate static analyses while still guaranteeing non-interference. We incorporate this check into an efficient evaluation strategy based on sparse information labeling that leaves information flow labels implicit whenever possible, and introduces explicit labels only for values that migrate between security domains. We present experimental results showing that, on a range of small benchmark programs, sparse labeling provides a substantial (30%--50%) speed-up over universal labeling.
Keywords
- Operating system security,
- language features,
- general programming,
- Security,
- computing
Disciplines
Publication Date
2009
Publisher Statement
SJSU users: use the following link to login and access the article via SJSU databases
Citation Information
Thomas H. Austin and Cormac Flanagan. "Efficient purely-dynamic information flow analysis" Proceedings of the ACM SIGPLAN Fourth Workshop on Programming Languages and Analysis for Security (2009) Available at: http://works.bepress.com/thomas_austin/13/