Improved Partial Instrumentation for Dynamic Taint Analysis in the JVM

Dynamic taint tracking is an important field of study with manyJava-based tools and systems created to implement it, includingPhosphor, a general purpose taint tracking tool designed forcommodity JVMs like Oracle and OpenJDK. Phosphor works byinstrumenting core Java libraries and the entire application bytecodewith operations to accurately propagate taint information. Prior workstrived to reduce the performance overhead of Phosphor by doingpartial instrumentation. The analysis that determined which parts ofthe program to instrument was effective but flawed.This paper aims to improve that analysis and further reduce theperformance overhead by instrumenting less of the program. We use thePetablox program analysis tool and custom Datalog rules to perform aninformation flow analysis that better models Phosphor's behavior,including calls across native library boundaries. We find that weobtain a reduction in the amount of a program that needs to beinstrumented by 79.9%