DECAF++: Elastic Whole-System Dynamic Taint Analysis

Whole-system dynamic taint analysis has many unique applications such as malware analysis and fuzz testing. Compared with process-level taint analysis, it offers a wider analysis scope, better transparency and tamper resistance. The main barrier of applying whole-system dynamic taint analysis in practice is the large slowdown that can be sometimes up to 30 times. Existing optimization schemes either have considerable baseline overheads (when there is no tainted data) or rely on specific hardware features. In this paper, we propose an elastic whole-system dynamic taint approach and implement a prototype called DECAF++. Elastic whole-system dynamic taint analysis strives to perform taint analysis as least frequent as possible while maintaining the precision and accuracy. Although similar ideas are explored before for process-level taint analysis, we are the first to successfully achieve true elasticity for whole-system taint analysis via pure software approaches. We evaluated our prototype DECAF++ on nbench, apache bench, and SPEC CPU2006. Under taint analysis load, DECAF++ achieves 202% speedup on nbench and 66% speedup on apache bench. Under no taint analysis load with SPEC CPU2006, DECAF++ imposes only 4% overhead.