Dynamic tainting for deployed Java programs

Dynamic tainting is a powerful technique that has been used to detect computer attacks, generate test cases analyze data scopes, and protect memory. However, existing tainting techniques suffer from excessive runtime overheads that can be as high as 30 to 50 times, making them unsuitable for applications in deployed systems. The goal of our work is to provide as efficient and low-overhead tainting framework that can be used in deployed environments. To accomplish this goal, we propose to implement framework that supports dynamic tainting as a feature of a Java Virtual Machine (JVM). In this approach, the tainting code can be injected by the JVM without needing to instrument the source code. It can also support customizable and configurable tainting. The overhead of tainting can be controlled by sampling and different tainting granularity. For example, the framework can taint all the data as needed when the workload is low. It can also taint only a subset of interesting data to reduce the overhead. Ultimately, we envision that our proposed framework will be instrumental in various dynamic monitoring methodologies including runtime verification.