TreeDroid: a tree automaton based approach to enforcing data processing policies

Current approaches to security policy monitoring are based on linear control flow constraints such as 'runQuery' may be evaluated only after 'sanitize'. However, realistic security policies must be able to conveniently capture data flow constraints as well. An example is a policy stating that arguments to the function 'runQuery' must be either constants, outputs of a function 'sanitize', or concatenations of any such values. We present a novel approach to security policy monitoring that uses tree automata to capture constraints on the way data is processed along an execution. We present a »-calculus based model of the framework, investigate some of the models meta-properties, and show how it can be implemented using labels corresponding to automaton states to reflect the computational histories of each data item. We show how a standard denotational semantics induces the expected monitoring regime on a simple "while" language. Finally we implement the framework for the Dalvik VM using TaintDroid as the underlying data flow tracking mechanism, and evaluate its functionality and performance on five case studies.