Parallelizing dynamic information flow tracking

  • Authors:

  • Olatunji Ruwase;Phillip B. Gibbons;Todd C. Mowry;Vijaya Ramachandran;Shimin Chen;Michael Kozuch;Michael Ryan

  • Affiliations:

  • Carnegie Mellon University, Pittsburgh, PA, USA;Intel Research Pittsburgh, Pittsburgh, PA, USA;Carnegie Mellon University and Intel Research Pittsburgh, Pittsburgh, PA, USA;University of Texas at Austin, Austin, TX, USA;Intel Research Pittsburgh, Pittsburgh, PA, USA;Intel Research Pittsburgh, Pittsburgh, PA, USA;Intel Research Pittsburgh, Pittsburgh, PA, USA

  • Venue:
  • Proceedings of the twentieth annual symposium on Parallelism in algorithms and architectures
  • Year:
  • 2008

Quantified Score

Hi-index 0.00

Visualization

Abstract

Dynamic information flow tracking (DIFT) is an important tool for detecting common security attacks and memory bugs. A DIFT tool tracks the flow of information through a monitored program's registers and memory locations as the program executes, detecting and containing/fixing problems on-the-fly. Unfortunately, sequential DIFT tools are quite slow, and DIFT is quite challenging to parallelize. In this paper, we present a new approach to parallelizing DIFT-like functionality. Extending our recent work on accelerating sequential DIFT, we consider a variant of DIFT that tracks the information flow only through unary operations relaxed DIFT, and yet makes sense for detecting security attacks and memory bugs. We present a parallel algorithm for relaxed DIFT, based on symbolic inheritance tracking, which achieves linear speed-up asymptotically. Moreover, we describe techniques for reducing the constant factors, so that speed-ups can be obtained even with just a few processors. We implemented the algorithm in the context of a Log-Based Architectures (LBA) system, which provides hardware support for logging a program trace and delivering it to other (monitoring) processors. Our simulation results on SPEC benchmarks and a video player show that our parallel relaxed DIFT reduces the overhead to as low as 1.2X using 9 monitoring cores on a 16-core chip multiprocessor.