DsVD: An Effective Low-Overhead Dynamic Software Vulnerability Discoverer

Abstract

Dynamic taint analysis based software vulnerability and malware detection is an effective method to detect a wide range of vulnerabilities. Unfortunately, existing systems suffer from requirement of source code, high overhead or shortage of discovery rules, which limit their usage. This paper proposes a low-overhead vulnerability discovery system called DsVD (Dynamic Software Vulnerabilities Discoverer). DsVD works on X86 executables and does not need any hardware change. A new taint state called controlled-taint is introduced to detect more types of vulnerabilities. Our experiments show that DsVD can effectively detect various software vulnerabilities. DsVD incurs very low overhead, only 3.1 times on average forSPECINT2006 benchmarks. With some optimizations such as Irrelevant API Filter and Basic Block Handling, it can reduce runtime overhead by a factor of 4-11 times.