Dynamic Taint Propagation Based on Dynamic String Conversion Detection

Abstract

Currently, the security of web applications is faced with the threat of script injection attacks, such as cross-site scripting, and SQL injection. DTP (Dynamic Taint Propagation) has been established as a powerful technique for detecting script injection attacks, but current DTP systems suffer from a trade-off between false positives and false negatives. Therefore, Li et al. proposed an enhanced DTP system called SWIFT. SWIFT traces memory accesses, detects string operations, and only propagates tainted information under string operations. Although the basic idea of SWIFT is quite promising, they only showed a preliminary implementation on a simulator and failed to show advantage in accuracy over Raksha, which is one of the most sophisticated platform DTP systems. In this paper, we implement SWIFT to PHP interpreter to put SWIFT into practical use. Moreover, we succeeded to show that SWIFT has better propagation accuracy than Raksha in real-world web applications.