Parallelizing Dynamic Information Flow Tracking Olatunji Ruwase* Phillip B. Gibbons† Todd C. Mowry* Vijaya Ramachandran§ Shimin Chen† Michael Kozuch† Michael Ryan† Carnegie Mellon University * Intel Research Pittsburgh † University of Texas at Austin §

Lifeguards: Pros and Cons + Monitors a running program in order to detect bugs & security attacks E.g., detect any accesses to unallocated memory program lifeguard 1 2 3 4 1 2 3 4 1 2 1 2 3 4 3 4 Slows down the program 3X to 30X program slowdown Parallelize lifeguards to make them faster Can run lifeguard on separate core SPAA ‘08 June 14, 2008 Parallelizing Dynamic Information Flow Tracking Olatunji Ruwase

TaintCheck : A Dynamic Information Flow Tracking Lifeguard = = + JMP = …………… JMP My My PACKET PACKET Mx R1 DIFT Parallelism Challenge: Embarrassingly sequential lifeguards R2 R1 R1 My Mx My R1 R1 Catch security bugs [NewSome et al NDSS ‘05] TAINTED/UNTAINTED Propagation of taint status Memcheck [Nethercote et al PLDI’05] memory bugs SPAA ‘08 June 14, 2008 Parallelizing Dynamic Information Flow Tracking Olatunji Ruwase

A Parallel DIFT Algorithm -------- --------------- ------- -------- -------- -------- -------- -------- -------- -------- n -------- Asymptotic Linear Speedup -------- Symbolic Inheritance Tracking Ο(n/p) Inheritance Resolution Ο(n/p) SPAA ‘08 June 14, 2008 Parallelizing Dynamic Information Flow Tracking Olatunji Ruwase

Symbolic Inheritance Tracking Mx = R1 Mx = My R1 = R2 R1 R2 = R3 R2 R3 segment j + 1 segment j - 1 segment j Collapsed propagation chain SPAA ‘08 June 14, 2008 Parallelizing Dynamic Information Flow Tracking Olatunji Ruwase

Inheritance Resolution Mx My R2 R1 R3 R2 segment j - 1 segment j segment j + 1 Resolve segments in sequential order Locations within segment are resolved in parallel SPAA ‘08 June 14, 2008 Parallelizing Dynamic Information Flow Tracking Olatunji Ruwase

Symbolic Inheritance Tracking (Harder Case) = Mx R1 R1 R2 = + R2 R2 R1 = My R1 My = R1 My Mx My JMP ? R1 segment j + 1 segment j - 1 segment j Unary propagation [Costa et al SOSP ‘05] SPAA ‘08 June 14, 2008 Parallelizing Dynamic Information Flow Tracking Olatunji Ruwase

Inheritance Resolution (Harder Case) Mx R2 My R1 R1 My My JMP ? segment j - 1 segment j segment j + 1 Detect security attack SPAA ‘08 June 14, 2008 Parallelizing Dynamic Information Flow Tracking Olatunji Ruwase

Implementation : Parallel TaintCheck Algorithm Implementation -------- -------- --------------- ------- -------- -------- -------- -------- -------- -------- -------- -------- Parallel workers Master -------- -------- -------- -------- -------- -------- -------- -------- Speedup achieved because inheritance information is smaller than code segment SPAA ‘08 June 14, 2008 Parallelizing Dynamic Information Flow Tracking Olatunji Ruwase

Achieving speedups with few workers Constant Factors sequential 2 workers Taint propagation 1 Inheritance Tracking 2 Inheritance Resolution -------- ----------- ------- .5T T 1.5T -------- ------- -------- --------- time Inheritance info ~ ½ segment -------- --------- ------- Require up to 4 workers to match sequential performance -------- --------- ------- SPAA ‘08 June 14, 2008 Parallelizing Dynamic Information Flow Tracking Olatunji Ruwase

Hybrid Parallelism sequential 2 workers 1 worker -------- ----------- ------- .5T .75T T 1.5T -------- ------- -------- --------- ------- -------- --------- ------- -------- ------- --------- -------- --------- ------- --------- -------- ------- --------- -------- ------- -------- --------- Use inheritance tracking as accelerator for taint propagation Achieves speedup even with 1 worker SPAA ‘08 June 14, 2008 Parallelizing Dynamic Information Flow Tracking Olatunji Ruwase

Evaluation Log Transport Decompress Compress capture Operating System (e.g. L2 cache) Core 1 Core 2 Decompress Compress capture dispatch Operating System Application Lifeguard Log Based Architectures [Chen et al ISCA ’08] Simics simulation 16 core 64K execution window 10 SPEC 2000 integer benchmarks SPAA ‘08 June 14, 2008 Parallelizing Dynamic Information Flow Tracking Olatunji Ruwase

Slowdown Improvement using Pure Parallelism Number of Workers 0 workers = Sequential SPAA ‘08 June 14, 2008 Parallelizing Dynamic Information Flow Tracking Olatunji Ruwase

gcc slowdown with few workers SPAA ‘08 June 14, 2008 Parallelizing Dynamic Information Flow Tracking Olatunji Ruwase

Related Work Sequential DIFT: [Suh et al ASPLOS 04, Costa et al SOSP ’05, Newsome et al NDSS ’05, Nethercote et al PLDI ’07, Dalton et al ISCA ’07, Venkataramani et al HPCA ‘08] Parallel DIFT : Speck [Nightingale et al ASPLOS ’08] Parallel taint analysis lifeguard on commodity CMPs Parallel compression of code segments Sequential analysis of compressed segments Cannot achieve linear speedup (unary propagation not considered) Video decoder slowdown reduced from 18X to 9X using 9 lifeguard threads. SPAA ‘08 June 14, 2008 Parallelizing Dynamic Information Flow Tracking Olatunji Ruwase

Parallel DIFT algorithm Conclusion Parallel DIFT algorithm Symbolic Inheritance Tracking Unary propagation Asymptotic Linear speedup Parallel TaintCheck Lifeguard Program slowdown reduced from 3X – 5X to 1.2X – 3X with 8 worker threads Hybrid parallelism is useful with few workers SPAA ‘08 June 14, 2008 Parallelizing Dynamic Information Flow Tracking Olatunji Ruwase