Enabling Refinable Cross-Host Attack Investigation with Efficient Data Flow Tagging and Tracking
summary
RTAG implements cross-host dynamic information flow tracking by combining record-and-replay with system-call provenance and in-packet tag embedding, producing a practical tool that tags TCP streams with counters and UDP datagrams with embedded tags. The prototype uses a user-space DIFT engine and a replay-based analysis pipeline, recovers true cross-host data flows in realistic scenarios, reduces DIFT memory by up to 90%, cuts analysis time 60–90%, keeps runtime overhead under 5% and network overhead below 0.05%.
AI-written summary · about
chapters (13)
- 0:00Intro
- 0:26Advanced attacks involve multiple hosts
- 4:09Analyzing data flow across hosts is hard
- 5:01Resolving false positive dependencies
- 8:07Our approach
- 8:57Overview
- 11:53Tag allocation by analyzing syscall trace
- 12:49Comparison of tag sizes with previous systems
- 15:37UDP (datagram transmission)
- 17:36Evaluation
- 18:44Analysis time reduction - 90%
- 19:00Runtime overhead: 4.84% SPEC CPU2006
- 20:05Conclusion
related talks
31mFollow the Trace: How Traditional AppSec Tools Have Failed Us
14mCognitive and SelfAdaptive System for Distributed Tracing
49mRelational Observability for Cloud-Native Security and Data Science
16mHardTaint: Production-Run Dynamic Taint Analysis via Selective Hardware Tracing
41mTracing Real-Time Distributed Systems
10mTags: A Framework for Distributed Event Ordering
48mDPTrace: Dual Purpose Trace for Exploitability Analysis of Program Crashes
13mAPTGen: An Approach towards Generating Practical Dataset Labelled with Targeted...