A Meta-level Approach for Multilingual Taint Analysis

Damian Lyons, Dino Becaj

2021

Abstract

It is increasingly common for software developers to leverage the features and ease-of-use of different languages in building software systems. Nonetheless, interaction between different languages has proven to be a source of software engineering concerns. Existing static analysis tools handle the software engineering concerns of monolingual software but there is little general work for multilingual systems despite the increasing visibility of these systems. While recent work in this area has greatly extended the scope of multilingual static analysis systems, the focus has still been on a primary, host language interacting with subsidiary, guest language functions. In this paper we propose a novel approach that does not privilege any one language and has a modular way to include new languages. We present an approach to multilingual taint analysis (a security oriented static analysis method) as a ‘meta-level’ algorithm which includes monolingual static analysis as a special case. A complexity analysis of the taint analysis algorithm is presented along with a detailed ‘deep’ multilingual example with Python and C/C++ software. A performance analysis is presented on a collection of 20 public, multilingual repositories selected from github. Our results show an average of 76% improved coverage using our algorithm when compared to monolingual taint analysis.

Paper Citation

in Harvard Style

Lyons D. and Becaj D. (2021). A Meta-level Approach for Multilingual Taint Analysis. In Proceedings of the 16th International Conference on Software Technologies - Volume 1: ICSOFT, ISBN 978-989-758-523-4, pages 69-77. DOI: 10.5220/0010543800690077

in Bibtex Style

@conference{icsoft21,
author={Damian Lyons and Dino Becaj},
title={A Meta-level Approach for Multilingual Taint Analysis},
booktitle={Proceedings of the 16th International Conference on Software Technologies - Volume 1: ICSOFT,},
year={2021},
pages={69-77},
publisher={SciTePress},
organization={INSTICC},
doi={10.5220/0010543800690077},
isbn={978-989-758-523-4},
}

in EndNote Style

TY - CONF

JO - Proceedings of the 16th International Conference on Software Technologies - Volume 1: ICSOFT,
TI - A Meta-level Approach for Multilingual Taint Analysis
SN - 978-989-758-523-4
AU - Lyons D.
AU - Becaj D.
PY - 2021
SP - 69
EP - 77
DO - 10.5220/0010543800690077