Instruct: Identify the main and secondary category of Arxiv papers based on the titles and abstracts
Query: An Empirical Study of Information Flows in Real-World JavaScript   Information flow analysis prevents secret or untrusted data from flowing into
public or trusted sinks. Existing mechanisms cover a wide array of options,
ranging from lightweight taint analysis to heavyweight information flow control
that also considers implicit flows. Dynamic analysis, which is particularly
popular for languages such as JavaScript, faces the question whether to invest
in analyzing flows caused by not executing a particular branch, so-called
hidden implicit flows. This paper addresses the questions how common different
kinds of flows are in real-world programs, how important these flows are to
enforce security policies, and how costly it is to consider these flows. We
address these questions in an empirical study that analyzes 56 real-world
JavaScript programs that suffer from various security problems, such as code
injection vulnerabilities, denial of service vulnerabilities, memory leaks, and
privacy leaks. The study is based on a state-of-the-art dynamic information
flow analysis and a formalization of its core. We find that implicit flows are
expensive to track in terms of permissiveness, label creep, and runtime
overhead. We find a lightweight taint analysis to be sufficient for most of the
studied security problems, while for some privacy-related code, observable
tracking is sometimes required. In contrast, we do not find any evidence that
tracking hidden implicit flows reveals otherwise missed security problems. Our
results help security analysts and analysis designers to understand the
cost-benefit tradeoffs of information flow analysis and provide empirical
evidence that analyzing implicit flows in a cost-effective way is a relevant
problem.

28
The categories of this paper are: alg-geom
25
The categories of this paper are: patt-sol
6
The categories of this paper are: astro-ph
8
The categories of this paper are: hep-ex
3
The categories of this paper are: physics
19
The categories of this paper are: eess
10
The categories of this paper are: q-bio
20
The categories of this paper are: acc-phys
36
The categories of this paper are: cmp-lg
13
The categories of this paper are: quant-ph
16
The categories of this paper are: stat
15
The categories of this paper are: nucl-ex
34
The categories of this paper are: chem-ph
22
The categories of this paper are: chao-dyn
37
The categories of this paper are: supr-con
21
The categories of this paper are: adap-org