# Cloud Security Using Fine-Grained Efficient Information Flow Tracking
## 3 Materials, Methods, and Tools Used by the CloudMonitor Framework
### Intel-Pin  
Intel-Pin is a dynamic binary instrumentation framework specifically catered towards the Instruction Set Architecture (ISA) 32 (32-bit), x86-64 (64-bit), and MIC (Many Integrated Core) ISAs that enables software developers to build personalized tools for dynamic program analysis [4]. These tools, known as Pin tools, can be utilized to analyze user space applications across Linux, Windows, and Mac operating systems. By performing run-time instrumentation of a program's binary file, Intel Pin tools allow in-depth analysis of the program's behavior and performance. As a result, the tool eliminates the need for re-compiling the initial source code and can assist in the instrumentation of programs that involve dynamic code generation (i.e., a relocatable image).  
The Intel-Pin API (Application Programming Interface) is well-organized and documented offering an abstraction of intricate instruction-set information. Thus, the API enables contextual details, such as register contents, to be passed as parameters into the injected code from the pin tool. Moreover, Intel Pin has built-in capabilities to save and restore register values that become overwritten by the injected code. This ensures that the application can proceed with its execution as intended, without any disruptions [4].  
A pin tool is comprised of three main components: instrumentation, analysis, and callback routines. Instrumentation routines are normally triggered when code that has not undergone recompilation is on the verge of execution, facilitating the analysis routines  
Figure 4: Conventional vs. Static Information Flow Tracking (modified) compiler.  
\begin{table}
\begin{tabular}{c c} \hline \hline
**Dynamic Information Flow Tracking** & **Static Information Flow Tracking** \\ \hline During the application run-time instrumentation code is added & Instrumentation code is added during the compilation of the application \\ \hline Can be directly applied to any software & Naturally, cannot be applied to any software \\ \hline Can establish a comprehensive set of guidelines for tracking & Application-specific (when a group of rules specifically \\ data flow or a set of rules can be formulated specifically tailored & functions for a single application) \\ to a particular system/application & \\ \hline Performance: Slow, requiring a DBI tool to be attached to the & Performance: Faster than DIFT. \\ running application to inject DIFT logic & No DBI tool is required and DIFT logic is already bundled \\  & within the application \\ \hline \hline \end{tabular}
\end{table}
Table 3: Static Versus Dynamic Information Flow Tracking.  
insertion. Essentially, instrumentation routines involve examining the binary instructions within a program to decide where and how analysis routines should be inserted. Analysis routines come into play when the code they are associated with is actively running. Callback routines, on the other hand, are triggered when specific conditions or events within the code occur, serving the purpose of security analysis [4].  
Therefore, after loading into system memory, Intel Pin performs program instrumentation by taking control of the program. Then, before execution, a JIT (Just-In-Time) compiler recompiles small sections of binary code. Consequently, there are new instructions introduced into the recompiled code, typically sourced from the Pin tool, which conducts the analysis. In addition, Intel Pin has a vast array of optimization techniques to achieve minimal run-time and memory overheads. At the time of this writing, about 30% without running a pin tool is the average overhead of Intel Pin [58]. As anticipated, the quality of the pin tool written by the software developer will greatly affect the overhead.