# Dynamic Information Flow Tracking: Taxonomy, Challenges, and Opportunities
## 1 Introduction  
Dynamic information flow tracking (DIFT) is a technique which leverages metadata tags to track the information flow among different entities. DIFT can be used to provide runtime protection for programs; data usage analysis; and performance analysis, wherein the tag is used to record the security properties of data and instructions. The program and its data usage profile can be acquired through analyzing and checking the tag usage. While the implementations of DIFT vary based on the target designs and other constraints, we can roughly divide DIFT techniques into three types: (i) software-based DIFT, (ii) hardware-based DIFT and (iii) software and hardware co-design-based DIFT. The different types of DIFT each have their benefits and limitations. For software-based DIFT mechanisms [1; 2; 3; 4; 5; 6; 7; 8; 9; 10; 11; 12; 13; 14], the tag can be combined with the software context closely through binary code instrumentation and source code modifications. Since one does not have to modify the hardware components, the software-based DIFT design provides better flexibility, customization and scalability. However, software solutions often introduce high performance overheads because additional instructions are added to support DIFT. Meanwhile, hardware assisted DIFT design [15; 16; 17; 18; 19; 20; 21; 22; 23; 24; 25; 26; 27; 28; 29; 30] can extract sufficient runtime data from the hardware level to enforce different security rules. By modifying the hardware, all DIFT-related operations are implemented as hardware logic to accelerate the tag propagation and tag checking. An exception is raised once the security rules are violated. This type of design reduces the high performance overhead but at its own cost. Hence, it is difficult to deploy hardware assisted DIFT in a real system, especially in modern commercial systems. The hardware-based DIFT design may not provide much flexibility and scalability after deployed. The hardware overhead usually cannot be handled by resource-constrained devices, e.g., low-end embedded systems. In addition to the above DIFT design, the hardware and software co-design [31; 32; 33; 34; 35] is a good option for enforcing DIFT rules. This type of design can extract information from a special hardware interface and associate the software context with the data from hardware. Flexible and fine-grained security check rules can be enforced in this type of design. There are some open questions. For example, it is difficult to decide on how to design a suitable tag when considering both software and hardware. Security rules on the software side need to be translated into tags. The hardware needs to be extended or modified to support the tags. Additionally, tag design needs to support rule updating after the system is deployed. It is difficult to balance both flexibility and hardware overheads at the same time. The above discussion briefly compared the different DIFT types. Additionally, there are some surveys about existing DIFT works. [PERSON] et al. in [36] summarized and analyzed several DIFT works. [PERSON] et al. in [37] aimed at analyzing the existing methods of malware detection and analysis. Additionally, this work does not involve static methods. [PERSON] et al. in [38] mainly focused on the DIFT works on mobile malware detection. They did not give a comprehensive analysis on existing DIFT works on different application environments. [PERSON] et al. in [39] analyzed the precision and soundness of existing software-based DIFT works. [PERSON] et al. in [40] analyzed existing dynamic binary instrumentation (DBI) methods. Additionally, they discussed the usage of DBI in the DIFT framework. Still, a more detailed comparison between different DIFT solutions is needed to guide the use of these solutions. Thus, in this paper, we analyze and systematize all three types of DIFT design--hardware-based, software-based and software and hardware co-design. The implementations of these three types of DIFT design cover different computer system layers.