taint analysis

Taint analysis faces two key challenges: heavy reliance on manual annotation of third-party libraries and poor scalability due to the prohibitively large size of whole-program dependency graphs. This paper proposes a language-agnostic, explicit data-dependency graph construction method enabling efficient taint analysis for large-scale programs. Our contributions are threefold: (1) the first taint propagation mechanism supporting *incremental library annotation*—i.e., adding or refining library function specifications *without re-analyzing the entire program*; (2) a lightweight, cross-language intermediate representation for data dependencies; and (3) a flow-sensitive but context-insensitive over-approximation model built atop Joern, balancing precision and performance. Evaluation demonstrates substantial improvements in analysis speed and scalability, making the approach suitable for CI/CD integration. The implementation is open-sourced and integrated into Joern, advancing practical, automated vulnerability detection.

Existing taint analysis tools lack interactive, end-user–oriented debugging capabilities, hindering investigation of causal and counterfactual questions—such as “Why?”, “Why not?”, and “What-if?”—and failing to expose global data connectivity across multiple sources and sinks due to limitations of tree- or list-only visualizations. This paper introduces TraceLens: the first question-answering–enabled taint flow debugging interface, integrating static taint analysis with configurable hybrid visualization (tree + list views). It supports user-defined sources/sinks and speculative analysis of third-party library model impacts. A controlled user study demonstrates that, compared to CodeQL, TraceLens improves fault localization accuracy by 21% and reduces cognitive workload by 45% (measured via NASA-TLX), while significantly increasing developers’ confidence in identifying critical data flows.

This work addresses the challenge of inaccurate taint analysis in JavaScript due to the language’s dynamic features and the vast npm ecosystem, which hinder precise identification of sources, sinks, and data flows, leading to high false-negative rates in existing static application security testing (SAST) tools. To overcome this, the authors propose SemTaint, the first approach that deeply integrates multi-agent large language models (LLMs) with static analysis. SemTaint leverages collaborative semantic reasoning to automatically extract CWE-specific taint specifications—including sources, sinks, call edges, and library summaries—and dynamically resolves unparseable calls while accurately modeling complex dependencies. Integrated into CodeQL, SemTaint successfully identifies 106 out of 162 previously missed vulnerabilities and discovers four new vulnerabilities in four widely used npm packages.

To address the challenge posed by widespread adoption of Techniques Against Dynamic Analysis (TADA) in malware—which undermines sandboxing efficacy and impedes manual reverse engineering—this paper proposes the first large language model (LLM)-based method for automatic TADA code localization. Our approach integrates semantic understanding and behavioral reasoning without relying on static symbols or runtime traces. It leverages fine-tuned CodeLlama, a novel disassembled instruction sequence encoding scheme, multi-granularity contextual prompting, and cross-sample transfer learning to precisely identify stealthy detection logic. Evaluated on a public dataset, our method achieves an 87.80% localization accuracy and successfully identifies real-world TADA snippets in four prevalent malware families (e.g., Emotet and QakBot), with an average localization error of fewer than three instructions. This significantly enhances dynamic analysis robustness and accelerates reverse-engineering workflows.

Static binary taint analysis suffers from heavy reliance on manually crafted rules, poor generalizability, and high engineering overhead. To address these limitations, this paper proposes LATTE—the first fully automated static binary taint analysis framework powered by large language models (LLMs). LATTE uniquely integrates LLMs deeply into both taint propagation modeling and semantic understanding of low-level code, enabling end-to-end automation via prompt engineering—eliminating the need for hand-written propagation or detection rules. Evaluated on real-world embedded firmware, LATTE discovers 37 previously unknown vulnerabilities (including 7 CVEs), outperforming state-of-the-art tools—including Emtaint, Arbiter, and Karonte—in both vulnerability detection rate and precision. Moreover, it substantially reduces manual effort and analysis cost. LATTE establishes a novel paradigm for leveraging LLMs in low-level program security analysis, marking a significant advance in automating binary-level taint tracking.

Static taint analysis often suffers from high false positives or false negatives due to coarse-grained sanitization modeling, blind spots in database propagation, and insufficient handling of object-level data flows. This work proposes an enhanced code property graph approach that jointly models sanitization logic, persistent propagation, and object field–level name semantics for the first time. It introduces vulnerability-type-aware sanitization analysis, a database-state-aware cross-script propagation mechanism, and object-aware reaching definitions, further integrating context-sensitive parameter binding, database schema constraints, and query safety verification. Evaluated on the SARD benchmark, the method maintains 80% accuracy while significantly reducing false positives. In experiments on 19 real-world PHP applications, it successfully reproduces most known CVEs and uncovers 29 previously undisclosed zero-day vulnerabilities—26 SQL injections and 3 stored XSS flaws.

Static analysis struggles to reconstruct complete control flow graphs for binaries employing dynamic loading techniques—such as packed programs and modern malware—due to unresolved indirect calls. This work proposes a novel approach that integrates symbolic execution with speculative library preloading. By deploying custom hooks during symbolic execution, the method intercepts dynamic loading operations in real time, speculatively preloads required libraries, and synchronously tracks instructions while managing intercepted functions—all without executing potentially malicious code. Consequently, it safely recovers accurate control flow graphs. Experimental evaluation on 16 synthetic benchmarks demonstrates that, compared to pure static analysis, the proposed technique recovers on average 29.8% more nodes and 26.5% more edges, while achieving 100% precision and recall in library identification.

This work addresses the challenge of locating cross-procedural vulnerability-triggering statements—specifically, identifying code that transforms program state into unsafe operations, particularly when situated deep within call chains outside patched functions. To this end, it proposes the first static analysis method integrating agent-guided exploration with causal evidence verification. The approach leverages large language model (LLM) agents to navigate code property graphs, while a deterministic acceptability gate ensures that all reported triggers are supported by explicit causal evidence. The study introduces SinkTrace-Bench, the first benchmark dataset of source-to-sink causal chains, comprising 1,542 balanced samples. Evaluated on InterPVD, the method achieves 75.0% VulnHit and 80.8% FuncHit, substantially outperforming existing techniques, and further exposes inherent limitations of LLMs in causal reasoning.

This work addresses the vulnerability of large language model (LLM) agents to attacks such as indirect prompt injection and unauthorized tool invocation when processing untrusted external inputs. Traditional taint analysis fails in this context due to its inability to model the probabilistic, natural-language-based information flows inherent in LLMs. To overcome this limitation, the authors propose NeuroTaint, a novel framework that reconceptualizes taint propagation as a joint process encompassing semantic transformation, causal decision influence, and cross-session memory persistence—departing from conventional paradigms reliant on string matching or predefined paths. By auditing execution traces offline, NeuroTaint combines semantic similarity analysis, causal impact detection, and memory state tracking to reconstruct end-to-end information flows from untrusted sources to privileged operations. Evaluated on benchmarks including TaintBench (400 scenarios), InjecAgent, and ToolEmu, NeuroTaint significantly outperforms the FIDES baseline while maintaining low auditing overhead.

This work addresses the challenges posed by Go-language malware to traditional static analysis and memory forensics, stemming from its statically linked binaries, intricate runtime structures, and absence of type information. The paper presents the first memory forensic framework specifically designed for Go malware, built upon Volatility 3. By dissecting Go runtime internals, the framework systematically reconstructs active execution states through ABI-aware call stack unwinding, goroutine stack traversal, and recovery of heap-allocated strings and associated metadata. Evaluated on real-world samples including BRICKSTORM, Obscura, and Pantegana, the approach successfully extracts critical artifacts such as C2 addresses, persistence mechanisms, encryption keys, and ransom notes—some of which surpass existing threat intelligence reports—thereby filling a significant gap in dynamic analysis capabilities for Go-based malware.