基于多属性决策及污点跟踪的大数据平台敏感信息泄露感知方法

Sensitive information leakage awareness method for big data platform based on multi-attributes decision-making and taint tracking

基于多属性决策及污点跟踪提出一种面向大数据平台中敏感信息泄露的感知方法,该方法通过分析已知大数据平台敏感信息泄露的相关已知漏洞,抽取并推演目标敏感信息集合,并结合敏感信息操作语义建立目标集多属性模型,进而设计基于灰色关联分析及理想优基点法的敏感度计算方法,并基于污点跟踪实现了原型系统,最终实现了基于所提方案的跨平台敏感信息泄露漏洞的挖掘与验证。实验表明,所提方法可有效实现敏感信息泄露场景的已知漏洞验证及未知漏洞挖掘,从而为敏感信息动态数据流的安全防护提供支持。

Based on multiple-attribute-decision-making and taint tracking,a sensitive-information leakage awareness method was proposed,some relative known vulnerabilities in big data platform was analyzed,target database was extracted and extended,multiple attribute model was built combined with operation semantic,a grey-correlation-analysis and technique for order preference by similarity to an ideal solution based sensitivity measurement was designed in combination of regular operation semantic for sensitive information.A prototype was built based on taint tracking,sensitive-information leakage vulnerabilities could be verified and discovered across big data platforms in this method.The experiment shows that verification for known bugs and discovery for unknown vulnerabilities can be accomplished based on leakage scenarios,which can be regarded as a support for protection in dynamic sensitive information data flow.