I'm studying program slicing and taint analysis. I know notion of program slicing and taint analysis.

I think Program slicing and taint analysis are similar notion. I don' know difference between program slicing and taint analysis.

What is the difference between program slicing and taint analysis?


In my understanding there are two major differences:

Program Slicing creates a reduced representant of a program which should still produces the same output for a given input. So you reduce the given program to its core functionality and you throw away all the clumpy/insignificant attachments.

In contrast a Taint Analysis traces the path of an information through an application and observes all the objects which are affected/visited/influenced by the corresponding information. Therefor a specific input is labeled or tagged, so it could be tracked during its execution.

So you have a reduced representation of a program with consideration of input output behavior VS the trail of a selected input/variable within a program and its dependencies.

See also detailed descriptions below:

Program slicing tries to reduce a given program P to a minimum form, a so called slice S, which produces the same behavior. More formally taken from these slides:

  • produce a slice S from a given program P by deleting statements
  • slice must be syntactically correct a given set of variables V
  • should produce the same output when given to S and P

Taint analysis can be seen as a form of Information Flow Analysis. A more formal definition ripped from here:

Information flows from object x to object y, denoted x→y , whenever Information stored in x is transferred to, object y.

| improve this answer | |
  • IMHO, what you are referring is about "static program slicing". On the other hand, in terms of "dynamic slicing" which is performed on a execution trace, then it cares about a selected input as well (since one trace corresponds to one input). – lllllllllllll Mar 8 '18 at 14:48
  • Could you provide a reference for static vs dynamic slicing? – kn000x Mar 8 '18 at 23:01

I'd say they are essentially the same, with slightly different focus:

Program slicing is, strictly, extracting code that operates on specific variables/memory, while omitting all other code;

Taint analysis is tracking which other variables/memory are affected, via that code, by the ones you chose. Also, tainted data is usually stricter defined as "user-controllable data", while slicing can be done on any var.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.