Towards Thwarting Data Leakage with Memory Page Access Interception

Data leakage prevention has recently become the most important concern for both personal users and corporate users. Most existing feasible data leakage preventers are built with the Dynamic Binary Instrumentation (DBI) technology. Such mechanism suffers from poor application compatibility issue, especially for the large scale ones. In this paper, we propose Gemini, an instrumentation-free approach, to track data propagation dynamically and then prevent data leakage. Gemini leverages the page fault interrupt mechanism of the operating system, instead of DBI, to track memory page accesses, and then thwart the data leakage. As a result, Gemini is application transparent, i.e., it solves the application compatibility issue. Besides, Gemini is implemented on the most prevalent operating system-Windows, while most of previous approaches are built on Linux. Our evaluation results demonstrate Gemini´s feasibility and effectiveness.