151 research outputs found
Enforcing Programming Guidelines with Region Types and Effects
We present in this paper a new type and effect system for Java which can be
used to ensure adherence to guidelines for secure web programming. The system
is based on the region and effect system by Beringer, Grabowski, and Hofmann.
It improves upon it by being parametrized over an arbitrary guideline supplied
in the form of a finite monoid or automaton and a type annotation or mockup
code for external methods. Furthermore, we add a powerful type inference based
on precise interprocedural analysis and provide an implementation in the Soot
framework which has been tested on a number of benchmarks including large parts
of the Stanford SecuriBench.Comment: long version of APLAS'17 pape
Dominators in Directed Graphs: A Survey of Recent Results, Applications, and Open Problems
The computation of dominators is a central tool in program optimization and code generation, and it has applications in other diverse areas includingconstraint programming, circuit testing, and biology. In this paper we survey recent results, applications, and open problems related to the notion of dominators in directed graphs,including dominator verification and certification, computing independent spanning trees, and connectivity and path-determination problems in directed graphs
Weighted pushdown systems and their application to interprocedural dataflow analysis
AbstractRecently, pushdown systems (PDSs) have been extended to weighted PDSs, in which each transition is labeled with a value, and the goal is to determine the meet-over-all-paths value (for paths that meet a certain criterion). This paper shows how weighted PDSs yield new algorithms for certain classes of interprocedural dataflow-analysis problems
IST Austria Thesis
This dissertation focuses on algorithmic aspects of program verification, and presents modeling and complexity advances on several problems related to the
static analysis of programs, the stateless model checking of concurrent programs, and the competitive analysis of real-time scheduling algorithms.
Our contributions can be broadly grouped into five categories.
Our first contribution is a set of new algorithms and data structures for the quantitative and data-flow analysis of programs, based on the graph-theoretic notion of treewidth.
It has been observed that the control-flow graphs of typical programs have special structure, and are characterized as graphs of small treewidth.
We utilize this structural property to provide faster algorithms for the quantitative and data-flow analysis of recursive and concurrent programs.
In most cases we make an algebraic treatment of the considered problem,
where several interesting analyses, such as the reachability, shortest path, and certain kind of data-flow analysis problems follow as special cases.
We exploit the constant-treewidth property to obtain algorithmic improvements for on-demand versions of the problems,
and provide data structures with various tradeoffs between the resources spent in the preprocessing and querying phase.
We also improve on the algorithmic complexity of quantitative problems outside the algebraic path framework,
namely of the minimum mean-payoff, minimum ratio, and minimum initial credit for energy problems.
Our second contribution is a set of algorithms for Dyck reachability with applications to data-dependence analysis and alias analysis.
In particular, we develop an optimal algorithm for Dyck reachability on bidirected graphs, which are ubiquitous in context-insensitive, field-sensitive points-to analysis.
Additionally, we develop an efficient algorithm for context-sensitive data-dependence analysis via Dyck reachability,
where the task is to obtain analysis summaries of library code in the presence of callbacks.
Our algorithm preprocesses libraries in almost linear time, after which the contribution of the library in the complexity of the client analysis is (i)~linear in the number of call sites and (ii)~only logarithmic in the size of the whole library, as opposed to linear in the size of the whole library.
Finally, we prove that Dyck reachability is Boolean Matrix Multiplication-hard in general, and the hardness also holds for graphs of constant treewidth.
This hardness result strongly indicates that there exist no combinatorial algorithms for Dyck reachability with truly subcubic complexity.
Our third contribution is the formalization and algorithmic treatment of the Quantitative Interprocedural Analysis framework.
In this framework, the transitions of a recursive program are annotated as good, bad or neutral, and receive a weight which measures
the magnitude of their respective effect.
The Quantitative Interprocedural Analysis problem asks to determine whether there exists an infinite run of the program where the long-run ratio of the bad weights over the good weights is above a given threshold.
We illustrate how several quantitative problems related to static analysis of recursive programs can be instantiated in this framework,
and present some case studies to this direction.
Our fourth contribution is a new dynamic partial-order reduction for the stateless model checking of concurrent programs. Traditional approaches rely on the standard Mazurkiewicz equivalence between traces, by means of partitioning the trace space into equivalence classes, and attempting to explore a few representatives from each class.
We present a new dynamic partial-order reduction method called the Data-centric Partial Order Reduction (DC-DPOR).
Our algorithm is based on a new equivalence between traces, called the observation equivalence.
DC-DPOR explores a coarser partitioning of the trace space than any exploration method based on the standard Mazurkiewicz equivalence.
Depending on the program, the new partitioning can be even exponentially coarser.
Additionally, DC-DPOR spends only polynomial time in each explored class.
Our fifth contribution is the use of automata and game-theoretic verification techniques in the competitive analysis and synthesis of real-time scheduling algorithms for firm-deadline tasks.
On the analysis side, we leverage automata on infinite words to compute the competitive ratio of real-time schedulers subject to various environmental constraints.
On the synthesis side, we introduce a new instance of two-player mean-payoff partial-information games, and show
how the synthesis of an optimal real-time scheduler can be reduced to computing winning strategies in this new type of games
A Compositional Deadlock Detector for Android Java
We develop a static deadlock analysis for commercial Android Java applications, of sizes in the tens of millions of
LoC, under active development at Facebook. The analysis runs
primarily at code-review time, on only the modified code and
its dependents; we aim at reporting to developers in under 15
minutes.
To detect deadlocks in this setting, we first model the real
language as an abstract language with balanced re-entrant locks,
nondeterministic iteration and branching, and non-recursive
procedure calls. We show that the existence of a deadlock in this
abstract language is equivalent to a certain condition over the
sets of critical pairs of each program thread; these record, for all
possible executions of the thread, which locks are currently held
at the point when a fresh lock is acquired. Since the critical pairs
of any program thread is finite and computable, the deadlock
detection problem for our language is decidable, and in NP.
We then leverage these results to develop an open-source
implementation of our analysis adapted to deal with real Java
code. The core of the implementation is an algorithm which
computes critical pairs in a compositional, abstract interpretation
style, running in quasi-exponential time. Our analyser is built in
the INFER verification framework and has been in industrial
deployment for over two years; it has seen over two hundred
fixed deadlock reports with a report fix rate of ∼54%
Analysis of Communicating Infinite State Machines using Lattice Automata
Communication protocols can be formally described by the Communicating Finite-State Machines~(CFSM) model. This model is expressive, but not expressive enough to deal with complex protocols that involve structured messages encapsulating integers or lists of integers. This is the reason why we propose an extension of this model : the Symbolic Communicating Machines (SCM). We also propose an approximate reachability analysis method, based on lattice automata. Lattice automata are finite automata, the transitions of which are labeled with elements of an atomic lattice. We tackle the problem of the determinization as well as the definition of a widening operator for these automata. We also show that lattice automata are useful for the interprocedural analysis
Program Dependence Net and On-demand Slicing for Property Verification of Concurrent System and Software
When checking concurrent software using a finite-state model, we face a
formidable state explosion problem. One solution to this problem is
dependence-based program slicing, whose use can effectively reduce verification
time. It is orthogonal to other model-checking reduction techniques. However,
when slicing concurrent programs for model checking, there are conversions
between multiple irreplaceable models, and dependencies need to be found for
variables irrelevant to the verified property, which results in redundant
computation. To resolve this issue, we propose a Program Dependence Net (PDNet)
based on Petri net theory. It is a unified model that combines a control-flow
structure with dependencies to avoid conversions. For reduction, we present a
PDNet slicing method to capture the relevant variables' dependencies when
needed. PDNet in verifying linear temporal logic and its on-demand slicing can
be used to significantly reduce computation cost. We implement a model-checking
tool based on PDNet and its on-demand slicing, and validate the advantages of
our proposed methods.Comment: 17 pages, 3 figure
- …