45,810 research outputs found
A Metric Encoding for Bounded Model Checking (extended version)
In Bounded Model Checking both the system model and the checked property are
translated into a Boolean formula to be analyzed by a SAT-solver. We introduce
a new encoding technique which is particularly optimized for managing
quantitative future and past metric temporal operators, typically found in
properties of hard real time systems. The encoding is simple and intuitive in
principle, but it is made more complex by the presence, typical of the Bounded
Model Checking technique, of backward and forward loops used to represent an
ultimately periodic infinite domain by a finite structure. We report and
comment on the new encoding technique and on an extensive set of experiments
carried out to assess its feasibility and effectiveness
Efficient Symmetry Reduction and the Use of State Symmetries for Symbolic Model Checking
One technique to reduce the state-space explosion problem in temporal logic
model checking is symmetry reduction. The combination of symmetry reduction and
symbolic model checking by using BDDs suffered a long time from the
prohibitively large BDD for the orbit relation. Dynamic symmetry reduction
calculates representatives of equivalence classes of states dynamically and
thus avoids the construction of the orbit relation. In this paper, we present a
new efficient model checking algorithm based on dynamic symmetry reduction. Our
experiments show that the algorithm is very fast and allows the verification of
larger systems. We additionally implemented the use of state symmetries for
symbolic symmetry reduction. To our knowledge we are the first who investigated
state symmetries in combination with BDD based symbolic model checking
A Survey of Symbolic Execution Techniques
Many security and software testing applications require checking whether
certain properties of a program hold for any possible usage scenario. For
instance, a tool for identifying software vulnerabilities may need to rule out
the existence of any backdoor to bypass a program's authentication. One
approach would be to test the program using different, possibly random inputs.
As the backdoor may only be hit for very specific program workloads, automated
exploration of the space of possible inputs is of the essence. Symbolic
execution provides an elegant solution to the problem, by systematically
exploring many possible execution paths at the same time without necessarily
requiring concrete inputs. Rather than taking on fully specified input values,
the technique abstractly represents them as symbols, resorting to constraint
solvers to construct actual instances that would cause property violations.
Symbolic execution has been incubated in dozens of tools developed over the
last four decades, leading to major practical breakthroughs in a number of
prominent software reliability applications. The goal of this survey is to
provide an overview of the main ideas, challenges, and solutions developed in
the area, distilling them for a broad audience.
The present survey has been accepted for publication at ACM Computing
Surveys. If you are considering citing this survey, we would appreciate if you
could use the following BibTeX entry: http://goo.gl/Hf5FvcComment: This is the authors pre-print copy. If you are considering citing
this survey, we would appreciate if you could use the following BibTeX entry:
http://goo.gl/Hf5Fv
Efficient Synthesis of Network Updates
Software-defined networking (SDN) is revolutionizing the networking industry,
but current SDN programming platforms do not provide automated mechanisms for
updating global configurations on the fly. Implementing updates by hand is
challenging for SDN programmers because networks are distributed systems with
hundreds or thousands of interacting nodes. Even if initial and final
configurations are correct, naively updating individual nodes can lead to
incorrect transient behaviors, including loops, black holes, and access control
violations. This paper presents an approach for automatically synthesizing
updates that are guaranteed to preserve specified properties. We formalize
network updates as a distributed programming problem and develop a synthesis
algorithm based on counterexample-guided search and incremental model checking.
We describe a prototype implementation, and present results from experiments on
real-world topologies and properties demonstrating that our tool scales to
updates involving over one-thousand nodes
Transient Reward Approximation for Continuous-Time Markov Chains
We are interested in the analysis of very large continuous-time Markov chains
(CTMCs) with many distinct rates. Such models arise naturally in the context of
reliability analysis, e.g., of computer network performability analysis, of
power grids, of computer virus vulnerability, and in the study of crowd
dynamics. We use abstraction techniques together with novel algorithms for the
computation of bounds on the expected final and accumulated rewards in
continuous-time Markov decision processes (CTMDPs). These ingredients are
combined in a partly symbolic and partly explicit (symblicit) analysis
approach. In particular, we circumvent the use of multi-terminal decision
diagrams, because the latter do not work well if facing a large number of
different rates. We demonstrate the practical applicability and efficiency of
the approach on two case studies.Comment: Accepted for publication in IEEE Transactions on Reliabilit
- …