A practical algorithm for learning disjunctive abstraction heuristics in static program analysis

A typestate property describes which operations are available on an object or a group of inter-related objects, depending on this object’s or group’s internal state, the typestate. Researchers in the field of static analysis have devised static program analyses to prove the absence of typestate-property violations on all possible executions of a given program under test. Researchers in runtime verification, on the other hand, have developed powerful monitoring approaches that guarantee to capture property violations on actual executions. Although static analysis can greatly benefit runtime monitoring, up until now, most static analyses are incompatible with most monitoring tools. We present Clara, a novel framework that makes these approaches compatible. With Clara, researchers in static analysis can easily implement powerful typestate analyses. Runtime-verification researchers, on the other hand, can use Clara to specialize AspectJ-based runtime monitors to a particular target program. To make aspects compatible to Clara, the monitoring tool annotates them with so-called dependency state machines. Clara uses the static analyses to automatically convert an annotated monitoring aspect into a residual runtime monitor that is triggered by fewer program locations. If the static analysis succeeds on all locations, this proves that the program fulfills the stated typestate properties, making runtime monitoring entirely obsolete. If not, the residual runtime monitor is at least optimized. We instantiated Clara with three static typestate analyses and applied these analyses to monitoring aspects generated from tracematches. In two-thirds of the cases in our experiments, the static analysis succeeds on all locations, proving that the program fulfills the stated properties, and completely obviating the need for runtime monitoring. In the remaining cases, the runtime monitor is often significantly optimized.

Static analysis of multi-staged programs is challenging because the basic assumption of conventional static analysis no longer holds: the program text itself is no longer a fixed static entity, but rather a dynamically constructed value. This article presents a semantic-preserving translation of multi-staged call-by-value programs into unstaged programs and a static analysis framework based on this translation. The translation is semantic-preserving in that every small-step reduction of a multi-staged program is simulated by the evaluation of its unstaged version. Thanks to this translation we can analyze multi-staged programs with existing static analysis techniques that have been developed for conventional unstaged programs: we first apply the unstaging translation, then we apply conventional static analysis to the unstaged version, and finally we cast the analysis results back in terms of the original staged program. Our translation handles staging constructs that have been evolved to be useful in practice (typified in Lisp's quasi-quotation): open code as values, unrestricted operations on references and intentional variable-capturing substitutions. This article omits references for which we refer the reader to our companion technical report.

Dynamic program analysis is extremely successful both in code debugging and in malicious code attacks. Fuzzing, concolic, and monkey testing are instances of the more general problem of analysing programs by dynamically executing their code with selected inputs. While static program analysis has a beautiful and well established theoretical foundation in abstract interpretation, dynamic analysis still lacks such a foundation. In this paper, we introduce a formal model for understanding the notion of precision in dynamic program analysis. It is known that in sound-by-construction static program analysis the precision amounts to completeness. In dynamic analysis, which is inherently unsound, precision boils down to a notion of coverage of execution traces with respect to what the observer (attacker or debugger) can effectively observe about the computation. We introduce a topological characterisation of the notion of coverage relatively to a given (fixed) observation for dynamic program analysis and we show how this coverage can be changed by semantic preserving code transformations. Once again, as well as in the case of static program analysis and abstract interpretation, also for dynamic analysis we can morph the precision of the analysis by transforming the code. In this context, we validate our model on well established code obfuscation and watermarking techniques. We confirm the efficiency of existing methods for preventing control-flow-graph extraction and data exploit by dynamic analysis, including a validation of the potency of fully homomorphic data encodings in code obfuscation.

Static program analyses and transformations for Java face many problems when analyzing programs that use reflection or custom class loaders: How can a static analysis know which reflective calls the program will execute? How can it get hold of classes that the program loads from remote locations or even generates on the fly? And if the analysis transforms classes, how can these classes be re-inserted into a program that uses custom class loaders?

This paper presents the first step of a wider research effort to apply tree automata completion to the static analysis of functional programs. Tree Automata Completion is a family of techniques for computing or approximating the set of terms reachable by a rewriting relation. The completion algorithm we focus on is parameterized by a set \(E\) of equations controlling the precision of the approximation and influencing its termination. For completion to be used as a static analysis, the first step is to guarantee its termination. In this work, we thus give a sufficient condition on \(E\) and \(\mathcal{T(F)}\) for completion algorithm to always terminate. In the particular setting of functional programs, this condition can be relaxed into a condition on \(E\) and \(\mathcal{T(C)}\) (terms built on the set of constructors) that is closer to what is done in the field of static analysis, where abstractions are performed on data.

Static program analysis has many applications including bug checking for large scale code that requires a points-to analysis. To express static program analysis frameworks concisely, it is advantageous to employ a domain-specific language. In the last two decades, Data log has emerged as a domain-specific language for static program analysis. However, existing Data log systems have problems solving large scale code with millions of program variables. This work reports on techniques that translate a Data log program to SQL queries, which are executed on a relational database system. The advantage of a relational database system as an execution platform is the effective use of memory and disks. Further, we can also use an off-the shelf tool to execute the SQL queries. In order to achieve performance, we explore some of the design choices for a source-to-source translation from Data log to SQL that implement stratified negations, totally ordered domains, and comparisons. For each design point, we explain how Data log can be efficiently translated to SQL using the semi-naive evaluation approach. We report the results of our experiments using large data-sets including the OpenJDK7-b147 dataset for points-to, which guided us in the design of our translation schemes.

A novel deep learning-based approach for malware detection

The co-occurrence of multiple code smells in Android applications poses a more serious threat to software maintainability and stability than individual smells. However, most existing studies still concentrate on detecting single types of smells. This study aims to detect prevalent co-occurring Android-specific code smells, Message Chains (MC) and Member Ignoring Method (MIM). We propose an approach that integrates static program analysis with a dynamic stacking ensemble learning method. First, we design a heuristic-based static analysis algorithm for MC smell detection and extend it to identify the co-occurrence of MC and MIM. To support training, an automated sample generation technique, implemented in a tool named Android-specific Smell Detection (ASSD), produces labeled positive and negative samples. Finally, our approach employs a Dynamic Stacking Ensemble with Backward Elimination (DSE-BE), which combines five conventional machine learning models with three deep learning models. The experimental results demonstrate substantial improvements compared with manual detection methods, with the F1 score increasing from 0.774 to 0.938 and the MCC from 0.623 to 0.874. Moreover, the DSE-BE strategy not only outperforms individual models but also reduces ensemble complexity, improving computational efficiency. This method provides a robust solution for detecting co-occurring code smells in Android applications and holds strong potential for practical application.

Programming tools have expanded both in scope of the problems they solve, and in the kinds of techniques they use. Traditionally, programming tools have focused on detecting errors in programs. Recently, this scope has broadened to help with other programming tasks, including inferring specifications, helping diagnose root cause of errors during debugging, and managing knowledge in large projects. Also, traditionally programming tools have been based on either static or dynamic program analysis. Modern programming tools combine static and dynamic program analysis together with techniques from other disciplines such as statistical and probabilistic inference, and information retrieval. This paper reports on some such tools built by the Rigorous Software Engineering group at Microsoft Research India.

Some trade-offs in reducing the overhead of assertion run-time checks via static analysis

The static program analysis is gradually adopting advanced use cases, and integration with programming tools becomes more necessary than ever. However, each integration requires a different kind of functionality implemented within an analyzer. For example, continuous integration tools typically analyze projects from scratch, while doing the same for code querying is not efficient performance-wise. The code behind such use cases makes «service models», and it tends to differ significantly between them. In this paper, we analyze the models which might be used by the static analyzer to provide its services based on aspects of security, performance, long-term storage. All models are assigned to one of the groups: logical presence (where the actual computation is performed), resource acquisition, input/output, change accounting and historic data tracking. The usage recommendations, advantages and disadvantages are listed for each reviewed model. Input/output models are tested for actual network throughput. We also describe the model which might aggregate all these use cases. The model is partially evaluated within the work-in-progress static analyzer Equid, and the observations are presented.

Analyzing links among pages from different mobile apps is an important task of app analysis. Currently, most efforts of analyzing inter-app page links rely on static program analysis, which produces a lot of false positives, requiring significant manual effort to verify the links. To address the issue, in this paper, we propose LinkRadar, a data-driven approach to assisting the analysis of inter-app page links. Our key idea is to use dynamic program analysis to gather a set of actual inter-app page links, based on which we train a model to predict whether there exist links among pages from different apps to help verify the results of static program analysis. The challenge is that inter-app page links are hard to be triggered by dynamic program analysis, making it difficult to collect enough inter-app page links to train the model. Considering the similarity between intra-app page links and inter-app page links, we use transfer learning to deal with the data scarcity problem. Evaluation results show that LinkRadar is able to infer the inter-app page links with high accuracy.

Static program analysis is used to summarize properties over all dynamic\nexecutions. In a unifying approach based on 3-valued logic properties are\neither assigned a definite value or unknown. But in summarizing a set of\nexecutions, a property is more accurately represented as being biased towards\ntrue, or towards false. Compilers use program analysis to determine benefit of\nan optimization. Since benefit (e.g., performance) is justified based on the\ncommon case understanding bias is essential in guiding the compiler.\nFurthermore, successful optimization also relies on understanding the quality\nof the information, i.e. the plausibility of the bias. If the quality of the\nstatic information is too low to form a decision we would like a mechanism that\nimproves dynamically.\n We consider the problem of building such a reasoning framework and present\nthe fuzzy data-flow analysis. Our approach generalize previous work that use\n3-valued logic. We derive fuzzy extensions of data-flow analyses used by the\nlazy code motion optimization and unveil opportunities previous work would not\ndetect due to limited expressiveness. Furthermore we show how the results of\nour analysis can be used in an adaptive classifier that improve as the\napplication executes.\n

KABA is an innovative system for refactoring Java class hierar-chies. It uses the Snelting/Tip algorithm [13] in order to determine a behavior-preserving refactoring which is optimal with respect to a given set of client programs. KABA can be based on dynamic as well as static program analysis. The static variant will preserve program behavior for all possible input values; the dynamic version guarantees preservation of behavior for all runs in a given test suite. KABA offers automatic refactoring as well as manual refactoring using a dedicated editor.

KABA is an innovative system for refactoring Java class hierar-chies. It uses the Snelting/Tip algorithm [13] in order to determine a behavior-preserving refactoring which is optimal with respect to a given set of client programs. KABA can be based on dynamic as well as static program analysis. The static variant will preserve program behavior for all possible input values; the dynamic version guarantees preservation of behavior for all runs in a given test suite. KABA offers automatic refactoring as well as manual refactoring using a dedicated editor. In this contribution, we recapitulate the Snelting/Tip algorithm, present the new dynamic version, and explain new extensions which allow to handle full Java. We then present five case studies which discuss the KABA refactoring proposals for programs such as javac and antlr. KABA proved that javac does not need refactoring, but generated semantics-based refactoring proposals for antlr.