A structure based measurement of software

Interorganisational new service development capability in the mobile communications ecosystem

Many data-driven software engineering tasks such as discovering programming patterns, mining API specifications, etc., perform source code analysis over control flow graphs (CFGs) at scale. Analyzing millions of CFGs can be expensive and performance of the analysis heavily depends on the underlying CFG traversal strategy. State-of-the-art analysis frameworks use a fixed traversal strategy. We argue that a single traversal strategy does not fit all kinds of analyses and CFGs and propose bespoke control flow analysis (BCFA). Given a control flow analysis (CFA) and a large number of CFGs, BCFA selects the most efficient traversal strategy for each CFG. BCFA extracts a set of properties of the CFA by analyzing the code of the CFA and combines it with properties of the CFG, such as branching factor and cyclicity, for selecting the optimal traversal strategy. We have implemented BCFA in Boa, and evaluated BCFA using a set of representative static analyses that mainly involve traversing CFGs and two large datasets containing 287 thousand and 162 million CFGs. Our results show that BCFA can speedup the large scale analyses by 1%-28%. Further, BCFA has low overheads; less than 0.2%, and low misprediction rate; less than 0.01%.

Control-Flow Integrity (CFI) enforces a control-flow graph (CFG) to limit attackers' ability to manipulate runtime control flow. CFI variations, enforcing different CFGs, achieve different degrees of attack surface reduction. To compare the security strength of different CFI policies, measuring the remaining attack surface is critical but challenging. Therefore, we propose MazeRunner, a framework that quantitatively estimates the attack surface of a CFI-hardened program. Methodology-wise, it takes a program's CFG, an attack model, and a security-violation policy as input to discover risky program points by an attack-aware data dependency tracking algorithm. Risky program points and the CFG are used to compute a metric for the remaining attack surface. We evaluate MazeRunner with 3 CFG types, 3 attack models, and 4 security-violation policies against 13 realistic benchmarks, and demonstrate that the new metric achieves higher precision than traditional metrics while maintaining completeness.

Low-level languages like C/C++ are widely used in various applications for their performance and flexibility. Unfortunately, these languages are prone to memory corruption vulnerabilities, leading to control-flow hijacking attacks. Control flow integrity (CFI) is a general principle to enforce run-time control flow of a program to a pre-computed control-flow graph (CFG). While the traditional context-insensitive CFI falls short in protecting critical control transfers, recent context-sensitive CFI research shows promising improvements but has various limitations. We present Control Flow Integrity with Look Back (CFI-LB), a call-site sensitive CFI in which a conventional source-target control transfer is strengthened by a look back into its call-sites (return addresses). CFI-LB features the adaptive call-site sensitivity in which each indirect call has its own level of sensitivity and the multi-scope CFG to improve the security even if a precise context-sensitive static CFG is not available, especially for large programs such as GCC and NGINX. One of the CFGs is constructed by our localized concolic execution, which significantly extends the dynamic CFG with very low false positives. In addition, CFI-LB is the first CFI system explicitly designed to protect its reference monitors from race conditions. We have built a prototype of CFI-LB. The evaluation with SPEC CPU2006 benchmarks and NGINX indicates that CFI-LB has a low-performance overhead (less than 5% on average for the full protection) while increasing the security.

Smart Contracts ensure trust through blockchain technology, streamline processes, and have disruptive potential across various industries. However, the issue of smart contract security cannot be underestimated. The vulnerability of smart contracts to exploitation has led to substantial losses, prompting increased attention toward vulnerability mining. Existing efforts for analyzing contract security heavily depend on inflexible rules set by experts, making them non‐adaptable or scalable. Although various machine‐learning methods have emerged for vulnerability mining in smart contracts, a research gap remains in effectively integrating diverse features of complex smart contracts with deep neural networks for enhanced detection. This paper presents SmartSecure, a vulnerability mining framework incorporating high‐level semantic features extracted from contract source code. It provides in‐depth local insights into vulnerabilities through contract property graphs that integrate abstract syntax trees, control flow graphs, and data dependency graphs, encompassing all syntactic and semantic aspects of the contract function. To fortify these features, we integrate them with low‐level features derived from opcode sequences, encompassing global aspects. These diverse features are seamlessly fused and processed through a novel neural network design, resulting in a robust and effective solution. We evaluate our framework over 25,129 real‐world smart contracts. Extensive experiments demonstrate the superiority of our method over existing tools and neural network‐based approaches. It achieves an exceptional performance level of up to 97.6%, marking a significant step forward in smart contract security.

The real structures of clinotobermorite and tobermorite 9 Å OD character, polytypes, and structural relationships

The software development process often requires the use of tools that the developers did not write themselves, such as a compiler. Additionally, when security researchers perform tasks such as binary analysis and reverse engineering disassembly and decompiler tools may be used which the researchers did not develop themselves. Yet in all of these cases, there is inherent trust placed in the tools that are being used for these tasks without thought to whether or not that trust is valid. In this work, we provide an overview of what has already been done in the realms of verification and establishment of this trust as well as show our contribution to this area. Our approach is taken through an algorithm that allows us to validate or invalidate that trust by comparing the control flow graphs (CFGs) for a piece of source code to the corresponding CFG for the disassembled binary. This is done by putting the source CFG through a series of program functionality preserving transforms that implement different control structure compiler optimizations. Then we are able to make use of a graph isomorphism algorithm to determine whether or not the two CFGs are isomorphic and determine if the trust is valid. We evaluate the effectiveness of this algorithm against the XINU codebase and report our results.

Control flow graph models program execution paths and is essential for program analysis and compiler optimizations. Compilers traverse thousands of graphs during compilation, thus, efficient control flow graph traversal is crucial. Prior work shows that breadth-first and depth-first search algorithms can perform differently depending on the graph structure, but the impact of graph features on the choice of the traversal algorithm remained underexplored. In this paper, we construct a dataset of over 200,000 control flow graphs extracted from modern JVM-based applications and train an ensemble-based machine learning model to predict the optimal graph traversal algorithm using only a set of lightweight graph features. Our model identifies the key features that drive accurate predictions, and we demonstrate that these informative features can be efficiently extracted during control flow graph construction.

We describe the design, generation, and compression of the extended whole program path (eWPP), representation that not only captures the control flow history of a program execution but also its data dependence history. This representation is motivated by the observation that, typically, a significant fraction of data dependence history can be recovered from the control flow trace. To capture the remainder of the data dependence history, we introduce disambiguation checks in the program whose control flow signatures capture the results of the checks. The resulting extended control flow trace enables the recovery of otherwise irrecoverable data dependences. The code for the checks is designed to minimize the increase in program execution time and the extended control flow trace size when compared to directly collecting control flow and address traces. Our experiments show that compressed eWPPs are only one-quarter of the size of combined compressed control flow and address traces. However, their collection incurs a 5× increase in runtime overhead relative to the overhead required for directly collecting the control flow and address traces, respectively.

This paper describes a set of tools for the reengineering of computer-based systems, in particular software. The toolset is based on an abstract intermediate representation (IR) which incorporates the system software architecture at five level of granularity: program level, task level, package/object instance level, subprogram level and statement level. The toolset provides a graphical user interface that allows various views of a software architecture, including call graph, rendezvous graph, call-rendezvous graph, call-data-rendezvous graph, control flow graph and dependence graphs. The information captured by the toolset is useful in software structure, flow and interaction analysis, tasks commonly performed manually during maintenance and reengineering. This information is also helpful for understanding the software design to guide software transformation, and for porting software to distributed platforms.

Whether enjoying the luxury of a bubble bath or enduring the drudgery of washing dishes, one is likely to be struck by the beauty and intricate structure of foams, froths, or ‘‘suds.’’ Keen observers may even notice the unusual elastic and yield properties, not seen in the constituent aqueous and gaseous phases. Scientifically, the interest in and the study of foams have been truly multidisciplinary and have not been confined to chemists, engineers, and physicists. Foams have traditionally inspired mathematicians for their geometric properties and as equilibrium structures in which the surface area is minimized (1). Metallurgists (2) have realized the similarity between foams and polycrystalline metals, both in their structure and coarsening behavior (grain growth). Similarly, botanists and life scientists in general have noticed strong structural parallels between foams and living tissues (3). Gas–liquid foams are abundant in nature and their technological applications are numerous. They are used to advantage in fire fighting, enhanced oil recovery, foods (e.g., whipped cream), cosmetics (e.g., shaving cream), and in many other ways. The ‘‘world of foams’’ may be considerably expanded by the realization that concentrated liquid–liquid emulsions, although generally characterized by a much smaller mean size of the dispersed units, are structurally identical to gas–liquid foams, which is readily revealed under the microscope. Macroscopically, they behave like

The brain is probably the most complex system of the human body, composed of numerous neural units interconnected at dierent scales. This highly structured architecture provides the ability to communicate, synthesize information and perform the analytical tasks of human beings. Its development starts during the transition between the embryonic and fetal periods, from a simple tubular to a highly complex folded structure. It is globally organized as early as birth. This developing process is highly vulnerable to antenatal adverse conditions. Indeed, extreme prematurity and intra uterine growth restriction are major risk factors for long-term morbidities, including developmental ailments such as cerebral palsy, mental retardation and a wide spectrum of learning disabilities and behavior disorders. In this context, the characterization of the brainâ s normative wiring pattern is crucial for our understanding of its architecture and workings, as the origin of many neurological and neurobehavioral disorders is found in early structural brain development. Diusion magnetic resonance imaging (dMRI) allows the in vivo assessment of biological tissues at the microstructural level. It has emerged as a powerful tool to study brain connectivity and analyse the underlying substrate of the human brain, comprising its structurally integrated and functionally specialized architecture. dMRI has been widely used in adult studies. Nevertheless, due to technical constraints, this mapping at earlier stages of development has not yet been accomplished. Yet, this time period is of extreme importance to comprehend the structural and functional integrity of the brain. This thesis is motivated by this shortfall, and intends to fill the gap between the clinical and neuroscience demands and the methodological developments needed to fulfill them. In our work, we comprehensibly study the brain structural connectivity of children born extremely prematurely and/or with additional prenatal restriction at school-age. We provide evidence that brain systems that mature early in development are the most vulnerable to antenatal insults. Interestingly, the alterations highlighted in these systems correlate with the neurobehavioral and cognitive impairments seen in these children at school-age. The overall brain organization appear also altered after preterm birth and prenatal restriction. Indeed, these children show dierent brain network modular topology, with a reduction in the overall network capacity. What remains unclear is whether the alterations seen at school age are already present at birth and, if yes, to what extent. In this thesis we set the technical basis to enable the connectome analysis as early as at birth. This task is challenging when dealing with neonatal data. Indeed, most of the assumptions used in adult data processing methods do not hold, due to the inverted image contrast and other MRI artefacts such as motion, partial volume and intensity inhomogeneities. Here, we propose a novel technique for surface reconstruction, and provide a fully-automatic procedure to delineate the newborn cortical surface, opening the way to establish the newborn connectome.

Effective representation methods and proper signal priors are crucial in most signal processing applications. In this thesis we focus on different structured models and we design appropriate schemes that allow the discovery of low dimensional latent structures that characterise and identify the signals. Motivated by the highly non-linear structure of most datasets, we firstly investigate the geometry of manifolds. Manifolds are low dimensional, non-linear structures that are naturally employed to describe sets of strongly related signals such as the images of a 3-D object captured from different viewpoints. However, the use of manifolds in applications is not straightforward due to their usually non-analytic and non-linear form. We propose here a way to `disassemble' a manifold into simpler components by approximating it with affine subspaces. Our objective is to discover a set of low dimensional affine subspaces that can represent manifold data accurately while preserving the manifold's structure. To this end, we employ a greedy technique that iteratively merges manifold samples into groups based on the difference of local tangents. We use our algorithm to approximate synthetic and real manifolds and to demonstrate that it is competitive to state-of-the-art techniques. Then, we consider structured sparse representations of signals and we propose a new sparsity model, where signals are essentially composed of a small number of structured {\it molecules }. We define the molecules to be linear combinations of a small number of atoms in a redundant dictionary. Our multi-level model takes into account the energy distribution of the significant signal components in addition to their support. It permits to define typical visual patterns and recognise them in prototypical or deformed form. We define a new structural difference measure between molecules and their deformed versions, which is based on their sparse codes and we create an algorithm for decomposing signals into molecules that can account for different deviations in the internal molecule structure. Our experiments verify the benefits of the new image model in various restoration tasks and they confirm that the development of proper models that extend the mere notion of sparsity can be very useful for various inverse problems in imaging. Finally, we investigate the problem of learning molecule representations directly in the sparse code domain. We constrain sparse codes to be linear combinations of a few, possibly deformed, molecules and we design an algorithm that can learn the structure from the codes without transforming them back into the signal domain. To this end, we take advantage of our structural difference which is based on the sparse codes and we devise a scheme for representing the codes with molecules and learn the molecules at the same time. To illustrate the effectiveness of our proposed algorithm we apply it to various synthetic and real datasets and we compare the results with traditional sparse coding and dictionary learning techniques. From the experiments, we verify the superior performance of our scheme in interpreting and recognising correctly the underlying structure. In short, in this thesis we are interested in low-dimensional, structured models. Among the various choices, we focus on manifolds and sparse representations and we propose schemes that enhance their structural properties and highlight their effectiveness in signal representations.

Side-channels in software are an increasingly significant threat to the confidentiality of private user information, and the static detection of such vulnerabilities is a key challenge in secure software development. In this paper, we introduce a new technique for scalable detection of side- channels in software. Given a program and a cost model for a side-channel (such as time or memory usage), we decompose the control flow graph of the program into nested branch and loop components, and compositionally assign a symbolic cost expression to each component. Symbolic cost expressions provide an over-approximation of all possible observable cost values that components can generate. Queries to a satisfiability solver on the difference between possible cost values of a component allow us to detect the presence of imbalanced paths (with respect to observable cost) through the control flow graph. When combined with taint analysis that identifies conditional statements that depend on secret information, our technique answers the following question: Does there exist a pair of paths in the program's control flow graph, differing only on branch conditions influenced by the secret, that differ in observable side-channel value by more than some given threshold? Additional optimization queries allow us to identify the minimal number of loop iterations necessary for the above to hold or the maximal cost difference between paths in the graph. We perform symbolic execution based feasibility analyses to eliminate control flow paths that are infeasible. We implemented our techniques in a prototype, and we demonstrate its favourable performance against state-of-the-art tools as well as its effectiveness and scalability on a set of sizable, realistic Java server-client and peer-to-peer applications.

Assessing the understandability of source code remains an elusive yet highly desirable goal for software developers and their managers. While many metrics have been suggested and investigated empirically, the McCabe cyclomatic complexity metric (CC) - which is based on control flow complexity - seems to hold enduring fascination within both industry and the research community despite its known limitations. In this work, we introduce the ideas of Control Flow Patterns (CFPs) and Compressed Control Flow Patterns (CCFPs), which eliminate some repetitive structure from control flow graphs in order to emphasize high-entropy graphs. We examine eight well-known open source Java systems by grouping the CFPs of the methods into equivalence classes, and exploring the results. We observed several surprising outcomes: first, the number of unique CFPs is relatively low, second, CC often does not accurately reflect the intricacies of Java control flow, and third, methods with high CC often have very low entropy, suggesting that they may be relatively easy to understand. These findings challenge the widely-held belief that there is a clear-cut causal relationship between CC and understandability, and suggest that CC and similar measures need to be reconsidered as metrics for code understandability.