A Useful Bounded Resource Functional Language

Malware classification plays an important role in tracing the attack sources of computer security. However, existing static analysis methods are fast in classification, but they are inefficient in some malware using packing and obfuscation techniques; the dynamic analysis methods have better universality for packing and obfuscation, but they will cause excessive classification cost. To overcome these shortcomings, in this paper, we propose a classification system Malscore based on the probability scoring and machine learning, which sets the probability threshold to concatenate static analysis (called Phase 1) and dynamic analysis (called Phase 2). The convolutional neural networks with spatial pyramid pooling were used to analyze the grayscale images (static features) in Phase 1, and the variable n-grams and machine learning were used to analyze the native API call sequences (dynamic features) in Phase 2. Malscore combined static analysis with dynamic analysis not only accelerated the static analysis process by taking advantage of the CNN in image recognition but also appeared to be more resilient to obfuscation by the dynamic analysis. Different from other static and dynamic analysis techniques, when malware is detected, due to the fact that malware will most likely be labeled only by static analysis, we could reduce the overheads by dynamically analyzing a few malware that has less obvious features or greater confusion in static analysis. We performed experiments on 174607 malware samples from 63 malware families. The result showed that Malscore achieved 98.82% accuracy for malware classification. Furthermore, Malscore was compared with the method of using static and dynamic analysis. The preprocessing and test time represented a reduction of 59.58% and 61.70%, respectively.

Static and dynamic program analysis techniques are important research areas in software security. Static analysis helps us locate vulnerabilities in a software by looking at the source code. Dynamic analysis helps us reason about the behavior of the software from information gathered at run-time. In this thesis, we are focusing on data flow analysis and heap analysis which are key static and dynamic program analysis techniques respectively.
\n
\nIn the first part of this thesis, we aim at detecting vulnerabilities in Android applications which have capability leaks. The security of the Android platform relies mainly on sandboxing applications and restricting their capabilities such that no application, by default, can perform any operations that would adversely impact other applications, the operating system, or the user. However, a recent research reported that a genuine but vulnerable application may leak its capabilities. When being leveraged, other applications can gain extra capabilities which they are not granted originally. We present DroidChecker, an Android application analyzing tool which searches for the aforementioned vulnerability in Android applications. DroidChecker uses interprocedural control flow graph searching and static taint checking to detect exploitable data paths in an Android application. We analyzed more than 1100 Android applications using DroidChecker and found 6 previously unknown vulnerable applications including the renowned Adobe Photoshop Express application. We also developed a malicious application that exploits the previously unknown vulnerability found in the Adobe Photoshop Express application. We showed that the malicious application, which is not granted any permissions, can access contacts on the phone with just a few lines of code.
\n
\nIn the second part of this thesis, we explore the use of heap analysis to extract software birthmarks. There are techniques like code obfuscation and watermarking which can make the source code of a program difficult to understand by humans and prove the ownership of the program. However, code obfuscation cannot avoid the source code being copied and a watermark can be defaced. A birthmark is a group of unique characteristics a program possesses that can be used to identify the program. We propose two novel dynamic birthmark systems based on the run-time heap. A dynamic birthmark is one that is extracted when the program is executing. Since it is based on the run-time behavior of the program, semantics-preserving transformations of the code like obfuscation cannot defeat dynamic birthmarks. In this regard, dynamic birthmarks are more robust compared with static birthmarks.
\n
\nTo the best of our knowledge, these are the first birthmark systems using heap analysis as the underlying technique. The basic idea is to take snapshots of the heap while the program is running. From the snapshots, heap graphs are constructed to model the referencing structure between objects. After going through some filtering and referencing processes, they become the birthmarks. The two birthmark systems have been devised to extract birthmarks for Java programs and JavaScript programs respectively. While the underlying ideas of the two birthmark systems are similar, the differences in nature of the two programming languages led to different implementation designs.

Despite their rapid growth, the utilisation of application programming interfaces (APIs) poses challenges for companies under pressure to yield productive systems integration. APIs of larger systems tend to be large, complex and have reduced modularity and quality, which makes them cumbersome to comprehend and use. These challenges can be addressed by static API analysis that focuses on studying API code itself and deriving business entities and dependencies from operational signatures. However, existing techniques for static analysis of APIs face the challenges in deriving a sufficient coverage of business entity relationship types from implementation-oriented API operational signatures carrying limited semantic insights. The paper aims to address such problems by supporting static analysis techniques for APIs that improve their modularity. Our approach adopts an object-oriented paradigm where the concept of “object” is exemplified by the notion of business entity. It systematically applies interface analysis methods and techniques for eliciting knowledge of business entities and their attributes, for deriving the temporal order of calling operations across multiple business entities, and for learning and extracting various ways of invoking a service via APIs. The approach is implemented as an open-source tool and applied to a group of widely-deployed services in practice for validation. The research contributes to identifying key aspects of both the structure and behaviour of APIs, which will lead to building a simplified but comprehensive interface (presentation) layer to assist service users in understanding complex and overloaded interfaces as well as to facilitate efficient and effective service integration.

The past decade has witnessed an explosive increase in the scale, intensity and sophistication of cyber attacks. While software vendors have significantly increased their efforts on security, they are almost always playing catch up. As a result, security-conscious organizations and individuals have come to expect their system administrators to deploy an array of tools and techniques to stay a step ahead of the hackers. While developer-oriented security tools rely mainly on static analysis, runtime analysis and policy enforcement are the mechanisms of choice in administrator-oriented tools. Runtime techniques offer increased automation and precision over static analysis, thus addressing the needs of administrators who don't have the time or resources needed to acquire extensive knowledge about the internals of a software system. In this talk, I will begin by summarizing some of the significant advances that have been achieved in the past few years in the context of software vulnerability mitigation, including buffer overflow defenses, and more recently, the impressive results that have been achieved using dynamic information-flow analysis for blocking the most popular exploits today, including SQL and command injection and cross-site scripting. I will then proceed to describe dynamic analysis and enforcement techniques aimed at another high-profile security problem faced today, namely, malware defense. Our initial target in this regard has been on dynamic analysis techniques for extracting high-level models of program behavior. These models could be used in a variety of applications such as intrusion detection, vulnerability analysis and security policy verification. More recently, interesting advances have been made in the context of security policy development, where a combination of static and dynamic analysis techniques have been developed to synthesize low-level, enforceable policies that achieve a high-level goal such as protecting system integrity. Finally, I will conclude the talk with a discussion of some research opportunities and challenges in software security.

Some trade-offs in reducing the overhead of assertion run-time checks via static analysis

Using static analysis techniques compilers for lazy functional languages can be used to identify parts of a program that can be legitimately evaluated in parallel and ensure that those expressions are executed concurrently with the main thread of execution. These techniques can produce improvements in the runtime performance of a program, but are limited by the static analyses’ poor prediction of runtime performance. This paper outlines the development of a system that uses iterative profile-directed improvement in addition to well-studied static analysis techniques. This allows us to achieve higher performance gains than through static analysis alone.

Functional programming languages are well-suited for developing compilers, and compilers for functional languages are often themselves written in a functional language. Functional abstractions, such as monads, allow abstracting away some of the repetitive structure of a compiler, removing boilerplate code and making extensions simpler. Even so, functional languages are rarely used to implement compilers for languages of other paradigms.

Exception handling is a key feature in modern programming languages. Exceptions can be used to deal with errors, or as a means to control the flow of execution of a program. Since they might unexpectedly terminate a program, unhandled exceptions are a serious safety concern. We propose a static analysis to detect uncaught exceptions in functional programs, that is defined as an abstract interpreter. It computes a description of the values potentially returned by a program using a novel abstract domain, that can express inductively defined sets of values. Simultaneously, the analysis infers the possibly raised exceptions, by computing in theabstract exception monad. This abstract interpreter has been implemented as an effective static analyser for a large subset of programs, that supports mutable data types, the module system, and dynamically extensible data types such as the exception type. The analyser has been evaluated on several hundreds of programs.

The increasing popularity of dynamically-typed programming languages, such as JavaScript or Python, requires specific support methods for developers to avoid pitfalls arising from the dynamic nature of these languages. Static analyses are frequently used but the dynamic type systems limit their applicability. Dynamic analyses, in contrast, depend on the execution of the code under analysis, and thus depend on the quality of existing tests. This quality of the test suite can be improved by the use of automated test generation but automated test generation for dynamically-typed programming languages itself is hard due to the lack of type information in the programs. The limitations of each of these approaches will be overcome by iteratively combining test generation with static and dynamic analysis techniques for dynamically-typed programs.

Spazio IT has been working on the Independent Software Verification and Validation of several codebases, some written in Ada, others in C/C++ and more recently also in Python; in all cases Spazio IT has used static analysis techniques and tools facilitating code inspection. Static analysis has always proven to be beneficial, but depending on the programming language, its advantages have emerged in different areas and namely: metrics and structural analysis for Ada, bugs finding at execution/semantic level for C/C++ and errors finding at compilation/syntactical level for Python. The paper presents first some general considerations on static analysis, then it concentrates on static analysis specifically applied to Ada, C/C++ and Python codebases. Finally, the paper describes Spazio IT future activities in the area of static analysis.

Spazio IT has been working on the Independent Software Verification and Validation of several codebases, some written in Ada, others in C/C++ and more recently also in Python; in all cases Spazio IT has used static analysis techniques and tools facilitating code inspection. Static analysis has always proven to be beneficial, but depending on the programming language, its advantages have emerged in different areas and namely: metrics and structural analysis for Ada, bugs finding at execution/semantic level for C/C++ and errors finding at compilation/syntactical level for Python. The paper presents first some general considerations on static analysis, then it concentrates on static analysis specifically applied to Ada, C/C++ and Python codebases. Finally, the paper describes Spazio IT future activities in the area of static analysis.

The rapid growing in electrical load, and increasing the dependency on renewable energy recourses; highly affect the Jordanian power system stability and operation. This paper presents a static voltage stability analysis for the northern part of the Jordanian grid. The main purpose of this study is finding out the domain of the system from facing voltage instability conditions. In order to analyze voltage stability of the study system, static analysis techniques such as P-V curve and Q-V curve methods are applied. The DIgSILENT PowerFactory® program is used in this study to obtain the results.

The efficient implementation of functional logic languages relies on finding (if it exists) an optimal evaluation order for the arguments of functions. The problems of finding the best evaluation order, and the sequentiality of program rules are both difficult and can benefit from using static analysis techniques. The second problem is of special interest because the parallel evaluation of arguments is out of the question due to the possibility of backtracking and sharing of free logical variables among different arguments. However, the lack of sequentiality is often syntactic rather than semantic. In this paper we show that an adequate use of type information and strictness analysis can help a compiler to (i) derive an efficient evaluation order, and (ii) generate sequential code from most programs. Data structures (new versions of definitional trees) are introduced to take advantage of this kind of information and manage run time tests when the computation cannot be made sequential at compile time.

The two broad approaches to discover properties of programs---static and dynamic analyses---have complementary strengths: static techniques perform exhaustive exploration and prove upper bounds on program behaviors, while the dynamic analysis of test cases provides concrete evidence of these behaviors and promise low false alarm rates. In this paper, we present DynaBoost, a system which uses information obtained from test executions to prioritize the alarms of a static analyzer. We instrument the program to dynamically look for dataflow behaviors predicted by the static analyzer, and use these results to bootstrap a probabilistic alarm ranking system, where the user repeatedly inspects the alarm judged most likely to be a real bug, and where the system re-ranks the remaining alarms in response to user feedback. The combined system is able to exploit information that cannot be easily provided by users, and provides significant improvements in the human alarm inspection burden: by 35% compared to the baseline ranking system, and by 89% compared to an unaided programmer triaging alarm reports.

Static analysis of multi-staged programs is challenging because the basic assumption of conventional static analysis no longer holds: the program text itself is no longer a fixed static entity, but rather a dynamically constructed value. This article presents a semantic-preserving translation of multi-staged call-by-value programs into unstaged programs and a static analysis framework based on this translation. The translation is semantic-preserving in that every small-step reduction of a multi-staged program is simulated by the evaluation of its unstaged version. Thanks to this translation we can analyze multi-staged programs with existing static analysis techniques that have been developed for conventional unstaged programs: we first apply the unstaging translation, then we apply conventional static analysis to the unstaged version, and finally we cast the analysis results back in terms of the original staged program. Our translation handles staging constructs that have been evolved to be useful in practice (typified in Lisp's quasi-quotation): open code as values, unrestricted operations on references and intentional variable-capturing substitutions. This article omits references for which we refer the reader to our companion technical report.