An empirical comparison of dynamic impact analysis algorithms

Dynamic impact analysis based on program executions has shown promise in aiding tasks in the life cycle of large-scale systems. Dynamic impact analysis techniques have shown to produce more precise results than static impact analysis [1]. However, current dynamic impact analysis techniques lack important features such as analysis of dependency among program entities and consideration of object-oriented programs ' features. Thus they may produce imprecise results. In this paper, we present a precise dynamic impact analysis approach for object-oriented programs. This approach considers the characteristics of object- oriented programs and performs dependency analysis which may potentially reduce the impact sets by eliminating elements that do not have dependency on the changed elements. Even though our discussion in this paper is based on Java <sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">TM</sup> programming language, this approach can be carried out in a language independent manner for broader applications.

Assessing the similarity between code components plays a pivotal role in a number of Software Engineering (SE) tasks, such as clone detection, impact analysis, refactoring, etc. Code similarity is generally measured by relying on manually defined or hand-crafted features, e.g., by analyzing the overlap among identifiers or comparing the Abstract Syntax Trees of two code components. These features represent a best guess at what SE researchers can utilize to exploit and reliably assess code similarity for a given task. Recent work has shown, when using a stream of identifiers to represent the code, that Deep Learning (DL) can effectively replace manual feature engineering for the task of clone detection. However, source code can be represented at different levels of abstraction: identifiers, Abstract Syntax Trees, Control Flow Graphs, and Bytecode. We conjecture that each code representation can provide a different, yet orthogonal view of the same code fragment, thus, enabling a more reliable detection of similarities in code. In this paper, we demonstrate how SE tasks can benefit from a DL-based approach, which can automatically learn code similarities from different representations.

The past decade has witnessed an explosive increase in the scale, intensity and sophistication of cyber attacks. While software vendors have significantly increased their efforts on security, they are almost always playing catch up. As a result, security-conscious organizations and individuals have come to expect their system administrators to deploy an array of tools and techniques to stay a step ahead of the hackers. While developer-oriented security tools rely mainly on static analysis, runtime analysis and policy enforcement are the mechanisms of choice in administrator-oriented tools. Runtime techniques offer increased automation and precision over static analysis, thus addressing the needs of administrators who don't have the time or resources needed to acquire extensive knowledge about the internals of a software system. In this talk, I will begin by summarizing some of the significant advances that have been achieved in the past few years in the context of software vulnerability mitigation, including buffer overflow defenses, and more recently, the impressive results that have been achieved using dynamic information-flow analysis for blocking the most popular exploits today, including SQL and command injection and cross-site scripting. I will then proceed to describe dynamic analysis and enforcement techniques aimed at another high-profile security problem faced today, namely, malware defense. Our initial target in this regard has been on dynamic analysis techniques for extracting high-level models of program behavior. These models could be used in a variety of applications such as intrusion detection, vulnerability analysis and security policy verification. More recently, interesting advances have been made in the context of security policy development, where a combination of static and dynamic analysis techniques have been developed to synthesize low-level, enforceable policies that achieve a high-level goal such as protecting system integrity. Finally, I will conclude the talk with a discussion of some research opportunities and challenges in software security.

Accepting too many software change requests could contribute to expense and delay in project delivery. On the other hand rejecting the changes may increase customer dissatisfaction. Software project management might use a reliable estimation on potential impacted artifacts to decide whether to accept or reject the changes. In software development phase, an assumption that all classes in the class artifact are completely developed is impractical compared to software maintenance phase. This is due to some classes in the class artifact are still under development or partially developed. This paper is a continuous effort from our previous work on combining between static and dynamic analysis techniques for impact analysis. We have converted the approach to an automated tool and call it a CIAT (Change Impact Analysis Tool). The significant achievements of the tool are demonstrated through an extensive experimental validation using several case studies. The experimental analysis shows improvement in the accuracy over current impact analysis results.

Any change to one component of a software system is likely to be felt in other components, a phenomenon known as ‘ripple effect’. Impact analysis is the process of identifying all those components of a system which may be affected by ripple effect. This requires a knowledge of the dependencies between components. A software system consists not only of the source code, but also of all life cycle work products including requirements, design and test documents. Any of these components may be the subject of a change request, and should therefore be included in impact analysis. The ripple propagation graph (RPG) for impact analysis, developed as part of the AMES (Application Management Environments and Support) project, models an application in such a way that dependencies can be traced in order to identify all affected components. It is an object-relationship model consisting of the components of a system at some level of granularity, and the various relationships between them. This paper describes the AMES RPG, and how the results of the application understanding (AU) toolset, developed (again as part of the AMES project) to support the process of gaining an understanding of an application, can be used to provide some of the data required to populate the RPG. © 1998 John Wiley & Sons, Ltd.

Impact analysis determines the effects that program entities of interest, or changes to them, may have on the rest of the program for software measurement, maintenance, and evolution tasks. Dynamic impact analysis could be one major approach to impact analysis that computes smaller impact setsthan static alternatives for concrete sets of executions. However, existing dynamic approaches often produce impact sets that are too large to be useful, hindering their adoption in practice. To address this problem, we propose to exploit static program dependencies to drastically prune false-positive impacts that are not exercised by the set of executions utilized by the analysis, via hybrid dependence approximation. Further, we present a novel dynamic impact analysis called Diver which leverages both the information provided by the dependence graph and method-execution events to identify runtimemethod-level dependencies, hence dynamic impact sets, much more precisely without reducing safety and at acceptable costs. We evaluate Diver on ten Java subjects of various sizes and application domains against both arbitrary queries covering entire programs and practical queries based on changes actually committed by developers to actively evolving software repositories. Our extensive empirical studies show that Diver can significantly improve the precision of impact prediction, with 100-186 percent increase, with respect to a representative existing alternative thus provide a far more effective option for dynamic impact prediction. Following a similar rationale to Diver, we further developed and evaluated an online dynamic impact analysis called DiverOnline which produces impact sets immediately upon the termination of program execution. Our results show that compared to the offline approach, for the same precision, the online approach can reduce the time by 50 percent on average for answering all possible queries in the given program at once albeit at the price of possibly significant increase in runtime overhead. For users interested in one specific query only, the online approach may compute the impact set for that query during runtime without much slowing down normal program operation. Further, the online analysis, which does not incur any space cost beyond the static-analysis phase, may be favored against the offline approach when trace storage and/or related file-system resource consumption becomes a serious challenge or even stopper for adopting dynamic impact prediction. Therefore, the online and offline analysis together offer complementary options to practitioners accommodating varied application/task scenarios and diverse budget constraints.

Reverse engineering aims at obtaining high-level representations of software systems from existing low-level artifacts, such as binaries, source code, execution traces or historical information. Reverse engineering methods and technologies play an important role in many software engineering tasks and quite often are the only way to get an understanding of large and complex software systems. Given for example the task to understand certain aspects of the test code in large software systems, such as Eclipse. How would you figure out the answers to the following questions:

An improving approach to analyzing change impact of C programs

Static and dynamic program analysis techniques are important research areas in software security. Static analysis helps us locate vulnerabilities in a software by looking at the source code. Dynamic analysis helps us reason about the behavior of the software from information gathered at run-time. In this thesis, we are focusing on data flow analysis and heap analysis which are key static and dynamic program analysis techniques respectively.&#13;\n&#13;\nIn the first part of this thesis, we aim at detecting vulnerabilities in Android applications which have capability leaks. The security of the Android platform relies mainly on sandboxing applications and restricting their capabilities such that no application, by default, can perform any operations that would adversely impact other applications, the operating system, or the user. However, a recent research reported that a genuine but vulnerable application may leak its capabilities. When being leveraged, other applications can gain extra capabilities which they are not granted originally. We present DroidChecker, an Android application analyzing tool which searches for the aforementioned vulnerability in Android applications. DroidChecker uses interprocedural control flow graph searching and static taint checking to detect exploitable data paths in an Android application. We analyzed more than 1100 Android applications using DroidChecker and found 6 previously unknown vulnerable applications including the renowned Adobe Photoshop Express application. We also developed a malicious application that exploits the previously unknown vulnerability found in the Adobe Photoshop Express application. We showed that the malicious application, which is not granted any permissions, can access contacts on the phone with just a few lines of code.&#13;\n&#13;\nIn the second part of this thesis, we explore the use of heap analysis to extract software birthmarks. There are techniques like code obfuscation and watermarking which can make the source code of a program difficult to understand by humans and prove the ownership of the program. However, code obfuscation cannot avoid the source code being copied and a watermark can be defaced. A birthmark is a group of unique characteristics a program possesses that can be used to identify the program. We propose two novel dynamic birthmark systems based on the run-time heap. A dynamic birthmark is one that is extracted when the program is executing. Since it is based on the run-time behavior of the program, semantics-preserving transformations of the code like obfuscation cannot defeat dynamic birthmarks. In this regard, dynamic birthmarks are more robust compared with static birthmarks.&#13;\n&#13;\nTo the best of our knowledge, these are the first birthmark systems using heap analysis as the underlying technique. The basic idea is to take snapshots of the heap while the program is running. From the snapshots, heap graphs are constructed to model the referencing structure between objects. After going through some filtering and referencing processes, they become the birthmarks. The two birthmark systems have been devised to extract birthmarks for Java programs and JavaScript programs respectively. While the underlying ideas of the two birthmark systems are similar, the differences in nature of the two programming languages led to different implementation designs.

Approaches that support software maintenance need to be evaluated and compared against existing ones, in order to demonstrate their usefulness in practice. However, oftentimes the lack of well-established sets of benchmarks leads to situations where these approaches are evaluated using different datasets, which results in biased comparisons. In this data paper we describe and make publicly available a set of benchmarks from six Java applications, which can be used in the evaluation of various software engineering (SE) tasks, such as feature location and impact analysis. These datasets consist of textual description of change requests, the locations in the source code where they were implemented, and execution traces. Four of the benchmarks were already used in several SE research papers, and two of them are new. In addition, we describe in detail the methodology used for generating these benchmarks and provide a suite of tools in order to encourage other researchers to validate our datasets and generate new benchmarks for other subject software systems. Our online appendix: http://www.cs.wm.edu/semeru/data/msr13/.

Dynamic analysis techniques reason over program executions and deal with data produced at program execution time. Dynamic analysis and static analysis techniques complement each other. Hence, a key focus of the workshop is dynamic analysis of software systems with an emphasis on research that integrates static and dynamic analyses.

As the overheads for ensuring the correctness of electronic designs continue to increase with continued technology scaling and increased variability, better-than-worst-case (BTWC) design has gained significant attention. Many BTWC design techniques utilize dynamic timing and activity information for design analysis and optimization. These techniques rely on path-based analysis that enumerates the exercised paths in a design as targets for analysis and optimization. However, path-based dynamic analysis techniques are not scalable and cannot be used to analyze full processors and full applications. On the other hand, graph-based techniques like those that form the foundational building blocks of electronic design automation tools are scalable and can efficiently analyze large designs. In this paper, we extend graph-based analysis to provide the fundamental dynamic analysis tools necessary for BTWC design, analysis, and optimization. Specifically, we present scalable graph-based techniques to report the N-worst exercised paths in a design for three metrics — timing criticality (slack), activity (toggle count), and activity subject to delay constraints. Compared to existing path-based techniques, our scalable dynamic analysis techniques improve average performance by 977 x, 163 x, and 113 x, respectively, and enable scalable analysis for a full processor design running full applications.

The hanging net shielding system, employing a suspended cage-type enclosed structure to restrict the high-voltage transmission wire, has seen increasingly widespread application in transmission line crossing construction. However, the lack of a comprehensive dynamic analysis methodology has limited the standardization of its design and usage. In this investigation, a systematical dynamic modeling and analysis procedure of the hanging net shielding system is proposed based on the absolute nodal coordinate formulation (ANCF). The carrier cable, slings and transmission wire are discretized by the ANCF cable element. The spatial flexible beam–beam contact model and the assumption of a single contact area are adopted to perform the contact searching between the transmission wire and the horizontal pulley. The system dynamics analysis equation is assembled and solved by generalized alpha method. A full-scale model is simulated for the transmission wire impact condition and the variation history of the tension in carrier cable and the sling cable are given. The peak value of the tension in carrier cable could be 110 kN, while the largest tension in sling cable is 9 kN. Results could help to ensure construction safety, shorten the design cycle of the protection system and reduce the development cost at the same time.

Software specifications are the foundation of many software development activities including maintenance, testing, and verification. However, specifications are rarely available for real systems. This dissertation describes a dynamic analysis technique to automatically infer program specifications. We focus on temporal specifications, an important category of specifications that constrain the order of occurrence of events. Our technique generates execution traces of the program by running a set of test cases and then analyzes the properties satisfied by traces using inference techniques and a set of predefined patterns. Our approach makes three contributions over previous work, focusing on enabling effective dynamic inference on large programs under realistic conditions. First, our inference algorithm scales well to large execution traces that have millions of events and thousands of distinct events. Second, our statistical inference algorithm can successfully infer property specifications from imperfect traces collected from buggy programs or using inadequate instrumentation tools. Third, our heuristics can effectively reduce the large number of properties inferred to a manageable set of mostly interesting properties. We implemented our dynamic analysis technique in a prototype tool called Perracotta. To evaluate the usefulness of dynamically inferred temporal properties, we applied Perracotta to aid program understanding, verification, and differencing. Results include inferring a 24-state finite state machine from the JBoss transaction manager that is consistent with the J2EE specification, inferring interesting API rules for the Windows kernel, and detecting a previously unknown deadlock bug in Windows by checking the inferred properties with the ESP verifier.

Malware classification plays an important role in tracing the attack sources of computer security. However, existing static analysis methods are fast in classification, but they are inefficient in some malware using packing and obfuscation techniques; the dynamic analysis methods have better universality for packing and obfuscation, but they will cause excessive classification cost. To overcome these shortcomings, in this paper, we propose a classification system Malscore based on the probability scoring and machine learning, which sets the probability threshold to concatenate static analysis (called Phase 1) and dynamic analysis (called Phase 2). The convolutional neural networks with spatial pyramid pooling were used to analyze the grayscale images (static features) in Phase 1, and the variable n-grams and machine learning were used to analyze the native API call sequences (dynamic features) in Phase 2. Malscore combined static analysis with dynamic analysis not only accelerated the static analysis process by taking advantage of the CNN in image recognition but also appeared to be more resilient to obfuscation by the dynamic analysis. Different from other static and dynamic analysis techniques, when malware is detected, due to the fact that malware will most likely be labeled only by static analysis, we could reduce the overheads by dynamically analyzing a few malware that has less obvious features or greater confusion in static analysis. We performed experiments on 174607 malware samples from 63 malware families. The result showed that Malscore achieved 98.82% accuracy for malware classification. Furthermore, Malscore was compared with the method of using static and dynamic analysis. The preprocessing and test time represented a reduction of 59.58% and 61.70%, respectively.