Dynamic memory access monitoring based on tagged memory

A memory-related vulnerability detection approach based on vulnerability model with Petri Net

Memory leaks represent a remarkable problem for mobile app developers since a waste of memory due to bad programming practices may reduce the available memory of the device, slow down the apps, reduce their responsiveness and, in the worst cases, they may cause the crash of the app. A common cause of memory leaks in the specific context of Android apps is the bad handling of the events tied to the Activity Lifecycle. In order to detect and characterize these memory leaks, we present FunesDroid, a tool-supported black box technique for the automatic detection of memory leaks tied to the Activity Lifecycle in Android apps. FunesDroid implements a testing approach that can find memory leaks by analyzing unnecessary heap object replications after the execution of three different sequences of Activity Lifecycle events. In the paper, we present an exploratory study that shows the capability of the proposed technique to detect memory leaks and to characterize them in terms of their size, persistence and growth trend. The study also illustrates how memory leak causes can be detected with the support of the information provided by the FunesDroid tool.

It is well accepted that pointers are a common source of memory anomalies such as loosing references to dynamic records without deallocating them (also known as memory leaks). This paper presents a novel pointer analysis framework that detects memory leaks by statically analyzing the behavior of programs. Our approach is based on symbolic evaluation of programs. Symbolic evaluation is an advanced static symbolic analysis that is centered around symbolic variable values, assumptions about and constraints between variable values, and control flow information (path conditions). As part of symbolic evaluation we introduce a new symbolic heap algebra for modeling heap operations. Predicates — defined over the program's input — are derived which allow to detect memory leaks. Our approach goes beyond previous work in the field of statically detecting memory leaks by considering also path conditions which increases the accuracy of our results, symbolically modeling heap data structures and heap operations. Examples are used to illustrate the effectiveness of our approach.

For C++ programs often appear memory leaks, cross-border access memory and memory does not match the release of error, we have analyzed existing memory error detection tools and methods, implemented in the Linux platform to run the memory testing tool MemDetect prototype based on the open source dynamic instrumentation-Valgrind using function family's memory information block management method and life cycle method. The prototype can detect memory leaks, cross-border access memory and memory does not match the release problems effectively, the validity and efficiency of the prototype are proved by comparing with Purify Rational.

An integrated dynamic memory tracing tool for C++

With sustained growth of software complexity, finding security vulnerabilities in operating systems has become an important necessity. Nowadays, OS are shipped with thousands of binary executables. Unfortunately, methodologies and tools for an OS scale program testing within a limited time budget are still missing. In this paper we present an approach that uses lightweight static and dynamic features to predict if a test case is likely to contain a software vulnerability using machine learning techniques. To show the effectiveness of our approach, we set up a large experiment to detect easily exploitable memory corruptions using 1039 Debian programs obtained from its bug tracker, collected 138,308 unique execution traces and statically explored 76,083 different subsequences of function calls. We managed to predict with reasonable accuracy which programs contained dangerous memory corruptions. We also developed and implemented VDiscover, a tool that uses state-of-the-art Machine Learning techniques to predict vulnerabilities in test cases. Such tool will be released as open-source to encourage the research of vulnerability discovery at a large scale, together with VDiscovery, a public dataset that collects raw analyzed data.

Lots of efforts have yet been devoted to the detection of memory leaks. However, very few work concerns on the problem of memory leak fixing. In this paper, we propose a dynamic approach for the weak reference based memory leak fixing. The approach can automatically infer the weakenable references in a program, rank them and report them to the user. The user can then weaken references according to the reports to fix the memory leaks.

Ada Gem #79 --- A number of tools and libraries exist to monitor memory usage, detect memory leaks and more generally solve issues with memory management. The Gems in this three-part series offer an overview of these issues and explain how you can benefit from these tools in your own development.

Utility programs, which perform similar and largely independent operations on a sequence of inputs, include such common applications as compilers, interpreters, and document parsers; databases; and compression and encoding tools. The repetitive behavior of these programs, while often clear to users, has been difficult to capture automatically. We present an active profiling technique in which controlled inputs to utility programs are used to expose execution phases, which are then marked, automatically, through binary instrumentation, enabling us to exploit phase transitions in production runs with arbitrary inputs. We demonstrate the effectiveness and programmability of active profiling via experiments with six utility programs from the SPEC benchmark suite; compare to code and interval phases; and describe applications of active profiling to memory management and memory leak detection.

In this paper we are presenting general scheme proposal to be used as preliminary financial feasibility analysis tool in complex software projects. We present our scheme proposal applied to real world example. Before facing any real world software project, sort of outline financial estimation is needed in order to evaluate if further talks and tasks have sense. This preliminary financial estimation is the first task (and duty) for software engineers. As result of our experience, both in software project management and in academia, we are presenting general scheme proposal to study, at first stages, software project financial feasibility. We present our proposal related to the application of vertical software reuse approach to an e-procurement project. As general framework, we briefly introduce the concept of e-procurement systems and e-auctions as the most relevant components of an e-procurement application. We also remark the importance of e-procurement in e-government environments. Just as reference, some successful e-procurement projects in Latin America are mentioned. We remark that the relevant aspect in the paper is our point of view and general scheme to evaluate the project expected finance impact during first talks with potential supporters. Investors do not like talking about lines of codes, function points, etc. In this paper we present a language that investors understand and use as standard communication tool

Java is one of the languages that are popular for high abstraction and automatic memory management. As in other object-oriented languages, Java's objects can easily represent a domain model of an application. While it has a positive impact on the design, implementation and maintenance of applications, there are drawbacks as well. One of them is a relatively high memory overhead to manage objects. In this work, we show our experience with searching for this problem in an application that we refactored to use less memory. Although the application was relatively well designed with no memory leaks, it required such a big amount of memory that for large data the application was not usable in reality. We did three relatively simple improvements: we reduced the usage of Java Collections, removed unnecessary object instances, and simplified the domain model, which reduced memory needs up to 88% and made the application better usable and even faster. This work is a case-study reporting results. Moreover, the employed ideas are formulated as a set of antipatterns, which may be used for other applications.

Vulnerability exploits will result in security breaches or violations of the system's security policy causing information leakage or economic losses. Although many detection methods such as static analysis, dynamic analysis and fuzz testing have been presented, the vulnerabilities are still difficult to detect. In this paper, we propose a new detection cloud service Vulcloud, which is scalable and hybrid combining the static, dynamic and fuzzing into cloud computing. Vulcloud first statically analyzes the objects and reports the potential vulnerable items. And then, the fuzzing cases for the items are semi-automated created, and tested under the dynamic monitoring. Finally, the source code of the results are statically analyzed again to determine whether they are vulnerabilities or not. The prototype of Vulcloud is implemented, and the performance is evaluated by Mplayer source code. The experiment results show that Vulcloud can detect vulnerabilities in software, and the challenges of storage and processing capabilities are resolved by cloud computing.

The fourth industrial revolution envisions industry manufacturing systems to be software driven where mundane manufacturing tasks can be automated. As software is perceived as an integral part of this vision, discovering vulnerabilities is of paramount of importance so that manufacturing systems are secure. A categorization of vulnerability discovery strategies can inform practitioners on how to identify undiscovered vulnerabilities in software. Recently researchers have investigated and identified vulnerability discovery strategies used in open source software (OSS) projects. The efficacy of the derived strategy needs to be validated by obtaining feedback from practitioners. Such feedback can be helpful to assess if identified strategies are useful for practitioners and possible directions the derived vulnerability discovery strategies can be improvised. We survey 51 practitioners to assess if four vulnerability discovery strategies: diagnostics, malicious payload construction, misconfiguration, and pernicious execution can be used to identify undiscovered vulnerabilities. Practitioners perceive the strategies to be useful: for example, we observe 88% of the surveyed practitioners to agree that diagnostics could be used to discover vulnerabilities. Our work provides evidence of usefulness for the identified strategies.

Inefficient use of memory, including leaks and bloat, remain a significant challenge for C and C++ developers. Applications with these problems become slower over time as their working set grows and can become unresponsive. At the same time, memory leaks and bloat remain notoriously difficult to debug, and comprise a large number of reported bugs in mature applications. Previous tools for diagnosing memory inefficiencies-based on garbage collection, binary rewriting, or code sampling-impose high overheads (up to 100X) or generate many false alarms. This paper presents Hound, a runtime system that helps track down the sources of memory leaks and bloat in C and C++ applications. Hound employs data sampling , a staleness-tracking approach based on a novel heap organization, to make it both precise and efficient. Hound has no false positives, and its runtime and space overhead are low enough that it can be used in deployed applications. We demonstrate Hound's efficacy across a suite of synthetic benchmarks and real applications.

As a practice-oriented discipline, Software Engineering (SE) is most effectively taught by using a variety of hands-on experiences. Team-based projects where students can practice their technical and soft skills are a key feature of many software engineering courses aimed to prepare students for the realities of industrial software development. Current research indicates that projects offered in SE courses should have a close connection to the real world, be large scale and complex. On the one hand, students should be able to relate to the requirements and understand them without spending much time acquiring domain knowledge. On the other hand, students should be exposed to changing and evolving requirements, which is one of the main challenges of real-world software projects. Software projects should be large enough and have enough features to engage all members of the student team while enabling them to practice some degree of specialization and experience the advantages and challenges of teamwork. Software projects should be rich enough to allow students practice all previously acquired SE concepts, bring together knowledge from other specialized CS disciplines, and apply a number of modern tools and technologies. One of the most effective ways to learn SE is to expose students to an environment that resembles an industrial setting as much as possible. As a part of an academic program, SE courses can achieve this objective by offering students a balanced combination of three components: teamwork involving up-to-date technology grounded in a solid theoretical foundation . Instructors in SE courses are uniquely positioned to help maintain this balance by simultaneously playing four roles described below. As a customer who contracts a student team to implement a particular project, the instructor may provide a verbal or written description of the project. It is the students? responsibility to conduct the requirements elicitation interviews and to prepare formal requirements specification for subsequent validation with the customer and possible adjustment. The instructor may act as a customer during the acceptance testing throughout the project to make sure that the team is on the right track at every iteration of the project. The instructor acting as a customer can also act as a proxy if the project has been offered by an industrial partner, or some other department or organization on campus. As an architect initially specifying the overall structure of the solution, the instructor can help students choose the right software architecture. This is a very important choice that has to be made early because it impacts the overall flow of the project. Later architectural changes can be extremely costly and can significantly jeopardize meeting the deadlines. Most likely, students do not have experience in making such architectural decisions and, therefore, it is crucial for the instructor to provide some guidance in this important process. As a team manager concerned with risk management, the instructor needs to pay attention that the team efforts are not jeopardized due to a potential lack of students? soft skills and that these skills are built up as the project progresses. Although it is the students? responsibility to create all artifacts emerging from the project, the instructor can help the team adhere to the schedule by providing feedback based on the inspection of all produced artifacts. In this respect, the roles of the team manager and the customer may somewhat overlap because the same person will be providing feedback to the team from the technical point of view (artifact inspection), as well as from the customer point of view (verification of product implementation at each iteration). In addition to the traditional role of giving lectures, the instructor needs to be a mentor offering guidance to each team and individual students addressing their specific needs and answering questions unique to their projects and the responsibilities in the context of the project. Furthermore, the instructor is uniquely positioned to advise individual students on how to resolve potential conflicts within a team. Such an advice given at the right time could make a difference between completing the project on time and allowing interpersonal tensions completely ruin any chance of collaboration between the team members.