EagerMerge: an optimistic technique for efficient points-to analysis

Program slicing is a potentially useful analysis for aiding program understanding. However, in reality even slices of small programs are often too large to be useful. Imprecise pointer analyses have been suggested as one cause of this problem. In this paper, we use dynamic points-to data, which represents optimistic pointer information, to obtain a bound on the best case slice size improvement that can be achieved with improved pointer precision. Our experiments show that slice size can be reduced significantly for programs that make frequent use of calls through function pointers because for them the dynamic pointer data results in a considerably smaller call graph, which leads to fewer data dependences. Programs without or with only few calls through function pointers, however, show considerably less improvement. We discovered that C programs appear to have a significant fraction of direct and nonspurious pointer data dependences so that reducing spurious dependences via pointers is only of limited benefit. Consequently, to make slicing useful in general for such programs, improvements beyond better pointer analyses are necessary. On the other hand, since we show that collecting dynamic function pointer information can be performed with little overhead (average slowdown of 10 percent for our benchmarks), dynamic pointer information may be a practical approach to making slicing of programs with frequent function pointer use more successful in practice.

This paper presents a new worklist algorithm that significantly speeds up a large class of flow-sensitive data-flow analyses, including typestate error checking and pointer analysis. Our algorithm works particularly well for interprocedural analyses. By contrast, traditional algorithms work well for individual procedures but do not scale well to interprocedural analysis because they spend too much time unnecessarily re-analyzing large parts of the program. Our algorithm solves this problem by exploiting the sparse nature of many analyses. The key to our approach is the use of interprocedural def-use chains, which allows our algorithm to re-analyze only those parts of the program that are affected by changes in the flow values. Unlike other techniques for sparse analysis, our algorithm does not rely on precomputed def-use chains, since this computation can itself require costly analysis, particularly in the presence of pointers. Instead, we compute def-use chains on the fly during the analysis, along with precise pointer information. When applied to large programs such as nn, our techniques improve analysis time by up to 90%—from 1974s to 190s—over a state of the art algorithm.

Points-to analysis is the problem of approximating run-time values of pointers statically or at compile-time. Points-to sets are used to store the approximated values of pointers during points-to analysis. Memory usage and running time limit the ability of points-to analysis to analyze large programs. To our knowledge, works which have implemented a bit-vector representation of points-to sets so far, allocates bits for each pointer without considering pointer's type. By considering the type, we are able to allocate bits only for a subset of all abstract objects which are of compatible type with the pointer's type and as a consequence improve the memory usage and running time. To achieve this goal, we number abstract objects in a way that all the abstract objects of a type and all of its sub-types be consecutive in order. Our most efficient implementation uses about 2.5 times less memory than hybrid points-to set (default points-to set in Spark) and also improves the analysis time for sufficiently large programs.

Recently, with the purpose of helping developers reduce the needed effort to build highly secure software, researchers have proposed a number of vulnerable source code prediction models that are built on different kinds of features. Identifying security vulnerabilities along with differentiating non-vulnerable from a vulnerable code is not an easy task. Commonly, security vulnerabilities remain dormant until they are exploited. Software metrics have been widely used to predict and indicate several quality characteristics about software, but the question at hand is whether they can recognize vulnerable code from non-vulnerable ones. In this work, we conduct a study on static code metrics, their interdependency, and their relationship with security vulnerabilities in Android applications. The aim of the study is to understand: (i) the correlation between static software metrics; (ii) the ability of these metrics to predict security vulnerabilities, and (iii) which are the most informative and discriminative metrics that allow identifying vulnerable units of code.

Inclusion-based set constraint solving is the most popular technique for whole-program points-to analysis whereby an analysis is typically formulated as repeatedly resolving constraints between points-to sets of program variables. The set union operation is central to this process. The number of points-to sets can grow as analyses become more precise and input programs become larger, resulting in more time spent performing unions and more space used storing these points-to sets. Most existing approaches focus on improving scalability of precise points-to analyses from an algorithmic perspective and there has been less research into improving the data structures behind the analyses. Bit-vectors as one of the more popular data structures have been used in several mainstream analysis frameworks to represent points-to sets. To store memory objects in bit-vectors, objects need to mapped to integral identifiers. We observe that this object-to-identifier mapping is critical for a compact points-to set representation and the set union operation. If objects in the same points-to sets (co-pointees) are not given numerically close identifiers, points-to resolution can cost significantly more space and time. Without data on the unpredictable points-to relations which would be discovered by the analysis, an ideal mapping is extremely challenging. In this paper, we present a new approach to inclusion-based analysis by compacting points-to sets through object clustering. Inspired by recent staged analysis where an auxiliary analysis produces results approximating a more precise main analysis, we formulate points-to set compaction as an optimisation problem solved by integer programming using constraints generated from the auxiliary analysis’s results in order to produce an effective mapping. We then develop a more approximate mapping, yet much more efficiently, using hierarchical clustering to compact bit-vectors. We also develop an improved representation of bit-vectors (called core bit-vectors) to fully take advantage of the newly produced mapping. Our approach requires no algorithmic change to the points-to analysis. We evaluate our object clustering on flow sensitive points-to analysis using 8 open-source programs (>3.1 million lines of LLVM instructions) and our results show that our approach can successfully improve the analysis with an up to 1.83× speed up and an up to 4.05× reduction in memory usage.

Using type systems, this paper treats heap slicing which is a technique transforming a program into a new one that produces the same result while working on a heap sliced into independent regions. Heap slicing is a common approach to handle the problem of modifying the heap layout without changing the program semantics. Heap slicing has applications in the areas of performance optimization and security.Towards solving the problem of heap slicing, this paper introduces three type systems. The first type system does a pointer analysis and annotates program points with pointer information. This type system is an augmentation of a previously developed type system by the author. The second type system does a region analysis and refines the result of the first type system by augmenting the pointer information with region information. The region information approximately specifies at each program point for each memory cell the region where the cell exists. The third type system uses the information gathered by the region type system to do the principal transformation of heap slicing.The paper also presents two operational semantics; one for single-region heap scenario and the other for multi-regions heap scenario. These semantics are used to prove the soundness of the type systems.Keywordsheap slicingtype systemssemantics of programming languagesoperational semanticsregion analysispointer analysis

Many software engineering tools such as program slicers must perform data-flow analysis in order to extract necessary information from the program source. These tools typically borrow much of their implementation from optimizing compilers. However, since these tools are expected to analyze programs in their entirety, rather than functions in isolation, the time and space performance of the dataflow analyses are of major concern. We present techniques that reduce the time and space required to perform dataflow analysis of large programs. We have used these techniques to implement an efficient program slicing tool for C programs and have computed slices of programs with more than 100,000 lines of code.

Points-to information is essential in software engineering, including compiler optimization, instruction-level parallelism, program verification, and so on. The propagating of points-to information along paths of a program can be viewed as the “frame problem” in a dynamic world. As a primary knowledge representing and reasoning tool in Artificial Intelligence, Answer Set Programming (ASP) provides a natural and concise way to express the frame problem. We present a collection of ASP rules to model the propagating of points-to information along paths of an object-oriented program. With these rules and basic facts of a program, points-to information at each program point can be computed easily. This makes it possible to acquire useful information for program analysis through existing ASP solvers.KeywordsAnswer Set Programmingknowledge representing and reasoningpoints-to analysisobject-oriented language

Driven in part by federal law, accessibility (a11y) support for disabled users is becoming ubiquitous in commodity OSs. Some assistive technologies such as natural language user interfaces in mobile devices are welcomed by the general user population. Unfortunately, adding new features in modern, complex OSs usually introduces new security vulnerabilities. Accessibility support is no exception. Assistive technologies can be defined as computing subsystems that either transform user input into interaction requests for other applications and the underlying OS, or transform application and OS output for display on alternative devices. Inadequate security checks on these new I/O paths make it possible to launch attacks from accessibility interfaces. In this paper, we present the first security evaluation of accessibility support for four of the most popular computing platforms: Microsoft Windows, Ubuntu Linux, iOS, and Android. We identify twelve attacks that can bypass state-of-the-art defense mechanisms deployed on these OSs, including UAC, the Yama security module, the iOS sandbox, and the Android sandbox. Further analysis of the identified vulnerabilities shows that their root cause is that the design and implementation of accessibility support involves inevitable trade-offs among compatibility, usability, security, and (economic) cost. These trade-offs make it difficult to secure a system against misuse of accessibility support. Based on our findings, we propose a number of recommendations to either make the implementation of all necessary security checks easier and more intuitive, or to alleviate the impact of missing/incorrect checks. We also point out open problems and challenges in automatically analyzing accessibility support and identifying security vulnerabilities.

The purpose of this study is to know the characteristic rice farming in The Village Kedung Banteng and analyze the economic efficiency and technical efficiency in rice farming in the Village Kedung Banteng.Total population of rice farmers in the village Kedung Banteng totaling 1825 people and taken 95 samples in . This research was conducted with qualitative and quantitative analysis based on production function with a stochastic frontier approach (Stochastic Frontier Production Function) included: regression analysis, maximum likelihood (MLE), the analysis of technical efficiency(DEA), economic efficiency and price efficiency.The results show the estimation of stochastic frontier production function rice farming both in The Village Kedung Banteng there are only four significant independent variables namely labor, land , seed and capital. When viewed from the coefficient of elasticity, these inputs is elastic and when viewed from its RTS, rice farming in a state of increasing returns to scale (IRS), which the IRS values of 1,8747 in The Village Kedung Banteng. Based on analysis of technical efficiency (ET), it is known there are only 21 farmers who are efficient in the Village Kedung Banteng at 100% efficiency rate. When viewed from the efficiency of the price / allocative and economic efficiency, the farming of rise has not been efficient with the efficiency of its value pricing 2,163 &1,758 in The Village Kedung Banteng economic efficiency . From the calculation of technical efficiency, price efficiency, and economic efficiency can be concluded that rice farming has not been efficient. Value R/C ratio is 1.34 means rice farming profitable.

Developing scalable and precise points-to analyses is increasingly important for analysing and optimising object-oriented programs where pointers are used pervasively. An incremental analysis for a program updates the existing analysis information after program changes to avoid reanalysing it from scratch. This can be efficiently deployed in software development environments where code changes are often small and frequent. This paper presents an incremental approach for demand-driven context-sensitive points-to analyses based on Context-Free Language (CFL) reachability. By tracing the CFL-reachable paths traversed in computing points-to sets, we can precisely identify and recompute on demand only the points-to sets affected by the program changes made. Combined with a flexible policy for controlling the granularity of traces, our analysis achieves significant speedups with little space overhead over reanalysis from scratch when evaluated with a null dereferencing client using 14 Java benchmarks.

Modern society is irreversibly dependent on computers and, consequently, on software. However, as the complexity of programs increase, so does the number of defects within them. To alleviate the problem, automated techniques are constantly used to improve software quality. Static analysis is one such approach in which violations of correctness properties are searched and reported. Static analysis has many advantages, but it is necessarily conservative because it symbolically executes the program instead of using real inputs, and it considers all possible executions simultaneously. Being conservative often means issuing false alarms, or missing real program errors. Pointer variables are a challenging aspect of many languages that can force static analysis tools to be overly conservative. It is often unclear what variables are affected by pointer-manipulating expressions, and aliasing between variables is one of the banes of program analysis. To alleviate that, a common solution is to allow the programmer to provide annotations such as declaring a variable as unaliased in a given scope, or providing special constructs such as the never-null pointer of Cyclone. However, programmers rarely keep these annotations up-to-date. The solution is to provide some form of pointer analysis, which derives useful information about pointer variables in the program. An appropriate pointer analysis equips the static tool so that it is capable of reporting more errors without risking too many false alarms. This dissertation proposes a methodology for pointer analysis that is specially tailored for modular bug finding. It presents a new analysis space for pointer analysis, defined by finer-grain dimensions of precision, which allows us to explore and evaluate a variety of different algorithms to achieve better trade-offs between analysis precision and efficiency. This framework is developed around a new abstraction for computing points-to sets, the Assign-Fetch Graph, that has many interesting features. Empirical evaluation shows promising results, as some unknown errors in well-known applications were discovered.

Points-to information is the basis for many analyses and transformations, e.g., for program understanding and optimization. Collections frameworks are part of most modern programming languages' infrastructures and used by many applications. The richness of features and the inherent structure of collection classes affect both performance and precision of points-to analysis negatively. In this paper, we discuss how to replace original collections frameworks with versions specialized for points-to analysis. We implement such a replacement for the Java Collections Framework and support its benefits for points-to analysis by applying it to three different points-to analysis implementations. In experiments, context-sensitive points-to analyses require, on average, 16-24\% less time while at the same time being more precise. Context-insensitive analysis in conjunction with in lining also benefits in both precision and analysis cost.

Pointer analysis is a prerequisite for many program analyses, and the effectiveness of these analyses depends on the precision of the pointer information they receive. Two major axes of pointer analysis precision are flow-sensitivity and context-sensitivity, and while there has been significant recent progress regarding scalable context-sensitive pointer analysis, relatively little progress has been made in improving the scalability of flow-sensitive pointer analysis.This paper presents a new interprocedural, flow-sensitive pointer analysis algorithm that combines two ideas-semi-sparse analysis and a novel use of BDDs-that arise from a careful understanding of the unique challenges that face flow-sensitive pointer analysis. We evaluate our algorithm on 12 C benchmarks ranging from 11K to 474K lines of code. Our fastest algorithm is on average 197x faster and uses 4.6x less memory than the state of the art, and it can analyze programs that are an order of magnitude larger than the previous state of the art.

Demand.- to Essays on Port Economics.- Port Marketing Strategies and the Challenges of Maritime Globalization.- Contextual Port Development: A Theoretical Approach.- The Conditioned Demands of General Merchandise, Dry Bulk and Liquid Bulk Sea Transport.- Determinants of the Demand of International Maritime Transport.- The Demand for Maritime Transport: A Nonlinearity and Chaos Study.- Supply.- Productivity in Maritime Transportation.- Analysis of the Returns to Scale, Elasticities of Substitution and Behavior of Shipping (General Cargo) Production.- Returns to Scale, Elasticities of Substitution and Behavior of Shipping (Dry Bulk) Transport Costs, Some Empirical Evidence.- Cycles in the Ship Building Industry: An Empirical Evidence.- Port Economic Impact.- A Methodological Discussion on Port Economic Impact Studies and Their Possible Applications to Policy Design.- An Approach to the Contribution of the Port System.- The Economic Impact of Ports: Its Importance for the Region and Also the Hinterland.- The Effect of Port Infrastructures on Regional Production.- Regulation and Economic, Technical and Allocative Efficiency.- Bootstrapped Technical Efficiency of African Seaports.- Impact of New Technology on Port Administration.- Excess Capacity, Economic Efficiency and Technical Change in a Public-Owned Port System: An Application to the Infrastructure Services of Spanish Ports.- Analysis of Technical Efficiency and Rate of Return on Investment in Ports.- Cost Benefit Analysis and Externalities.- A Cost-Benefit Analysis of a New Container Terminal.- Evaluation of Port Externalities: The Ecological Footprint of Port Authorities.