Improved interconnect sharing by identity operation insertion

Automatic vectorization is crucial for improving the performance of computationally intensive programs. Existing compilers use conservative optimization strategies for automatic vectorization, which, in many cases, lead to the loss of vectorization opportunity. Studies have shown that the use of machine learning algorithms to build a performance prediction model is beneficial to improve the program performance. The model input is program features, and the output is the predicted optimization strategies or the program performance related to the optimization. In this paper, we focus on a computational intensive loop structure-tensor contraction, which is common in quantum chemical simulations. Most existing machine learning methods rely on control and data flow graphs as features to represent programs, but different tensor contraction kernels have the same control and data flow graphs. In addition, the existing methods often use the same kind of learning algorithm to construct a learning model, which is prone to overfitting and low-precision problems. In this paper, we propose an automatic vectorization performance enhancement method based on ensemble learning. We construct an ensemble learning model to predict the performance of tensor contraction kernels with different vectorization strategies and select the best vectorization strategy for the kernels. According to the storage access patterns of the tensor contraction kernels, we propose a static method for features representation. Based on the multi-algorithm ensemble learning strategy, we obtain better learning results than the single learning algorithm. The experimental results show that the prediction model achieves 88% and 87% prediction efficiency on two different platforms with different instruction sets, data types, and compilers. Compared with the existing methods, the prediction efficiency is greatly improved. In addition, the average peak performance is $2.96 \times $ of Intel ICC 12.0 and $2.98 \times $ of GCC 4.6 compiler, respectively.

Aim of the new methodology proposed is to extract, from a behavioral circuit description, all information on the regularity of the computation. Array architectures optimally implement the extracted regular behavior. A high-level synthesis tool for such arrays has been defined. First, the problem of translating a hardware description language (either VHDL or Hardware C) into and internal representation useful for the exploration of different alternative architectures is afforded. Here the main problems relate to the different interpretations that can be given to an HDL description during the behavioral synthesis step. A set of design rules for writing the specifications has been identified. Then the internal design representation is studied. A hierarchical graph-based representation has been adopted which contains all information needed to identify possible regularities. The hierarchical structure is composed of a data flow graph (DFG) that holds information about data and operations performed and of a control flow graph (CFG) representing the condition clauses causing the choice of the computations to be performed. All information needed to identify the regular structures, can be derived from the DFG alone, while the information of the CFG is useful to correctly synthesize the control machine. The proposed high-level synthesis approach has been implemented into a module called Orpheus, which can be connected to the Olympus synthesis system.< <ETX xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">&gt;</ETX>

This paper explores the problem of identifying malicious code sections in applications for the Android. A method for analyzing Android applications is proposed, based on applying of static analysis using control flow graphs and data flow graphs. The paper formally describes the dependency relationships that are used to construct graphs, and also describes an algorithm that allows to identify malicious sections of code using the received graphs. The results of an experimental evaluation of the effectiveness of the proposed method are presented, demonstrated a high probability of detecting malicious portions of the code of Android applications.

An Ameliorated Methodology for the Abstraction of Object Oriented Features from Software Requirements Specification

소프트웨어의 취약성을 검증하기 위하여 소프트웨어의 구조를 유추하여 유추된 구조를 활용하여 테스트하는 방법이 주목받고 있다. 이와 같은 방법을 사용하기 위해서 효과적인 소프트웨어의 구조 유추 방법이 요구된다. 많이 사용되는 DFG(Data Flow Graph), CFG(Control Flow Graph) 이나 CFA(Control Flow Automata)와 같은 그래프나 트리 방식은 소프트웨어 모델을 구조적으로 표현하지 못하는 단점을 가진다. 본 논문에서는 이러한 단점을 극복할 수 있는 방법을 제시한다. 제시된 방법은 바이너리 코드에 다양한 입력데이터 들을 부여하여 입력데이터별 CFG를 생성하고, 생성된 CFG들이 구조적으로 표현될 수 있도록 계층적 제어 흐름 그래프(Hierarchical Control Flow Graph, HCFG)를 작성한다. 또한 제안하는 HCFG을 생성하는데 요구되는 그래프의 구성요소와 점진적 그래프 생성 알고리듬도 제시한다. 제안한 방법론을 공개된 SMTP(Simple Mail Transfer Protocol) 서버 프로그램에 적용시켜 소프트웨어의 모델을 작성하는 실험을 수행하고, 생성된 모델과 실제 소프트웨어 구조를 비교 분석한다. To verify software vulnerability, the method of conjecturing software structure and then testing the software based on the conjectured structure has been highlighted. To utilize the method, an efficient way to conjecture software structure is required. The popular graph and tree methods such as DFG(Data Flow Graph), CFG(Control Flow Graph) and CFA(Control Flow Automata) have a serious drawback. That is, they cannot express software in a hierarchical fashion. In this paper, we propose a method to overcome the drawback. The proposed method applies various input data to a binary code, generate CFG's based on the code output and construct a HCFG (Hierarchical Control Flow Graph) to express the generated CFG's in a hierarchical structure. The components required for HCFG and progressive algorithm to construct HCFG are also proposed. The proposed method is verified through constructing the software architecture of an open SMTP(Simple Mail Transfer Protocol) server program. The structure generated by the proposed method and the real program structure are compared and analyzed.

In this paper an optimum algorithm to translate control flow graphs to dataflow graphs is proposed for dataflow execution of sequential programs. Some of the existing analysis methods restrict the specification of a program to be processed while others require a very high analysis cost. The algorithm proposed in this paper (CD translation algorithm), (1) with a very low cost, and (2) for any control structure that can be described by a control flow graph, (3) can generate dataflow programs that give an optimum dataflow execution. Furthermore, this proposed analysis algorithm is designed to handle task level control flow graphs as well as instruction level control flow graphs, which are accepted by the existing methods, so that optimum control is possible for task level dataflow execution.

Spatial architecture is a high-performance paradigm that employs control flow graphs and data flow graphs as computation model, and producer/consumer models as execution model. However, existing spatial architectures struggle with control flow handling challenges. Upon thoroughly characterizing their PE execution models, we observe that they lack autonomous, peer-to-peer, and temporally loosely-coupled control flow handling capability. This degrades its performance in intensive control programs. To tackle the existing control flow handling challenges, Marionette, a spatial architecture with an explicit-designed control flow plane, is proposed. We elaborately develop a full stack of Marionette architecture, from ISA, compiler, simulator to RTL. Marionette's flexible Control Flow Plane enables autonomous, peer-to-peer, and temporally loosely-coupled control flow management. Its Proactive PE Configuration ensures computation-overlapped and timely configuration to promote Branch Divergence handling capability. Besides, Marionette's Agile PE Assignment improves pipeline performance of imperfect loops. Compared to state-of-the-art spatial architectures, the experimental results demonstrate that Marionette outperforms Softbrain, TIA, REVEL, and RipTide by geomean 2.88<inline-formula><tex-math notation="LaTeX">$\mathbf{\times}$</tex-math></inline-formula>, 3.38<inline-formula><tex-math notation="LaTeX">$\mathbf{\times}$</tex-math></inline-formula>, 1.55<inline-formula><tex-math notation="LaTeX">$\mathbf{\times}$</tex-math></inline-formula>, and 2.66<inline-formula><tex-math notation="LaTeX">$\mathbf{\times}$</tex-math></inline-formula> in a variety of challenging intensive control programs.

This paper presents a novel methodology for automated parallel exploration of datapath and Unrolling Factor (UF) in High Level Synthesis (HLS) using hyper-dimensional particle encoding based swarm intelligence (termed as ‘H-SI’) for control and data flow graphs (CDFGs). The major novel contributions of the proposed approach are as follows: (a) Hybrid design space exploration (DSE) framework that concurrently balances the tradeoff between the following: i) conflicting metrics of power - execution time ii) control states and execution delay during loop unrolling iii) orthogonal condition of enhancing Quality of Results (QoR) and reducing the exploration runtime; (b) automated parallel exploration of data path and loop UF through an integrated hyper-dimensional particle encoding approach using swarm intelligence; (c) power model for evaluation of design points during exploration; (d) model for estimation of execution delay of a loop unrolled CDFG (for any UF value) based on an available resource without necessity of tediously unrolling the entire CDFG in most cases. Results indicated an average improvement in QoR of >38 % and reduction in runtime of > 93 % compared to recent approaches.

Large Language Models (LLMs) have gained traction in domains from software development to cybersecurity, particularly for detecting vulnerabilities in program source code. Their ability to analyze large codebases and identify security weaknesses makes them valuable in software security analysis. However, their effectiveness declines in the absence of intermediate representations such as Abstract Syntax Trees (AST), Control Flow Graphs (CFG), and Data Flow Graphs (DFG), or even tokenized forms of code. In this research study, we assess the performance of LLMs in detecting vulnerabilities directly from raw source code, without structural representations. By designing context-specific prompts, we aim to enhance the model's understanding of code semantics. Our findings show that LLMs can partially identify vulnerabilities from raw code alone, reaching up to 43% accuracy. This indicate both the potential and current limitations of prompt-based LLMs for static vulnerability detection.

BGNN4VD: Constructing Bidirectional Graph Neural-Network for Vulnerability Detection

Current software defect prediction and code quality assessment methods treat these inherently related tasks independently, failing to leverage their complementary information. Existing graph-based approaches lack the ability to jointly model structural dependencies and quality characteristics, limiting their effectiveness in capturing the complex relationships between defect patterns and code quality indicators. This paper proposes a novel integrated model that simultaneously tackles both objectives using graph neural networks to leverage the inherent graph structure of software systems. Our novelty lies in the first-of-its-kind integration of multi-level graph representations (AST, CFG, DFG) with a dual-branch attention-based GNN architecture for simultaneous defect prediction and quality assessment. Our approach constructs multi-level graph representations by integrating abstract syntax trees, control flow graphs, and data flow graphs, capturing both syntactic and semantic relationships in source code. The proposed dual-branch GNN architecture employs shared representation learning with attention mechanisms and multi-task optimization to exploit complementary information between defect prediction and quality assessment tasks. Comprehensive experiments on six real-world software projects demonstrate significant improvements over traditional methods, achieving F1-scores of 0.811 and AUC values of 0.896 for defect prediction, while showing 9.3% average improvement in code quality assessment accuracy across multiple quality dimensions. The integration strategy proves effective in capturing complex structural dependencies and provides actionable insights for software development teams, establishing a foundation for intelligent software engineering tools that deliver comprehensive code analysis capabilities.

Many data-driven software engineering tasks such as discovering programming patterns, mining API specifications, etc., perform source code analysis over control flow graphs (CFGs) at scale. Analyzing millions of CFGs can be expensive and performance of the analysis heavily depends on the underlying CFG traversal strategy. State-of-the-art analysis frameworks use a fixed traversal strategy. We argue that a single traversal strategy does not fit all kinds of analyses and CFGs and propose bespoke control flow analysis (BCFA). Given a control flow analysis (CFA) and a large number of CFGs, BCFA selects the most efficient traversal strategy for each CFG. BCFA extracts a set of properties of the CFA by analyzing the code of the CFA and combines it with properties of the CFG, such as branching factor and cyclicity, for selecting the optimal traversal strategy. We have implemented BCFA in Boa, and evaluated BCFA using a set of representative static analyses that mainly involve traversing CFGs and two large datasets containing 287 thousand and 162 million CFGs. Our results show that BCFA can speedup the large scale analyses by 1%-28%. Further, BCFA has low overheads; less than 0.2%, and low misprediction rate; less than 0.01%.

Smart contracts on blockchain platforms are susceptible to security issues that can lead to significant financial losses. This study converts the Solidity code into abstract syntax trees and generates control flow graphs and data flow graphs. These graphs train a graph convolutional network model to detect security weaknesses. The proposed system outperforms traditional tools, achieving higher accuracy, recall, precision, and F1 scores when detecting weaknesses such as integer overflow/underflow, reentrancy, delegate call to the untrusted callee, and time-based issues. This study demonstrates that leveraging control and data flow analysis with graph neural networks significantly enhances smart contract security and provides a robust and reliable solution.

Low-level languages like C/C++ are widely used in various applications for their performance and flexibility. Unfortunately, these languages are prone to memory corruption vulnerabilities, leading to control-flow hijacking attacks. Control flow integrity (CFI) is a general principle to enforce run-time control flow of a program to a pre-computed control-flow graph (CFG). While the traditional context-insensitive CFI falls short in protecting critical control transfers, recent context-sensitive CFI research shows promising improvements but has various limitations. We present Control Flow Integrity with Look Back (CFI-LB), a call-site sensitive CFI in which a conventional source-target control transfer is strengthened by a look back into its call-sites (return addresses). CFI-LB features the adaptive call-site sensitivity in which each indirect call has its own level of sensitivity and the multi-scope CFG to improve the security even if a precise context-sensitive static CFG is not available, especially for large programs such as GCC and NGINX. One of the CFGs is constructed by our localized concolic execution, which significantly extends the dynamic CFG with very low false positives. In addition, CFI-LB is the first CFI system explicitly designed to protect its reference monitors from race conditions. We have built a prototype of CFI-LB. The evaluation with SPEC CPU2006 benchmarks and NGINX indicates that CFI-LB has a low-performance overhead (less than 5% on average for the full protection) while increasing the security.

The software development process often requires the use of tools that the developers did not write themselves, such as a compiler. Additionally, when security researchers perform tasks such as binary analysis and reverse engineering disassembly and decompiler tools may be used which the researchers did not develop themselves. Yet in all of these cases, there is inherent trust placed in the tools that are being used for these tasks without thought to whether or not that trust is valid. In this work, we provide an overview of what has already been done in the realms of verification and establishment of this trust as well as show our contribution to this area. Our approach is taken through an algorithm that allows us to validate or invalidate that trust by comparing the control flow graphs (CFGs) for a piece of source code to the corresponding CFG for the disassembled binary. This is done by putting the source CFG through a series of program functionality preserving transforms that implement different control structure compiler optimizations. Then we are able to make use of a graph isomorphism algorithm to determine whether or not the two CFGs are isomorphic and determine if the trust is valid. We evaluate the effectiveness of this algorithm against the XINU codebase and report our results.