Self-stabilizing Java

Soundness and completeness are two primary concerns of a static analysis tool for finding defects in software. Exhaustive static analysis of the program through all paths is not always possible, especially for a large software causing incompleteness in the analysis. Also, exhaustive testing of the program to detect all bugs is not possible. In this work, we describe a technique which uses coverage data from testing to remove the tested paths and then statically analyzes the remaining code. This pruning of tested paths allows a static analyzer to perform a more thorough analysis of the reduced code, thereby improving its effectiveness. This work is a step towards integration of static analysis and testing frameworks. The proposed technique is applied with a few static analyzers publicly available. Our experience shows that the approach results in lesser false positives as well as detection of more serious errors which might have gone unnoticed otherwise.

Formal specifications of software systems are extremely useful because they can be rigorously analyzed, verified, and validated, giving high confidence that the specification captures the desired behavior. To transfer this confidence to the actual source code implementation, a formal link is needed between the specification and the implementation. Generating the implementation directly from the specification provides one such link. A program transformation system such as Paige's APTS can be useful in developing a source code generator. This paper describes a case study in which APTS was used to produce code generators that construct C source code from a requirements specification in the SCR (Software Cost Reduction) tabular notation. In the study, two different code generation strategies were explored. The first strategy uses rewrite rules to transform the parse tree of an SCR specification into a parse tree for the corresponding C code. The second strategy associates a relation with each node of the specification parse tree. Each member of this relation acts as an attribute, holding the C code corresponding to the tree at the associated nodes the root of the tree has the entire C program as its member of the relation. This paper describes the two code generators supported by APTS, how each was used to synthesize code for two example SCR requirements specifications, and what was learned about APTS from these implementations.

A static analysis of the instructions used to implement all of the system software on the Lilith computer is described. The results are compared to those of a similar analysis performed on the Mesa instruction set architecture. The data provide a good illustration of how code generation strategies and language usage can affect opcode statistics, even for machines with similar architectures. >

Leveraging and acting on the results of static analysis is a well-known best practice. Static analysis also is an integral part of software quality assurance which is highlighted by the inclusion of static analysis results in software quality models like ColumbusQM and Quamoco. Although there are studies that explore if tools for static analysis are used and how they are configured, few publications explore the longitudinal effects of acting on static analysis results on software and on the evolution of software. Especially effects on quality criteria, e.g., software quality metrics, defects, or readability are missing. With our research, we will bridge this gap and measure the effects of static analysis on software quality evolution. We will measure the effect the removal of code that generates static analysis warnings has on software quality metrics. Furthermore, we will measure long term effects on external quality attributes, e.g., reported issues and defects. Finally, we want to predict false positives of static analysis warnings by training predictive models on our collected data.

Multi-physics coupling numerical simulation has significant value in engineering research, but the traditional “visual modeling + manual coding” approach faces challenges including low development efficiency, high error rates, and difficulties in knowledge reuse. This paper proposes a component-based framework for automatic code generation in multi-physics coupling numerical simulations. Through the establishment of a hierarchical workflow description model, workflow parsing engine, and code generation strategies, the framework achieves automatic conversion from workflow description models to executable code. The framework adopts a technical approach that combines modular layered architecture with model-driven engineering, supporting various component types including ordinary tasks, conditional judgments, parallel computing, and loop processing, and can automatically generate complete programs containing complex control logic and data flow. Using thermal-driven fluid flow in a two-dimensional enclosed space as a validation case, the accuracy and effectiveness of the framework are verified through systematic comparison of numerical accuracy and computational efficiency between automatically generated code and original simulation code. Experiments show that the generated code not only maintains computational performance and theoretical complexity (<tex xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">$\mathrm{O}\left(\mathrm{N}^{2}\right)$</tex>) comparable to the original code but also significantly simplifies the development process while ensuring numerical accuracy, providing a new efficient implementation path for multi-physics coupling numerical simulation.

Programming errors in traversal programs over structured data

The biggest problem in computer security is that most systems aren't constructed with security in mind. Being aware of common security weaknesses in programming might sound like a good way to avoid them, but awareness by itself often proves to be insufficient. Understanding security is one thing and applying your understanding in a complete and consistent fashion to meet your security goals is quite another. For this reason, static analysis is advocated as a technique for finding common security errors in source code. Manual security static analysis is a tedious work, so automatic tools which can guide programmers to detect security concerns is suggested. Good static analysis tools provide a fast way to get a detailed security related evaluation of program code. In this paper a new architecture (CBRFD) for software flaw detector, based on the concept of clone detection and case base reasoning, is proposed and various issues which concern detection of security weakness of codes through code clone detector is investigated.

Predicting the outcomes of software projects using data available in early development phases allows developers and managers more time to re-plan or re-design systems as needed to increase success. This research investigates early lifecycle predictive models of software faults and effort using information available no later than the system design phase. Static analysis of system designs characterizes intra- and inter-component control flow structure to calculate objective system design metrics. The model building process composes these design metrics into a set of relative factors that calibrate the relationships between the metrics and software faults and effort. These component-based predictive models provide a powerful approach to capture and analyze the designs of complex systems. These models facilitate the identification of essential system characteristics in terms of component structures and interactions, and they enable comprehensive analysis by being scalable to large systems. The research approach applies static analysis tools to the designs of 23 large-scale NASA systems containing over 5000 software components in order to automatically generate state- and interaction-based models of their designs. The static analysis tools derive the number of internal states for a component from its internal control flow design structure using cyclomatic complexity, and they calculate the number of interactions between components from the passing of control flow or data abstractions between components. The research approach evaluates the models by characterizing their relationships to favorable or unfavorable aspects of the system designs, in terms of component development faults and effort. The data analysis focuses on describing the characteristics of the state- and interaction-based models and identifying system design factors revealed by the models that relate to low or high faults, fault correction effort, and development effort. The results include the following, with comparative data being statistically significant at α < 0.05: ♦ The static analysis tools successfully generated state- and interaction-based models of the 23 system designs comprised of 5469 components. The numbers of states per component were exponentially distributed with an average of 14.3 and a median of 7.0. The numbers of interactions per component were exponentially distributed with an average of 8.8 and a median of 4.0. During system development, the components had 0.60 faults on average. ♦ Components with the most states (top 20%) had 7.8 times more faults than did those with the fewest states (bottom 20%). Components with the most states also had 22.5 times more fault correction effort and 5.4 times more development effort than did those with the fewest states. ♦ Components with the most interactions (top 20%) had 2.9 times more faults than did those with the fewest interactions (bottom 20%). Components with the most interactions also had 3.9 times more fault correction effort and 2.7 times more development effort than did those with the fewest interactions. In conclusion, we outline future research directions that build on these system modeling ideas and strategies.

This work introduces a proposal to capture adaptive navigation characteristics of a Web Application in the Requirements Specification stage. Tasks that users must be able to achieve are identified and described, considering the navigational adaptations that are needed to fulfill them. By applying a given code generation strategy, it is possible to obtain fully operative prototypes of the adaptive web application from its requirements specification.

Programming tools have expanded both in scope of the problems they solve, and in the kinds of techniques they use. Traditionally, programming tools have focused on detecting errors in programs. Recently, this scope has broadened to help with other programming tasks, including inferring specifications, helping diagnose root cause of errors during debugging, and managing knowledge in large projects. Also, traditionally programming tools have been based on either static or dynamic program analysis. Modern programming tools combine static and dynamic program analysis together with techniques from other disciplines such as statistical and probabilistic inference, and information retrieval. This paper reports on some such tools built by the Rigorous Software Engineering group at Microsoft Research India.

Fuzzers are often considered one of the most effective tools to uncover bugs in software, including security vulnerabilities. Current tools are designed to test the full programs by employing strategies that select and generate testcases that increase code coverage. In this paper, we propose to evolve these ideas to make fuzzers focus on specific portions (i.e., lines) of the code, which we call targets, avoiding wasting resources on the other regions. The aim is to support efficient testing of evolving software, and other practical scenarios such as confirming the results from static analysis.

Embedded software often involves intensive numerical computations and suffers from a number of runtime errors. The technique of numerical static analysis is of practical importance for checking the correctness of embedded software. However, most of the existing approaches of numerical static analysis consider sequential programs, while interrupts are a commonly used facility that introduces concurrency in embedded systems. Therefore, a numerical static analysis approach is highly desired for embedded software with interrupts. In this article, we propose a static analysis approach specifically for interrupt-driven programs based on sequentialization techniques. We present a method to sequentialize interrupt-driven programs into nondeterministic sequential programs according to the semantics of interrupts. The key benefit of using sequentialization is the ability to leverage the power of state-of-the-art analysis and verification techniques for sequential programs to analyze interrupt-driven programs, for example, the power of numerical abstract interpretation to analyze numerical properties of the sequentialized programs. Furthermore, to improve the analysis precision and scalability, we design specific abstract domains to analyze sequentialized interrupt-driven programs by considering their specific features. Finally, we present encouraging experimental results obtained by our prototype implementation.

We introduce the concept of “residual investigation” for program analysis. A residual investigation is a dynamic check installed as a result of running a static analysis that reports a possible program error. The purpose is to observe conditions that indicate whether the statically predicted program fault is likely to be realizable and relevant. The key feature of a residual investigation is that it has to be much more precise (i.e., with fewer false warnings) than the static analysis alone, yet significantly more general (i.e., reporting more errors) than the dynamic tests in the program's test suite pertinent to the statically reported error. That is, good residual investigations encode dynamic conditions that, when taken in conjunction with the static error report, increase confidence in the existence of an error, as well as its severity, without needing to directly observe a fault resulting from the error.

How to apply automated verification technology such as model checking and static program analysis to millions of lines of embedded C/C++ code? How to package this technology in a way that it can be used by software developers and engineers, who might have no background in formal verification? And how to convince business managers to actually pay for such a software? This work addresses a number of those questions. Based on our own experience on developing and distributing the Goanna source code analyzer for detecting software bugs and security vulnerabilities in C/C++ code, we explain the underlying technology of model checking, static analysis and SMT solving, steps involved in creating industrial-proof tools.

Despite the fact that a number of approaches have been proposed for effective and accurate prediction of software defects, yet most of these have not found widespread applicability. Our objective in this communication is to provide a framework which is expected to be more effective and acceptable for predicting the defects in multiple phases across software development lifecycle. The proposed framework is based on the use of neural networks for predicting defects in software development life cycle. Further, in order to facilitate the easy use of the framework by project managers, a software graphical user interface has been developed that allows input data (including effort and defect) to be fed easily for predicting defects. The proposed framework provides a probabilistic defect prediction approach where instead of a definite number, a defect range (minimum, maximum, and mean) is predicted. The claim of efficacy and superiority of proposed framework is established through results of a comparative study, involving the proposed frame-work and some well-known models for software defect prediction.