Sparse functional stores for imperative programs

Points-to analysis is a static program analysis aiming at analyzing the reference structure of dynamically allocated objects at compile-time. It constitutes the basis for many analyses and optimizations in software engineering and compiler construction. Sparse program representations, such as Whole Program Points-to Graph (WPP2G) and Points-to SSA (P2SSA), represent only dataflow that is directly relevant for points-to analysis. They have proved to be practical in terms of analysis precision and efficiency. However, intra-procedural control flow information is removed from these representations, which sacrifices analysis precision to improve analysis performance. We show an approach for keeping control flow related information even in sparse program representations by representing control flow effects as operations on the data transferred, i.e., as dataflow information. These operations affect distinct paths of the program differently, thus yielding a certain degree of path-sensitivity. Our approach works with both WPP2G and P2SSA representations. We apply the approach to P2SSA-based and flow-sensitive points-to analysis and evaluate a context-insensitive and a context-sensitive variant. We assess our approach using abstract precision metrics. Moreover, we investigate the precision improvements and performance penalties when used as an input to three source-code-level analyses: dead code, cast safety, and null pointer analysis.

Uncertainty principle and sparse reconstruction in pairs of orthonormal rational function bases

최근 많이 사용되고 있는 자바 바이트코드의 분석과 최적화를 효율적으로 수행하기 위해 CTOC 프레임워크가 구현되었다. CTOC에서는 바이트코드에 대해 분석과 최적화를 수행하기 위해 가장 먼저 eCFG를 생성하였다. 분석하기 어렵다는 바이트코드의 특성 때문에 기존의 바이트 코드를 제어 흐름 분석에 적합하게 확장하여 제어 흐름 그래프를 작성하였다. 이를 확장된 제어 흐름 그래프인 eCFG라 부른다. 또한 정적으로 분석하기 위해 eCFG를 SSA Form으로 변환 하였다. 변환 시 많은 프로그램에서 루프가 발견되었다. 이전 CTOC에서는 루프에 대한 처리를 수행하지 않은 상태에서 직접 SSA Form으로 변환을 수행하였다. 하지만 SSA Form으로 변환하기 이전에 루프에 대한 부분을 처리하면 더욱 효율적인 SSA Form을 생성할 수 있게 된다. 본 논문은 루프에 대한 처리를 효율적으로 하기 위해 eCFG를 SSA Form으로 변환하는 과정 이전에 루프를 발견하고 이와 관련된 루프 트리를 생성하는 과정을 보인다. The CTOC framework was implemented to efficiently perform analysis and optimization of the Java bytecode that is often being used lately. In order to analyze and optimize the bytecode from the CTOC, the eCFG was first generated. Due to the bytecode characteristics of difficult analysis, the existing bytecode was expanded to be suitable for control flow analysis, and the control flow graph was drawn. We called eCFG(extended Control Flow Graph). Furthermore, the eCFG was converted into the SSA Form for a static analysis. Many loops were found in the conversion program. The previous CTOC performed conversion directly into the SSA Form without processing the loops. However, processing the loops prior to the SSA Form conversion allows more efficient generation of the SSA Form. This paper examines the process of finding the loops prior to converting the eCFG into the SSA Form in order to efficiently process the loops, and exhibits the procedures for generating the loop tree.

Static analysis is one of the techniques used today to analyze source codes and minimize the issue of software vulnerability. Static analysis has the ability to observe all possible software paths in an application through the scrutiny of a web application’s source code. Among those paths, some may be considered feasible paths, which refer to any paths that the test cases can execute. The detection of feasible paths in the results of a static analysis helps to minimize the false positive rate. However, the detection of feasible paths can be challenging, especially for programs that have multiple conditions in the same branch. The aim is to ensure that each feasible path is detected only once (not duplicated). This paper proposes an approach based on minimal static single assignment (MSSA) form and symbolic execution to detect feasible paths. The proposed approach starts by converting the source code into an abstract syntax tree (AST), followed by converting the AST to minimal SSA representation, which helps to decrease the number of instructions in the SSA form. An algorithm was built to examine all of the instructions of the SSA form, identify whole paths in the source code, and extract constraints along each path. A path weight method (PWM) is proposed in this work to avoid detecting duplicated feasible paths. The satisfiability modulo theory (SMT) solver was used to check the satisfiability of each path condition. The proposed approach was tested on seven well-known test programs that have been used in related studies and 10 large scale programs. The experimental results indicate that the proposed method (PWM) can avoid detecting duplicated feasible paths, and the proposed approach reduced the time required for generating the paths compared to that in related studies.

Reasoning about information flow can help software engineering. Static information flow inference analysis is a technique which automatically infers information flows based on data or control dependence. It can be utilized for the purposes of general program understanding, detection of security attacks and security vulnerabilities, and type inference for security type systems. This paper proposes a new static information flow inference analysis, which unlike most other information flow analyses, handles both explicit and implicit information flows. The analysis does not require annotations and it is relatively precise and practical. We illustrate the usage of the static information flow analysis on three applications. The first application of information flow analysis is security violation detection. We perform experiments on a set of Java web applications and the experiments show that our analysis effectively detects security violations. The second application is type inference. Our experiments on the Java web applications successfully infer security types. The last application studies the effect of thread-shared variables on thread-local variables. Our experiments on a set of multi-thread programs show that most of the thread-local variables are affected by the thread-shared variables. We study the impact of implicit flow versus explicit flow in these applications. Implicit flow has significant impact on all these applications. In security violation detection, implicit flow detects more security violations than explicit flow. In type inference, implicit flow infers more untrusted type variables. In the study of the effect of thread-shared variables, implicit flow detects more affected variables than explicit flow.

Boolean function is one of the most fundamental computation models in theoretical computer science. The two most common representations of Boolean functions are Fourier transform and real polynomial form. Applying analytic tools under these representations to the study Boolean functions has led to fruitful research in many areas such as complexity theory, learning theory, inapproximability, pseudorandomness, metric embedding, property testing, threshold phenomena, social choice, etc. In this thesis, we focus on \emph{sparse representations} of Boolean function in both Fourier transform and polynomial form, and obtain the following new results. A classical result of Rothschild and van Lint asserts that if every non-zero Fourier coefficient of a Boolean function $f$ over $\mathbb{F}_2^{n}$ has the same absolute value, namely $|\hat{f}(\alpha)|=1/2^k$ for every $\alpha$ in the Fourier support of $f$, then $f$ must be the indicator function of some affine subspace of dimension $n-k$. Here we slightly generalize their result, and show that Boolean functions whose Fourier coefficients take values in the set $\{-2/2^k, -1/2^k, 0, 1/2^k, 2/2^k\}$ are indicator functions of two disjoint affine subspaces of dimension $n-k$ or four disjoint affine subspaces of dimension $n-k-1$. Our main technical tools are results from additive combinatorics which offer tight bounds on the affine span size of a subset of $\mathbb{F}_2^{n}$ when the doubling constant of the subset is small. For polynomial representation of Boolean function, we study the distribution of the number of non-zero coefficients of \emph{random} Boolean functions. For a random Boolean function $f:\{0,1\}^n\rightarrow \{0,1\}$, i.e., a function whose value at each point on the Boolean cube is chosen independently and uniformly at random from $\{0,1\}$, in real polynomial representation, we give several bounds and concentration results about the distribution of the sparsity of $f$.

In this paper, a new multiple kernel machine with in-situ learning capability is introduced for pattern classification using sparse representation framework. A vector-valued score function for a given pattern is generated as a linear combination of multiple kernel functions, each of which measures the similarity between the pattern to be classified and the representative samples from every class. The representative samples for different classes are selected through the sparse approximations, by forcing the representation of the vector-valued score function to be sparse in a dictionary of kernel functions with respect to all data samples from different classes. After the sparse weight matrix is found, the vector-valued score function for a new pattern with unknown class label can be computed. An incremental learning process is developed which allows for incremental updating of the system without impacting the previously learnt patterns. The proposed multiple kernel machine was then implemented and benchmarked against other multi-kernel methods for classifying underwater objects using low frequency sonar data.

Ahstract-Points-to analysis is a fundamental, but computationally intensive technique for static program analysis, optimization, debugging and verification. Context-Free Language (CFL) reachability has been proposed and widely used in demand-driven points-to analyses that aims for computing specific points-to relations on demand rather than all variables in the program. However, CFL-reachability-based points-to analysis still faces challenges when applied in practice especially for flow-sensitive points-to analysis, which aims at improving the precision of points-to analysis by taking account of the execution order of program statements. We propose a scalable approach named Parseeker to parallelize flow-sensitive demand-driven points-to analysis via CFL-reachability in order to improve the performance of points-to analysis with high precision. Our core insights are to (1) produce and process a set of fine-grained, parallelizable queries of points-to relations for the objective program, and (2) take a CFL-reachability-based points-to analysis to answer each query. The MapReduce is used to parallelize the queries and three optimization strategies are designed for further enhancing the efficiency.

Modern society is irreversibly dependent on computers and, consequently, on software. However, as the complexity of programs increase, so does the number of defects within them. To alleviate the problem, automated techniques are constantly used to improve software quality. Static analysis is one such approach in which violations of correctness properties are searched and reported. Static analysis has many advantages, but it is necessarily conservative because it symbolically executes the program instead of using real inputs, and it considers all possible executions simultaneously. Being conservative often means issuing false alarms, or missing real program errors. Pointer variables are a challenging aspect of many languages that can force static analysis tools to be overly conservative. It is often unclear what variables are affected by pointer-manipulating expressions, and aliasing between variables is one of the banes of program analysis. To alleviate that, a common solution is to allow the programmer to provide annotations such as declaring a variable as unaliased in a given scope, or providing special constructs such as the never-null pointer of Cyclone. However, programmers rarely keep these annotations up-to-date. The solution is to provide some form of pointer analysis, which derives useful information about pointer variables in the program. An appropriate pointer analysis equips the static tool so that it is capable of reporting more errors without risking too many false alarms. This dissertation proposes a methodology for pointer analysis that is specially tailored for modular bug finding. It presents a new analysis space for pointer analysis, defined by finer-grain dimensions of precision, which allows us to explore and evaluate a variety of different algorithms to achieve better trade-offs between analysis precision and efficiency. This framework is developed around a new abstraction for computing points-to sets, the Assign-Fetch Graph, that has many interesting features. Empirical evaluation shows promising results, as some unknown errors in well-known applications were discovered.

As software vulnerabilities have surged, efforts to discover them have increased. The syntactic and semantic information of a program is required to detect vulnerabilities. Each information can be represented as a graph, such as Abstract Syntax Tree and Program Dependency Graph. In this paper, the program representations were extracted using various static analysis tools, including Clang Static Analyzer, Joern, and SVF, and compared using Graph Neural Networks to select the appropriate representations for vulnerability detection in C/C++. From the comparison, PDG shows the best performance among the multiple representations. This result indicates a suitable program representation and a tool for vulnerability detection that can be utilized in research utilizing graph neural networks.

For a nonparametric regression problem, we have been proposed a training scheme based on orthogonalization and thresholding, in which a machine is assumed to be a weighted sum of fixed basis functions. In the basis of the scheme, vectors of basis function outputs are orthogonalized and coefficients of the orthogonalized vectors are estimated instead of weights. The coefficients are set to zero if those are less than predetermined threshold levels which are assigned componentwisely to every coefficients. We then obtain a resulting weight vector by transforming the thresholded coefficients. In this article, we presented theoretical details for supporting threshold levels applied in the training scheme. For a simple situation, we also gave an upper bound of a generalization error of the training scheme. As an implication of the bound, we found that an increase of generalization error is of O(log n/n) when there is a sparse representation of a target function in an orthogonal domain. In implementing the training scheme, an eigendecomposition or a Gram-Schmidt procedure for orthogonalization has been employed, in which the corresponding training methods are referred as HTED and HTGS. Also modified versions of HTED and HTGS has been proposed to reduce an estimation bias, which are referred as HTED2 and HTGS2 respectively. We also examined performances of the training methods on real benchmark datasets, in which HTED2 and HTGS2 exhibit relatively good generalization performances. In addition to the generalization performance, HTGS2 is found to obtain a sparse representation of a target function in terms of basis functions.

Static software analyser tools use different levels of intermediate source code representations that depend on the syntax and semantics of the language to be analysed. Most of the analyser tools use graph representation to efficiently retrieve information. Building such graphs for dynamically typed languages, such as Erlang, is not straightforward. In this paper we present static analysis methods to define the Dependency Graph representation of Erlang programs. The introduced methods cover the data-, control-, behaviour-flow and dependency analyses for sequential and parallel language constructs.

Filter generators are a traditional basis for creating synchronous stream ciphers. They are built with the help of linear shift registers (usually over a field of two elements) and nonlinear complexity functions, which are subject to a number of requirements in terms of the generators security against known attacks. Intensive researches of filter generators during the last decades show that meeting these requirements without degrading the performance of the generators is a very difficult task. Despite a large number of publications devoted to the construction of complexity functions with known “good cryptographic properties”, the usage of such functions in practice often becomes unacceptable due to the bulkiness of their constructions, which slows down the functioning of the corresponding generators, especially during software implementation. The way to overcome the noted difficulties by using an additional secret parameter that determines the appearance of the generator transitions’ function is proposed. Such a modification makes it possible to increase the security of generator (compared to traditional filter generators) against known attacks without increasing the length of its initial state. In particular, a specific version of a generator construction with a complexity function, which is determined with the help of substitutions used in the “Kalyna” encryption scheme, is considered. A lower estimate of the output sequences periods of the proposed generators was obtained. A research of their security to known attacks, in particular, Babbage-Golic balancing attack; an attack associated with a small number of terms in the polynomial representation of the complexity function (which negatively affects the value of the equivalent linear complexity of the output sequences of the generator); a natural correlation attack associated with the specifics of the proposed generator construction scheme; algebraic attacks of the Courtois-Mayer type were also conducted. At the end of the article, it is indicated how to choose the components of the proposed generators to ensure their security at a predetermined level.

Many program analyses benefit, both in precision and performance, from precise pointer analysis. An important dimension of pointer analysis precision is flow-sensitivity, which has been shown to be useful for applications such as program verification and static analysis of binary code, among many others. However, flow-sensitive pointer analysis has historically been unable to scale to programs with millions of lines of code. We present a new flow-sensitive pointer analysis algorithm that is an order of magnitude faster than the existing state of the art, enabling for the first time flow-sensitive pointer analysis for programs with millions of lines of code. Our flow-sensitive algorithm is based on a sparse representation of program code created by a staged, flow-insensitive pointer analysis. We explain how this new algorithm is a member of a new family of pointer analysis algorithms that deserves further study.

This paper presents a context-sensitive and path-sensitive, intra-thread and inter-thread solution to combined pointer analysis, escape analysis and data dependence analysis of multithreaded Java programs which uses a sparse representation. We build and maintain a complete Static Single Assignment (SSA) form even for fields variables. We show how to compute inter-thread dependencies for multithreaded programs with structured fork-join constructs, open-ended threads, recursively generated threads, monitors, and wait-notify synchronization. We have implemented our algorithm in a slicer for Java programs. Our experimental results show that a sparse representation improves the analysis time and strong updates on field variables improves the precision.