Static Data Flow Analysis of PL/I Programs with the PROBE System

Static and dynamic program analysis techniques are important research areas in software security. Static analysis helps us locate vulnerabilities in a software by looking at the source code. Dynamic analysis helps us reason about the behavior of the software from information gathered at run-time. In this thesis, we are focusing on data flow analysis and heap analysis which are key static and dynamic program analysis techniques respectively.
\n
\nIn the first part of this thesis, we aim at detecting vulnerabilities in Android applications which have capability leaks. The security of the Android platform relies mainly on sandboxing applications and restricting their capabilities such that no application, by default, can perform any operations that would adversely impact other applications, the operating system, or the user. However, a recent research reported that a genuine but vulnerable application may leak its capabilities. When being leveraged, other applications can gain extra capabilities which they are not granted originally. We present DroidChecker, an Android application analyzing tool which searches for the aforementioned vulnerability in Android applications. DroidChecker uses interprocedural control flow graph searching and static taint checking to detect exploitable data paths in an Android application. We analyzed more than 1100 Android applications using DroidChecker and found 6 previously unknown vulnerable applications including the renowned Adobe Photoshop Express application. We also developed a malicious application that exploits the previously unknown vulnerability found in the Adobe Photoshop Express application. We showed that the malicious application, which is not granted any permissions, can access contacts on the phone with just a few lines of code.
\n
\nIn the second part of this thesis, we explore the use of heap analysis to extract software birthmarks. There are techniques like code obfuscation and watermarking which can make the source code of a program difficult to understand by humans and prove the ownership of the program. However, code obfuscation cannot avoid the source code being copied and a watermark can be defaced. A birthmark is a group of unique characteristics a program possesses that can be used to identify the program. We propose two novel dynamic birthmark systems based on the run-time heap. A dynamic birthmark is one that is extracted when the program is executing. Since it is based on the run-time behavior of the program, semantics-preserving transformations of the code like obfuscation cannot defeat dynamic birthmarks. In this regard, dynamic birthmarks are more robust compared with static birthmarks.
\n
\nTo the best of our knowledge, these are the first birthmark systems using heap analysis as the underlying technique. The basic idea is to take snapshots of the heap while the program is running. From the snapshots, heap graphs are constructed to model the referencing structure between objects. After going through some filtering and referencing processes, they become the birthmarks. The two birthmark systems have been devised to extract birthmarks for Java programs and JavaScript programs respectively. While the underlying ideas of the two birthmark systems are similar, the differences in nature of the two programming languages led to different implementation designs.

Data flow analysis is used widely in program compilation, understanding, design, and analysis tools. In data flow analysis, problem-specific information is associated with nodes and/or edges in the flow graph representation of a program or component and re-comp\-uted iteratively. A popular data flow analysis design relies on a worklist that stores all nodes and edges whose data flow information has to be re-computed. While this approach is straightforward, it has some drawbacks. First, the presence of the worklist makes data flow algorithms centralized, which may reduce effectiveness of parallel implementations of these algorithms. Second, the worklist approach is difficult to implement in a way that minimizes the amount of information passed between flow graph nodes.In this paper, we propose to use the well-known Observer pattern for implementation of data flow analyses. We argue that such implementations are more object-oriented in nature, as well as less centralized, than worklist-based ones. We argue that by adopting this Observer-based view, data flow analyses that minimize the amount of information passed between flow graph nodes can be implemented easier than by using the worklist view. We present experimental data indicating that for some types of data flow problems, even single-threaded implementations of Observer-based data flow analysis have better run times than comparable worklist-based implementations.

The ways that the methods of data flow analysis can be applied to improve software reliability are described. There is also a review of the basic terminology from graph theory and from data flow analysis in global program optimization. The notation of regular expressions is used to describe actions on data for sets of paths. These expressions provide the basis of a classification scheme for data flow which represents patterns of data flow along paths within subprograms and along paths which cross subprogram boundaries. Fast algorithms, originally introduced for global optimization, are described and it is shown how they can be used to implement the classification scheme. It is then shown how these same algorithms can also be used to detect the presence of data flow anomalies which are symptomatic of programming errors. Finally, some characteristics of and experience with DAVE, a data flow analysis system embodying some of these ideas, are described.

In this work we present an algorithm for solving the reachability problem in finite systems that are modelled with process algebras. Our method uses Static Analysis, in particular, Data Flow Analysis, of the syntax of a process algebraic system with multi-way synchronisation. The results of the Data Flow Analysis are used in order to cut off some of the branches in the reachability analysis that are not important for determining, whether or not a state is reachable. In this way, it is possible for our reachability algorithm to avoid building large parts of the system altogether and still solve the reachability problem in a precise way.

SummaryMulti‐core systems equipped with micro processing units and accelerators such as digital signal processors (DSPs) and graphics processing units (GPUs) have become a major trend in processor design in recent years in attempts to meet ever‐increasing application performance requirements. Open Computing Language (OpenCL) is one of the programming languages that include new extensions proposed to exploit the computing power of these kinds of processors. Among the newly extended language features, the single‐instruction multiple‐data (SIMD) linguistics and vector types are added to OpenCL to exploit hardware features of the accelerators. The addition makes it necessary to consider how traditional compiler data flow analysis can be adopted to meet the optimization requirements of vector linguistics. In this paper, we propose a calculus framework to support the data flow analysis of vector constructs for OpenCL programs that compilers can use to perform SIMD optimizations. We model OpenCL vector operations as data access functions in the style of mathematical functions. We then show that the data flow analysis for OpenCL vector linguistics can be performed based on the data access functions. Based on the information gathered from data flow analysis, we illustrate a set of SIMD optimizations on OpenCL programs. The experimental results incorporating our calculus and our proposed compiler optimizations show that the proposed SIMD optimizations can provide average performance improvements of 22% on x86 CPUs and 4% on advanced micro devices GPUs. For the selected 15 benchmarks, 11 of them are improved on x86 CPUs, and six of them are improved on advanced micro devices GPUs. The proposed framework has the potential to be used to construct other SIMD optimizations on OpenCL programs. Copyright © 2015 John Wiley & Sons, Ltd.

A number of coverage criteria have been proposed for testing classes and class clusters modeled with state machines. Previous research has revealed their limitations in terms of their capability to detect faults. As these criteria can be considered to execute the control flow structure of the state machine, we are investigating how data flow information can be used to improve them in the context of UML state machines. More specifically, we investigate how such data flow analysis can be used to further refine the selection of a cost‐effective test suite among alternative, adequate test suites for a given state machine criterion. This paper presents a comprehensive methodology to perform data flow analysis of UML state machines—with a specific focus on identifying the data flow from OCL guard conditions and operation contracts—and applies it to a widely referenced coverage criterion, the round‐trip path (transition tree) criterion. It reports on two case studies whose results show that data flow information can be used to select the best transition tree, in terms of cost effectiveness, when more than one satisfies the transition tree criterion. The results also suggest that different trees are complementary in terms of the data flow that they exercise, thus, leading to the detection of intersecting but distinct subsets of faults. Copyright © 2009 John Wiley & Sons, Ltd.

Code optimization improves program performance through program analysis and program transformation, which transforms the program in an equivalent form. The basis of optimization is data flow analysis and control flow analysis. The paper first analyzes the characterization of Mgrid and the kernel Resid routine, including architecture analysis, data flow analysis, and dependence analysis, which is the basis of static optimization. Based on these characterization data, we first apply static optimization to Resid, including DMA access, data reuse, overlapping of computing and DMA, loop unrolling, common sub-expression extraction, Input Value Embedding, etc. and then loop blocking is applied to Resid, and genetic algorithm is utilized to search for the near-optimal blocking size, which further improves the performance of static optimization. The performance of Mgrid is improved by combing static analysis and empirical search, which is verified during the experiments.

The Android operating system dominates the smartphone market. Thus, to service the market, the number of Android applications has risen dramatically. These applications are processing a great amount of sensitive data, which could result in various concerns including data leakage and privacy violations. For example, applications may misuse the sensitive data stored on Android devices and violate the privacy of the user. Therefore, it is essential to maintain user privacy and protect sensitive data from leakage. Static data flow analysis approaches are used for analyzing Android applications to uncover security and privacy issues. However, these approaches frequently generate false alarms, given the different challenges created by Android applications, such as inter-component communication (ICC), reflection, and implicit flow. This work presents the DroidRista approach for conducting static data flow analysis on Android applications to detect sensitive data leakage. DroidRista analyzes ICC, reflection, and implicit flow in Android applications. To evaluate the performance of DroidRista, it was tested on three data sets. The results demonstrate improved performance in terms of detecting data leakage compared to existing static data flow analysis approaches.

To solve the problems of structure abstract representation in the software verification process, we define method of using process tree represent program, which can better represent program sequence structure and the relationship between call and return. Based on this data structures and μ-calculus, we definite μ - calculus of the process tree (PT - μ). Representation is divided into two levels: the first level take the nodes in a process tree as the basic unit, the second level take the summary as the basic unit. Summary is based on the relationship between call and return to represent the process of implementation, which also consider the possible simultaneous execution of other processes. PT - μ formulas also take into account of the classification of executive relations in the program. Experiments show that PT - μ can better represent the needs that to be verified, and better represent the reachability properties and better reflect the data flow relations in the data flow analysis.

Smart contracts on blockchain platforms are susceptible to security issues that can lead to significant financial losses. This study converts the Solidity code into abstract syntax trees and generates control flow graphs and data flow graphs. These graphs train a graph convolutional network model to detect security weaknesses. The proposed system outperforms traditional tools, achieving higher accuracy, recall, precision, and F1 scores when detecting weaknesses such as integer overflow/underflow, reentrancy, delegate call to the untrusted callee, and time-based issues. This study demonstrates that leveraging control and data flow analysis with graph neural networks significantly enhances smart contract security and provides a robust and reliable solution.

Analysis and mapping of national data flows and processes relevant to EFSA's business data collections is a long‐standing EFSA objective, originally launched with EFSA's SIGMA project in 2018‐2019 and further continued with the launch of a focused activity to “Develop, pilot and document a methodology for the data flow mapping and analysis in the European Member States” in 2023. The aim of latter activity is to apply a generic methodology for the analysis of any business data collection at Member State level with the ultimate purpose for countries and EFSA to increase understanding of data flows at national level, where existing challenges rely on and what common solutions could be implemented. This report presents results from the execution of the aforementioned methodology on Norway for the analysis of national data flows which contribute data to Food Consumption business data collection. The report contains information on the steps, participant organizations and actors, tools, systems, formats, structural and content metadata, as well as challenges and “pain points” identified in the country's internal data flows related to the collection of the selected data. The presented information has been generated based on the responses submitted by the participating Member State to a survey developed in the context of the data flow mapping and analysis methodology as well as relevant discussions held in a post‐survey interview with the country. Though the information presented on the current report represents real‐world data, it must be clarified that the survey and the follow‐up interview with the MS, have been both performed during the activity of the Data Flow Mapping methodology.

: This final report describes results of the Phase I SBIR research effort to develop new software testing techniques capable of satisfying the demands of distributed real-time software environments. Traditional software testing techniques are inadequate for distribute systems due to such complicating factors as non-deterministic execution, real-time timing constraints, task interaction event sequencing, race conditions, etc. During the course of the Phase I-effort, OTI investigate a wide variety of candidate technique. For each technique, OTI evaluated the feasibility and defined a research and development approach for the technique and required supporting technologies. Detailed comparison-of the attributes of each technique gives the following prioritization of techniques: Deterministic Execution Testing, Timing Analysis, Control Flow Testing, Dependency Analysis, Network Communication Testing, Data Flow Analysis, Problem Tracking Facility, Mutation Analysis, Static Concurrency Testing. OTI's research approach was based on developing new functionality on top of an existing software testing environment to construct the Environment for Test and Analysis of Distributed Software (ETADS). Distributed software testing, Software testing environment, Control flow analysis, Data flow analysis, Timing analysis, Software instrumentation, Non- determinism, Deterministic replay.

The specification language is a critical component of the hardware-software co-design process since it is used for functional validation and as a starting point for hardware-software partitioning and co-synthesis. The paper proposes the Java programming language as a specification language for hardware-software systems. Java has several characteristics that make it suitable for system specification. However static control and data flow analysis of Java programs is problematic because Java classes are dynamically linked. The paper provides a general solution to the problem of statically analyzing Java programs using a technique that pre-allocates most class instances and aggressively resolves memory aliasing using global analysis. The output of the analysis is a control data flow graph for the input specification. The results for sample designs show that the analysis can extract fine to coarse-grained concurrency for subsequent hardware-software partitioning and co-synthesis steps of the hardware-software co-design process to exploit.

A range of static analysis tools and techniques have been developed in recent years with the aim of helping JavaScript web application programmers produce code that is more robust, safe, and efficient. However, as shown in a previous large-scale study, many web applications use the JavaScript eval function to dynamically construct code from text strings in ways that obstruct existing static analyses. As a consequence, the analyses either fail to reason about the web applications or produce unsound or useless results.<br/><br/>We present an approach to soundly and automatically transform many common uses of eval into other language constructs to enable sound static analysis of web applications. By eliminating calls to eval, we expand the applicability of static analysis for JavaScript web applications in general.<br/><br/>The transformation we propose works by incorporating a refactoring technique into a dataflow analyzer. We report on our experimental results with a small collection of programming patterns extracted from popular web sites. Although there are inevitably cases where the transformation must give up, our technique succeeds in eliminating many nontrivial occurrences of eval.

As Android becomes popular, Android security acquires more and more attentions. This paper proposes a new system design strategy for dissemination of high fidelity applications. We propose to use static and dynamic data flow analysis on Android applications to detect about how the apps leverage users'/enterprises' sensitive data. Also, we plan to build up a cloud-based back-end to safeguard mobile devices. The new secure system framework will not only analyze an individual app isolatedly, but also analyze the correlation between apps.