The Clara framework for hybrid typestate analysis

Runtime monitoring allows programmers to validate, for instance, the proper use of application interfaces. Given a property specification, a runtime monitor tracks appropriate runtime events to detect violations and possibly execute recovery code. Although powerful, runtime monitoring inspects only one program run at a time and so may require many program runs to find errors. Therefore, in this paper, we present ahead-of-time techniques that can (1) prove the absence of property violations on all program runs, or (2) flag locations where violations are likely to occur. Our work focuses on tracematches, an expressive runtime monitoring notation for reasoning about groups of correlated objects. We describe a novel flow-sensitive static analysis for analyzing monitor states. Our abstraction captures both positive information (a set of objects could be in a particular monitor state) and negative information (the set is known not to be in a state). The analysis resolves heap references by combining the results of three points-to and alias analyses. We also propose a machine learning phase to filter out likely false positives. We applied a set of 13 tracematches to the DaCapo benchmark suite and SciMark2. Our static analysis rules out all potential points of failure in 50% of the cases, and 75% of false positives on average. Our machine learning algorithm correctly classifies the remaining potential points of failure in all but three of 461 cases. The approach revealed defects and suspicious code in three benchmark programs.

Programmers using complex libraries and frameworks are faced with the difficult task of ensuring that their implementations comply with complex and informally described rules for proper sequencing of API calls. Recent advances in static and dynamic techniques for checking explicit specifications of program typestate properties have shown promise in addressing this challenge. Unfortunately, static typestate analyses are limited in their scalability and dynamic analyses can suffer from significant run-time overhead. In this paper, we present an approach that exploits information calculated by flow-sensitive static typestate analyses to reformulate the original analysis problem as a residual dynamic typestate analysis. We demonstrate that residual analyses retain the error reporting of unoptimized dynamic analysis while offering the potential for significantly reducing analysis cost

Some trade-offs in reducing the overhead of assertion run-time checks via static analysis

For systems which deal with serious or dangerous things (for example nuclear power plant), programs are constrained by legislation to be safe in any case, which requires verification process during the execution, in other words “Runtime Verification” (RV). The field of runtime verification has many different names: runtime monitoring, runtime checking, runtime result checking, runtime reflection, monitoring oriented programming, design by contract, runtime analysis, dynamic analysis, trace analysis, fault protection, etc. Aspect-oriented programming (AOP) is a useful paradigm for monitoring programs, even if it was not created for this purpose. Indeed, AOP tries to deal with crosscutting concerns (tangled and scattered codes) by “capturing” them within a new entity called aspect, and runtime verification properties are conceptually transversal to the code they verify, unavoidably resulting in such crosscutting codes. AOP is always used as an extension of an existing language. Hence it is necessary to design an aspect language extending the target language, and to use what is called a weaver, to realize a binding operation between the target program and the aspects. Thus, one can find many aspect-programming extensions (including an aspect language and an aspect weaver) for most programming languages. The first one to be developed was AspectJ, designed for Java, and which has been the best-known reference among aspect-oriented tools until now. We use an AspectJ-like tool, straight inspired from AspectJ but designed for C, called ACC, which is itself an improved version of AspectC. The purpose of this paper is to explore the possibility of implementing and monitoring generic (also called parameterized) verification properties, i.e. which could be used on any target code, with ACC through a basic example. As ACC, contrary to AspectJ, does not provide abstraction for aspects, which would have made generic monitoring an easy task, we tried to simulate abstraction by making use of macros in the aspect code, which boils down to monitor every parameterized property within one macro function. We will see that despite losses of expressiveness without complexification of the monitoring code, the method still allows monitoring generically any property which is already monitorable directly in ACC.

The static program analysis is gradually adopting advanced use cases, and integration with programming tools becomes more necessary than ever. However, each integration requires a different kind of functionality implemented within an analyzer. For example, continuous integration tools typically analyze projects from scratch, while doing the same for code querying is not efficient performance-wise. The code behind such use cases makes «service models», and it tends to differ significantly between them. In this paper, we analyze the models which might be used by the static analyzer to provide its services based on aspects of security, performance, long-term storage. All models are assigned to one of the groups: logical presence (where the actual computation is performed), resource acquisition, input/output, change accounting and historic data tracking. The usage recommendations, advantages and disadvantages are listed for each reviewed model. Input/output models are tested for actual network throughput. We also describe the model which might aggregate all these use cases. The model is partially evaluated within the work-in-progress static analyzer Equid, and the observations are presented.

Static program analyses and transformations for Java face many problems when analyzing programs that use reflection or custom class loaders: How can a static analysis know which reflective calls the program will execute? How can it get hold of classes that the program loads from remote locations or even generates on the fly? And if the analysis transforms classes, how can these classes be re-inserted into a program that uses custom class loaders?

A practical algorithm for learning disjunctive abstraction heuristics in static program analysis

This paper presents an in-depth technical analysis of the Akira ransomware family, which has emerged as a prominent threat in the cybersecurity landscape between 2023 and 2025. Known for its advanced encryption techniques, anti-analysis mechanisms and targeted extortion campaigns, Akira demonstrates a sophisticated evolution of modern ransomware.The study applies both static and dynamic analysis methodologies to deconstruct Akira’s behavior and internal structure. Static analysis using tools such as Ghidra, PEStudio and FLOSS is used to extract key artifacts, analyze its PE structure and examine its encryption implementation and obfuscation techniques. Complementary dynamic analysis is performed in controlled sandbox environments using Any.Run, Procmon and Wireshark, revealing the ransomware's real-time activities, including file encryption behavior, registry modifications and potential network communications with command-and-control (C2) infrastructure. The research identifies critical indicators of compromise (IOCs), analyzes the encryption flow involving ChaCha20 and RSA and documents Akira’s ransomware note deployment and persistence mechanisms. The findings aim to support the development of more effective detection, classification and response frameworks in malware analysis and threat intelligence operations. This paper highlights how hybrid analysis techniques can uncover both surface-level and deeply embedded functionalities of emerging ransomware variants like Akira.

Traditionally, research in fault tolerance has required architectural state to be numerically perfect for program execution to be correct. However, in many programs, even if execution is not 100% numerically correct, the program can still appear to execute correctly from the user's perspective. To quantify user satisfaction, application-level fidelity metrics (such as PSNR) can be used. The output for such applications is defined to be correct if the fidelity metrics satisfy a certain threshold. However, such applications still contain instructions whose outputs are critical - i.e. their correctness decides if the overall quality of the program output is acceptable. In this paper, we present an analysis technique for identifying such critical program segments. More importantly, our technique is capable of guaranteeing application-level correctness through a combination of static analysis and runtime monitoring. Our static analysis consists of data flow analysis followed by control flow analysis to find static critical instructions which affect several instructions. Critical instructions are further refined into likely non-critical and likely critical sets in a profiling phase. At runtime, we use a monitoring scheme to monitor likely non-critical instructions and take remedial actions if some likely non-critical instructions become critical. Based on this analysis, we minimize the number of instructions that are duplicated and checked at runtime using a software-based fault detection and recovery technique [20]. Put together, our approach can lead to 22% average energy savings for multimedia applications while guaranteeing application-level correctness, when compared to a recent work [9], which cannot guarantee application-level correctness. Comparing to the approach proposed in [20] which guarantees both application-level and numerical correctness, our method achieves 79% energy reduction.

Soundness and completeness are two primary concerns of a static analysis tool for finding defects in software. Exhaustive static analysis of the program through all paths is not always possible, especially for a large software causing incompleteness in the analysis. Also, exhaustive testing of the program to detect all bugs is not possible. In this work, we describe a technique which uses coverage data from testing to remove the tested paths and then statically analyzes the remaining code. This pruning of tested paths allows a static analyzer to perform a more thorough analysis of the reduced code, thereby improving its effectiveness. This work is a step towards integration of static analysis and testing frameworks. The proposed technique is applied with a few static analyzers publicly available. Our experience shows that the approach results in lesser false positives as well as detection of more serious errors which might have gone unnoticed otherwise.

Static analysis of multi-staged programs is challenging because the basic assumption of conventional static analysis no longer holds: the program text itself is no longer a fixed static entity, but rather a dynamically constructed value. This article presents a semantic-preserving translation of multi-staged call-by-value programs into unstaged programs and a static analysis framework based on this translation. The translation is semantic-preserving in that every small-step reduction of a multi-staged program is simulated by the evaluation of its unstaged version. Thanks to this translation we can analyze multi-staged programs with existing static analysis techniques that have been developed for conventional unstaged programs: we first apply the unstaging translation, then we apply conventional static analysis to the unstaged version, and finally we cast the analysis results back in terms of the original staged program. Our translation handles staging constructs that have been evolved to be useful in practice (typified in Lisp's quasi-quotation): open code as values, unrestricted operations on references and intentional variable-capturing substitutions. This article omits references for which we refer the reader to our companion technical report.

How to apply automated verification technology such as model checking and static program analysis to millions of lines of embedded C/C++ code? How to package this technology in a way that it can be used by software developers and engineers, who might have no background in formal verification? And how to convince business managers to actually pay for such a software? This work addresses a number of those questions. Based on our own experience on developing and distributing the Goanna source code analyzer for detecting software bugs and security vulnerabilities in C/C++ code, we explain the underlying technology of model checking, static analysis and SMT solving, steps involved in creating industrial-proof tools.

To reduce the verification costs and to be more confident on software, static program analysis offers ways to prove properties on source code. Unfortunately, these techniques are difficult to apprehend and to use for non-specialists. Modelling allows users to specify some aspects of software in an easy way. More precisely, in embedded software, state machine models are frequently used for behavioural design. The aim of this paper is to bridge the gap between model and code by offering automatic generation of annotations from model to source code. These annotations are then verified by static analysis in order to ensure that the code behaviour conforms to the model-based design. The models we consider are UML state machines with a formal non-ambiguous semantics, the annotation generation and verification is implemented in a tool and applied to a case study.

Abstract—The increasing prevalence and sophistication of malware attacks have made it essential to develop advanced, automated detection systems. Traditional signature-based methods often fall short, particularly when faced with novel or polymorphic threats. This paper introduces an intelligent malware analysis framework that leverages deep learning models for effective and efficient real-time detection. Integrating both static and dynamic analysis, the system applies deep neural networks to classify software as malicious or benign. The framework aims to enhance detection accuracy, minimize false positives, and improve overall user experience. Keywords: Malware Detection, Deep Learning, User-Centric Security, Static Analysis, Dynamic Analysis, Neural Networks, Cybersecurity

Mission and safety requirements for next-generation aerospace vehicles have given rise to flight software with an ever-increasing level of complexity and autonomy. “Intelligence” is built into new and emerging designs through the development of novel algorithms that detect, learn, adapt, switch modes, coordinate, plan, etc. As the complexity of flight controllers grows, so does the cost associated with Verification and Validation (V&V). Current-generation controllers are already reaching a level of complexity that pushes the envelopes of existing V&V approaches, with little hope for affordable certification of nextgeneration intelligent systems under current V&V practices. One possible solution is to combine run-time monitors for advanced components with simple backup modules that provide a safe reversionary mode if undesirable behavior is detected. Such an architecture allows the V&V to be partitioned into design-time V&V (for the relatively simple monitor and fail-safe subsystems), and run-time V&V (for the full complex controller). A prototype run-time monitoring approach for flight-critical systems has been developed and demonstrated in batch and real-time simulations for a UAV system. Software faults were seeded into advanced control algorithms to test the runtime monitoring systems. In all experiments, it is shown that without a runtime V&V system, the vehicle either fails to accomplish the mission, or worse, is lost due to ensuing instability. With the runtime V&V system, the vehicle is saved and can either continue the mission or return to base.