Towards Static Analysis of Functional Programs Using Tree Automata Completion

Dynamic program analysis is extremely successful both in code debugging and in malicious code attacks. Fuzzing, concolic, and monkey testing are instances of the more general problem of analysing programs by dynamically executing their code with selected inputs. While static program analysis has a beautiful and well established theoretical foundation in abstract interpretation, dynamic analysis still lacks such a foundation. In this paper, we introduce a formal model for understanding the notion of precision in dynamic program analysis. It is known that in sound-by-construction static program analysis the precision amounts to completeness. In dynamic analysis, which is inherently unsound, precision boils down to a notion of coverage of execution traces with respect to what the observer (attacker or debugger) can effectively observe about the computation. We introduce a topological characterisation of the notion of coverage relatively to a given (fixed) observation for dynamic program analysis and we show how this coverage can be changed by semantic preserving code transformations. Once again, as well as in the case of static program analysis and abstract interpretation, also for dynamic analysis we can morph the precision of the analysis by transforming the code. In this context, we validate our model on well established code obfuscation and watermarking techniques. We confirm the efficiency of existing methods for preventing control-flow-graph extraction and data exploit by dynamic analysis, including a validation of the potency of fully homomorphic data encodings in code obfuscation.

Static analysis of multi-staged programs is challenging because the basic assumption of conventional static analysis no longer holds: the program text itself is no longer a fixed static entity, but rather a dynamically constructed value. This article presents a semantic-preserving translation of multi-staged call-by-value programs into unstaged programs and a static analysis framework based on this translation. The translation is semantic-preserving in that every small-step reduction of a multi-staged program is simulated by the evaluation of its unstaged version. Thanks to this translation we can analyze multi-staged programs with existing static analysis techniques that have been developed for conventional unstaged programs: we first apply the unstaging translation, then we apply conventional static analysis to the unstaged version, and finally we cast the analysis results back in terms of the original staged program. Our translation handles staging constructs that have been evolved to be useful in practice (typified in Lisp's quasi-quotation): open code as values, unrestricted operations on references and intentional variable-capturing substitutions. This article omits references for which we refer the reader to our companion technical report.

A practical algorithm for learning disjunctive abstraction heuristics in static program analysis

A typestate property describes which operations are available on an object or a group of inter-related objects, depending on this object’s or group’s internal state, the typestate. Researchers in the field of static analysis have devised static program analyses to prove the absence of typestate-property violations on all possible executions of a given program under test. Researchers in runtime verification, on the other hand, have developed powerful monitoring approaches that guarantee to capture property violations on actual executions. Although static analysis can greatly benefit runtime monitoring, up until now, most static analyses are incompatible with most monitoring tools. We present Clara, a novel framework that makes these approaches compatible. With Clara, researchers in static analysis can easily implement powerful typestate analyses. Runtime-verification researchers, on the other hand, can use Clara to specialize AspectJ-based runtime monitors to a particular target program. To make aspects compatible to Clara, the monitoring tool annotates them with so-called dependency state machines. Clara uses the static analyses to automatically convert an annotated monitoring aspect into a residual runtime monitor that is triggered by fewer program locations. If the static analysis succeeds on all locations, this proves that the program fulfills the stated typestate properties, making runtime monitoring entirely obsolete. If not, the residual runtime monitor is at least optimized. We instantiated Clara with three static typestate analyses and applied these analyses to monitoring aspects generated from tracematches. In two-thirds of the cases in our experiments, the static analysis succeeds on all locations, proving that the program fulfills the stated properties, and completely obviating the need for runtime monitoring. In the remaining cases, the runtime monitor is often significantly optimized.

Analyzing links among pages from different mobile apps is an important task of app analysis. Currently, most efforts of analyzing inter-app page links rely on static program analysis, which produces a lot of false positives, requiring significant manual effort to verify the links. To address the issue, in this paper, we propose LinkRadar, a data-driven approach to assisting the analysis of inter-app page links. Our key idea is to use dynamic program analysis to gather a set of actual inter-app page links, based on which we train a model to predict whether there exist links among pages from different apps to help verify the results of static program analysis. The challenge is that inter-app page links are hard to be triggered by dynamic program analysis, making it difficult to collect enough inter-app page links to train the model. Considering the similarity between intra-app page links and inter-app page links, we use transfer learning to deal with the data scarcity problem. Evaluation results show that LinkRadar is able to infer the inter-app page links with high accuracy.

Static program analysis is used to summarize properties over all dynamic\nexecutions. In a unifying approach based on 3-valued logic properties are\neither assigned a definite value or unknown. But in summarizing a set of\nexecutions, a property is more accurately represented as being biased towards\ntrue, or towards false. Compilers use program analysis to determine benefit of\nan optimization. Since benefit (e.g., performance) is justified based on the\ncommon case understanding bias is essential in guiding the compiler.\nFurthermore, successful optimization also relies on understanding the quality\nof the information, i.e. the plausibility of the bias. If the quality of the\nstatic information is too low to form a decision we would like a mechanism that\nimproves dynamically.\n We consider the problem of building such a reasoning framework and present\nthe fuzzy data-flow analysis. Our approach generalize previous work that use\n3-valued logic. We derive fuzzy extensions of data-flow analyses used by the\nlazy code motion optimization and unveil opportunities previous work would not\ndetect due to limited expressiveness. Furthermore we show how the results of\nour analysis can be used in an adaptive classifier that improve as the\napplication executes.\n

Static program analyses and transformations for Java face many problems when analyzing programs that use reflection or custom class loaders: How can a static analysis know which reflective calls the program will execute? How can it get hold of classes that the program loads from remote locations or even generates on the fly? And if the analysis transforms classes, how can these classes be re-inserted into a program that uses custom class loaders?

Static program analysis has many applications including bug checking for large scale code that requires a points-to analysis. To express static program analysis frameworks concisely, it is advantageous to employ a domain-specific language. In the last two decades, Data log has emerged as a domain-specific language for static program analysis. However, existing Data log systems have problems solving large scale code with millions of program variables. This work reports on techniques that translate a Data log program to SQL queries, which are executed on a relational database system. The advantage of a relational database system as an execution platform is the effective use of memory and disks. Further, we can also use an off-the shelf tool to execute the SQL queries. In order to achieve performance, we explore some of the design choices for a source-to-source translation from Data log to SQL that implement stratified negations, totally ordered domains, and comparisons. For each design point, we explain how Data log can be efficiently translated to SQL using the semi-naive evaluation approach. We report the results of our experiments using large data-sets including the OpenJDK7-b147 dataset for points-to, which guided us in the design of our translation schemes.

We propose an approach for the static analysis of probabilistic programs that sense, manipulate, and control based on uncertain data. Examples include programs used in risk analysis, medical decision making and cyber-physical systems. Correctness properties of such programs take the form of queries that seek the probabilities of assertions over program variables. We present a static analysis approach that provides guaranteed interval bounds on the values (assertion probabilities) of such queries. First, we observe that for probabilistic programs, it is possible to conclude facts about the behavior of the entire program by choosing a finite, adequate set of its paths. We provide strategies for choosing such a set of paths and verifying its adequacy. The queries are evaluated over each path by a combination of symbolic execution and probabilistic volume-bound computations. Each path yields interval bounds that can be summed up with a coverage bound to yield an interval that encloses the probability of assertion for the program as a whole. We demonstrate promising results on a suite of benchmarks from many different sources including robotic manipulators and medical decision making programs.

Synchronous programming languages are well-suited for the design of safety-critical real-time embedded systems. However, the compilers and synthesis procedures are challenged by the synchronous programming paradigm and have to solve additional problems like causality and schizophrenia problems. Algorithms to solve these basic compilation problems have already become mature, but code optimization still lacks behind. Often, code optimization is left to the back-end tools like compilers for sequential software or hardware synthesis tools. In this paper, we develop a static analysis procedure to introduce code optimization techniques to synchronous languages. We develop specialized code optimization procedures that can be applied to all kinds of synchronous languages. Similar to the code optimization techniques used for the compilation of sequential software, our procedures are also based on a static data-flow analysis that is adapted to the synchronous programing model.

Model-Driven Engineering (MDE) has been successfully used in static program analysis. Frameworks like MoDisco inject the program structure into a model, available for further processing by query and transformation tools, e.g., for program understanding, reverse-engineering, modernization. In this paper we present our first steps towards extending MoDisco with capabilities for dynamic program analysis.

KABA is an innovative system for refactoring Java class hierar-chies. It uses the Snelting/Tip algorithm [13] in order to determine a behavior-preserving refactoring which is optimal with respect to a given set of client programs. KABA can be based on dynamic as well as static program analysis. The static variant will preserve program behavior for all possible input values; the dynamic version guarantees preservation of behavior for all runs in a given test suite. KABA offers automatic refactoring as well as manual refactoring using a dedicated editor.

KABA is an innovative system for refactoring Java class hierar-chies. It uses the Snelting/Tip algorithm [13] in order to determine a behavior-preserving refactoring which is optimal with respect to a given set of client programs. KABA can be based on dynamic as well as static program analysis. The static variant will preserve program behavior for all possible input values; the dynamic version guarantees preservation of behavior for all runs in a given test suite. KABA offers automatic refactoring as well as manual refactoring using a dedicated editor. In this contribution, we recapitulate the Snelting/Tip algorithm, present the new dynamic version, and explain new extensions which allow to handle full Java. We then present five case studies which discuss the KABA refactoring proposals for programs such as javac and antlr. KABA proved that javac does not need refactoring, but generated semantics-based refactoring proposals for antlr.

The co-occurrence of multiple code smells in Android applications poses a more serious threat to software maintainability and stability than individual smells. However, most existing studies still concentrate on detecting single types of smells. This study aims to detect prevalent co-occurring Android-specific code smells, Message Chains (MC) and Member Ignoring Method (MIM). We propose an approach that integrates static program analysis with a dynamic stacking ensemble learning method. First, we design a heuristic-based static analysis algorithm for MC smell detection and extend it to identify the co-occurrence of MC and MIM. To support training, an automated sample generation technique, implemented in a tool named Android-specific Smell Detection (ASSD), produces labeled positive and negative samples. Finally, our approach employs a Dynamic Stacking Ensemble with Backward Elimination (DSE-BE), which combines five conventional machine learning models with three deep learning models. The experimental results demonstrate substantial improvements compared with manual detection methods, with the F1 score increasing from 0.774 to 0.938 and the MCC from 0.623 to 0.874. Moreover, the DSE-BE strategy not only outperforms individual models but also reduces ensemble complexity, improving computational efficiency. This method provides a robust solution for detecting co-occurring code smells in Android applications and holds strong potential for practical application.

This paper describes a family of tools which not only supports software development, but also assures the quality of each software product from the requirements definition to the integrated system. It is based upon an explicit definition of the design objectives and includes specification verification, design evaluation, static program analysis, dynamic program analysis, integration test auditing, and configuration management.