Unified control flow and data dependence traces

In this tutorial, we present a comprehensive approach to non-intrusive monitoring of multi-core processors. Modern multi-core processors come with trace-ports that provide a highly compressed trace of the instructions executed by the processor. We describe how these compressed traces can be used to reconstruct the actual control flow trace executed by the program running on the processor and to carry out analyses on the control flow trace in real time using FPGAs. We further give an introduction to the temporal stream-based specification language TeSSLa and show how it can be used to specify typical constraints of a cyber-physical system from the railway domain. Finally, we describe how light-weight, hardware-supported instrumentation can be used to enrich the control-flow trace with data values from the application.

Droid-MCFG: Android malware detection system using manifest and control flow traces with multi-head temporal convolutional network

Superblock compilation techniques such as control flow graph (CFG) or trace compilation have become a widely adopted approach to increase the performance of dynamically compiling virtual machines even further. While this was shown to be successful for many conventional virtual machines, it did not result in a higher performance for Java-based DBT machine emulators so far. These emulators dynamically translate application binaries of a target machine into Java bytecode, which is then eventually compiled into the native code of the emulating host by the Java Virtual Machine (JVM). Successful superblock compilation techniques for this class of emulators must consider the special requirements that result from the two-stage translation as well as the characteristics of the JVM, such as the inability of most Java JIT compilers to handle large bytecode methods efficiently. In this paper, we present a superblock compilation approach for a Java-based DBT machine emulator that generates a performance increase of up to 90 percent and of 32 percent on average. The key idea of our design is to provide a large scope over the control flow of target applications across basic block boundaries for the JVM, while still keeping small bytecode methods for the execution units. In addition, we also present two further optimizations -- interpreter context elimination and program counter elimination -- which increase the emulation performance by 16 percent again. In total, the optimization techniques discussed in this paper provide an average performance gain of 48 percent for the surveyed emulator.

JavaScript is currently the dominating client-side scripting language in the web community. However, the source code of JavaScript can be easily copied through a browser. The intellectual property right of the developers lacks protection. In this paper, we consider using dynamic software birthmark for JavaScript. Instead of using control flow trace (which can be corrupted by code obfuscation) and API (which may not work if the software does not have many API calls), we exploit the run-time heap, which reflects substantially the dynamic behavior of a program, to extract birthmarks. We introduce JSBiRTH, a novel software birthmark system for JavaScript based on the comparison of run-time heaps. We evaluated our system using 20 JavaScript programs with most of them being large-scale. Our system gave no false positive or false negative. Moreover, it is robust against code obfuscation attack. We also show that our system is effective in detecting partial code theft.

We develop a method for matching dynamic histories of program executions of two program versions. The matches produced can be useful in many applications including software piracy detection and several debugging scenarios. Unlike some static approaches for matching program versions, our approach does not require access to source code of the two program versions because dynamic histories can be collected by running instrumented versions of program binaries. We base our matching algorithm on comparison of rich program execution histories which include: control flow taken, values produced, addresses referenced, as well as data dependences exercised. In developing a matching algorithm we had two goals: producing an accurate match and producing it quickly. By using rich execution history, we are able to compare the program versions across many behavioral dimensions. The result is a fast and highly precise matching algorithm. Our algorithm first uses individual histories of instructions to identify multiple potential matches and then it refines the set of matches by matching the data dependence structure established by the matching instructions. To test our algorithm we attempted matching of execution histories of unoptimized and optimized program versions. Our results show that our algorithm produces highly accurate matches which are highly effective when used in comparison checking approach to debugging optimized code.

Graph models have been useful abstraction for examining the programmer's perspective of the static structure of imperative programs. A number of Graph models referring to control flow and data dependencies have appeared in the literature. The primary objective of this research is to develop a more general graph-theoretic model for describing programs written in arbitrary imperative languages and to compute a structural measure based on this abstraction. The proposed model is a synthesis of the control flow graph and the data dependency graph. This new unified abstraction, called the Generalized Program Graph (GPG), is structurally equivalent to the string from of a program. However, because of its graph structure, the new model is better suited for structural analysis of a program than original string form.

Due to its large size, a whole program path (WPP) is stored in compressed form generated using SEQUITUR. The occurrence of an intraprocedural path in the WPP cannot be carried out using existing algorithms due to the path interruption and path context problems. We present an algorithm that addresses the above problems. The complexity of the algorithm is analyzed and experimental data is presented to demonstrate that our algorithm is efficient in practice.

In this paper we examine two methods for controlling the execution of parallel logic programs. Specifically, we compare control driven execution of PRISM programs vs. data driven execution of Concurrent Prolog. Given a PRISM program we present several automatic transformations for deriving a Concurrent Prolog program whose execution is isomorphic to the original program. Although in many specific cases we may be able to write very natural specifications based on read-only variable and commit constructs, in general it is difficult to simulate control flow naturally using a transformation based on these constructs. Since control flow primitives are shown to have a simple and efficient implementation it seems that both data-flow and control-flow mechanisms are desirable for a general purpose parallel logic programming language. Subsequently, we propose a simple low level language to implement both PRISM nested control flow and Concurrent Prolog read-only variables. The idea is to convert the control/data dependencies into simple event scripts and then use existing methods to implement these scripts efficiently. Finally, we introduce a data structure that supports an efficient implementation of PRISM nested control flow.

Nowadays, multicore processor is common presence and available everywhere. However, when we try to speedup non-numerical programs, which are used by ordinary users much especially on both desktop and mobile computers, by introducing parallel computation on multicore processors, it is necessary to strictly keep both control and data dependencies between parallel tasks in order to get the correct computation result. In many cases, parallel computation is difficult for non-numerical programs on multicore processors, since these dependencies are complicated. To solve this problem,we propose a method of speculative thread-level parallel computation along the hot path, the most frequently executed control flow, on entire program, assuming the use of the support hardware of speculative multithreading. This utilizes the general property of program codes, that is, the control flow of program tends to be highly biased to quite a small number of path even if the program code contains many possibilities of paths. Our method divides conventional serial program into thread codes along the hot path, and the thread codes are executed in parallel on each processor core on multicore processor. Preliminary performance evaluation by trace-based simulation using SPEC CINT2000, that is the collection of practical programs for performance valuation purpose, shows that the speedup of 2.48 times at maximum and 1.94 times on average can be expected by using our method, as compared to the serial execution.

Adding static data dependence collapsing to a high-performance instruction scheduler

The current approach for testing a program is, in principle, quite primitive. Some small sample of the data that a program is expected to handle is presented to the program. If the program produces correct results for the sample, it is assumed to be correct. Much current work focuses on the question of how to choose this sample. We propose that a program can be more effectively tested by executing it "symbolically." Instead of supplying specific constants as input values to a program being tested, one supplies symbols. The normal computational definitions for the basic operations performed by a program can be expanded to accept symbolic inputs and produce symbolic formulae as output. If the flow of control in the program is completely independent of its input parameters, then all output values can be symbolically computed as formulae over the symbolic inputs and examined for correctness. When the control flow of the program is input dependent, a case analysis can be performed producing output formulae for each class of inputs determined by the control flow dependencies. Using these ideas, we have designed and implemented an interactive debugging/testing system called EFFIGY.

The schedulability analysis of real-time embedded systems requires worst case execution time (WCET) analysis for the individual tasks. Bounding WCET involves not only language-level program path analysis, but also modeling the performance impact of complex micro-architectural features present in modern processors. In this paper, we statically analyze the execution time of embedded software on processors with speculative execution. The speculation of conditional branch outcomes (branch prediction) significantly improves a program's execution time. Thus, accurate modeling of control speculation is important for calculating tight WCET estimates. We present a parameterized framework to model the different branch prediction schemes. We further consider the complex interaction between speculative execution and instruction cache performance, that is, the fact that speculatively executed blocks can generate additional cache hits/misses. We extend our modeling to capture this effect of branch prediction on cache performance. Starting with the control flow graph of a program, our technique uses integer linear programming to estimate the program's WCET. The accuracy of our method is demonstrated by tight estimates obtained on realistic benchmarks.

Trace-driven simulation is an important aid in performance analysis of computer systems. Capturing address traces for these simulations is a difficult problem for single processors and particularly for multicomputers. Even when existing trace methods can be used on multicomputers, the amount of collected data typically grows with the number of processors, so I/O and trace storage costs increase. A new technique is presented in this paper which modifies the executable code to dynamically collect the address trace from the user code and analyzes this trace during the execution of the program. This method helps resolve the I/O and storage problems and facilitates parallel analysis of the address trace. If a trace stored on disk is desired, the generated trace information can also be written to files during execution, with a resultant drop in program execution speed. An initial implementation on the Intel iPSC/2 hypercube multicomputer is detailed, and sample simulation results are presented. The effect of this trace collection method on execution time is illustrated.

Statistical debuggers use data collected during test case execution to automatically identify the location of faults within software. Recent work has applied causal inference to eliminate or reduce control and data flow dependence confounding bias in statement-level statistical debuggers. The result is improved effectiveness. This is encouraging but motivates two novel questions: (1) how can causal inference be applied in predicate-level statistical debuggers and (2) what other biases can be eliminated or reduced. Here we address both questions by providing a model that eliminates or reduces control flow dependence and failure flow confounding bias within predicate-level statistical debuggers. We present empirical results demonstrating that our model significantly improves the effectiveness of a variety of predicate-level statistical debuggers, including those that eliminate or reduce only a single source of confounding bias.

SummaryComprehensive, automated software testing requires an oracle to check whether the output produced by a test case matches the expected behaviour of the programme. But the challenges in creating suitable oracles limit the ability to perform automated testing in some programmes, and especially in scientific software. Metamorphic testing is a method for automating the testing process for programmes without test oracles. This technique operates by checking whether the programme behaves according to properties called metamorphic relations. A metamorphic relation describes the change in output when the input is changed in a prescribed way. Unfortunately, finding the metamorphic relations satisfied by a programme or function remains a labour‐intensive task, which is generally performed by a domain expert or a programmer. In this work, we propose a machine learning approach for predicting metamorphic relations that uses a graph‐based representation of a programme to represent control flow and data dependency information. In earlier work, we found that simple features derived from such graphs provide good performance. An analysis of the features used in this earlier work led us to explore the effectiveness of several representations of those graphs using the machine learning framework of graph kernels, which provide various ways of measuring similarity between graphs. Our results show that a graph kernel that evaluates the contribution of all paths in the graph has the best accuracy and that control flow information is more useful than data dependency information. The data used in this study are available for download at http://www.cs.colostate.edu/saxs/MRpred/functions.tar.gz to help researchers in further development of metamorphic relation prediction methods. Copyright © 2015 John Wiley & Sons, Ltd.