Using Ensemble Learning to Improve Automatic Vectorization of Tensor Contraction Program

Spatial architecture is a high-performance paradigm that employs control flow graphs and data flow graphs as computation model, and producer/consumer models as execution model. However, existing spatial architectures struggle with control flow handling challenges. Upon thoroughly characterizing their PE execution models, we observe that they lack autonomous, peer-to-peer, and temporally loosely-coupled control flow handling capability. This degrades its performance in intensive control programs. To tackle the existing control flow handling challenges, Marionette, a spatial architecture with an explicit-designed control flow plane, is proposed. We elaborately develop a full stack of Marionette architecture, from ISA, compiler, simulator to RTL. Marionette's flexible Control Flow Plane enables autonomous, peer-to-peer, and temporally loosely-coupled control flow management. Its Proactive PE Configuration ensures computation-overlapped and timely configuration to promote Branch Divergence handling capability. Besides, Marionette's Agile PE Assignment improves pipeline performance of imperfect loops. Compared to state-of-the-art spatial architectures, the experimental results demonstrate that Marionette outperforms Softbrain, TIA, REVEL, and RipTide by geomean 2.88<inline-formula><tex-math notation="LaTeX">$\mathbf{\times}$</tex-math></inline-formula>, 3.38<inline-formula><tex-math notation="LaTeX">$\mathbf{\times}$</tex-math></inline-formula>, 1.55<inline-formula><tex-math notation="LaTeX">$\mathbf{\times}$</tex-math></inline-formula>, and 2.66<inline-formula><tex-math notation="LaTeX">$\mathbf{\times}$</tex-math></inline-formula> in a variety of challenging intensive control programs.

Aim of the new methodology proposed is to extract, from a behavioral circuit description, all information on the regularity of the computation. Array architectures optimally implement the extracted regular behavior. A high-level synthesis tool for such arrays has been defined. First, the problem of translating a hardware description language (either VHDL or Hardware C) into and internal representation useful for the exploration of different alternative architectures is afforded. Here the main problems relate to the different interpretations that can be given to an HDL description during the behavioral synthesis step. A set of design rules for writing the specifications has been identified. Then the internal design representation is studied. A hierarchical graph-based representation has been adopted which contains all information needed to identify possible regularities. The hierarchical structure is composed of a data flow graph (DFG) that holds information about data and operations performed and of a control flow graph (CFG) representing the condition clauses causing the choice of the computations to be performed. All information needed to identify the regular structures, can be derived from the DFG alone, while the information of the CFG is useful to correctly synthesize the control machine. The proposed high-level synthesis approach has been implemented into a module called Orpheus, which can be connected to the Olympus synthesis system.< <ETX xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">&gt;</ETX>

This paper explores the problem of identifying malicious code sections in applications for the Android. A method for analyzing Android applications is proposed, based on applying of static analysis using control flow graphs and data flow graphs. The paper formally describes the dependency relationships that are used to construct graphs, and also describes an algorithm that allows to identify malicious sections of code using the received graphs. The results of an experimental evaluation of the effectiveness of the proposed method are presented, demonstrated a high probability of detecting malicious portions of the code of Android applications.

An Ameliorated Methodology for the Abstraction of Object Oriented Features from Software Requirements Specification

소프트웨어의 취약성을 검증하기 위하여 소프트웨어의 구조를 유추하여 유추된 구조를 활용하여 테스트하는 방법이 주목받고 있다. 이와 같은 방법을 사용하기 위해서 효과적인 소프트웨어의 구조 유추 방법이 요구된다. 많이 사용되는 DFG(Data Flow Graph), CFG(Control Flow Graph) 이나 CFA(Control Flow Automata)와 같은 그래프나 트리 방식은 소프트웨어 모델을 구조적으로 표현하지 못하는 단점을 가진다. 본 논문에서는 이러한 단점을 극복할 수 있는 방법을 제시한다. 제시된 방법은 바이너리 코드에 다양한 입력데이터 들을 부여하여 입력데이터별 CFG를 생성하고, 생성된 CFG들이 구조적으로 표현될 수 있도록 계층적 제어 흐름 그래프(Hierarchical Control Flow Graph, HCFG)를 작성한다. 또한 제안하는 HCFG을 생성하는데 요구되는 그래프의 구성요소와 점진적 그래프 생성 알고리듬도 제시한다. 제안한 방법론을 공개된 SMTP(Simple Mail Transfer Protocol) 서버 프로그램에 적용시켜 소프트웨어의 모델을 작성하는 실험을 수행하고, 생성된 모델과 실제 소프트웨어 구조를 비교 분석한다. To verify software vulnerability, the method of conjecturing software structure and then testing the software based on the conjectured structure has been highlighted. To utilize the method, an efficient way to conjecture software structure is required. The popular graph and tree methods such as DFG(Data Flow Graph), CFG(Control Flow Graph) and CFA(Control Flow Automata) have a serious drawback. That is, they cannot express software in a hierarchical fashion. In this paper, we propose a method to overcome the drawback. The proposed method applies various input data to a binary code, generate CFG's based on the code output and construct a HCFG (Hierarchical Control Flow Graph) to express the generated CFG's in a hierarchical structure. The components required for HCFG and progressive algorithm to construct HCFG are also proposed. The proposed method is verified through constructing the software architecture of an open SMTP(Simple Mail Transfer Protocol) server program. The structure generated by the proposed method and the real program structure are compared and analyzed.

In this paper an optimum algorithm to translate control flow graphs to dataflow graphs is proposed for dataflow execution of sequential programs. Some of the existing analysis methods restrict the specification of a program to be processed while others require a very high analysis cost. The algorithm proposed in this paper (CD translation algorithm), (1) with a very low cost, and (2) for any control structure that can be described by a control flow graph, (3) can generate dataflow programs that give an optimum dataflow execution. Furthermore, this proposed analysis algorithm is designed to handle task level control flow graphs as well as instruction level control flow graphs, which are accepted by the existing methods, so that optimum control is possible for task level dataflow execution.

This paper presents a novel methodology for automated parallel exploration of datapath and Unrolling Factor (UF) in High Level Synthesis (HLS) using hyper-dimensional particle encoding based swarm intelligence (termed as ‘H-SI’) for control and data flow graphs (CDFGs). The major novel contributions of the proposed approach are as follows: (a) Hybrid design space exploration (DSE) framework that concurrently balances the tradeoff between the following: i) conflicting metrics of power - execution time ii) control states and execution delay during loop unrolling iii) orthogonal condition of enhancing Quality of Results (QoR) and reducing the exploration runtime; (b) automated parallel exploration of data path and loop UF through an integrated hyper-dimensional particle encoding approach using swarm intelligence; (c) power model for evaluation of design points during exploration; (d) model for estimation of execution delay of a loop unrolled CDFG (for any UF value) based on an available resource without necessity of tediously unrolling the entire CDFG in most cases. Results indicated an average improvement in QoR of >38 % and reduction in runtime of > 93 % compared to recent approaches.

The paper presents an approach to reduce interconnect cost by insertion of identity operations in a control and data flow graph (CDFG). Other than previous approaches, it is based on systematic pattern analysis and automated transformation selection. The cost function controlling transformation selection is derived with statistical experiments and is optimized using practical benchmarks. The results show significantly reduced interconnect cost for most register architectures and application examples.

Many data-driven software engineering tasks such as discovering programming patterns, mining API specifications, etc., perform source code analysis over control flow graphs (CFGs) at scale. Analyzing millions of CFGs can be expensive and performance of the analysis heavily depends on the underlying CFG traversal strategy. State-of-the-art analysis frameworks use a fixed traversal strategy. We argue that a single traversal strategy does not fit all kinds of analyses and CFGs and propose bespoke control flow analysis (BCFA). Given a control flow analysis (CFA) and a large number of CFGs, BCFA selects the most efficient traversal strategy for each CFG. BCFA extracts a set of properties of the CFA by analyzing the code of the CFA and combines it with properties of the CFG, such as branching factor and cyclicity, for selecting the optimal traversal strategy. We have implemented BCFA in Boa, and evaluated BCFA using a set of representative static analyses that mainly involve traversing CFGs and two large datasets containing 287 thousand and 162 million CFGs. Our results show that BCFA can speedup the large scale analyses by 1%-28%. Further, BCFA has low overheads; less than 0.2%, and low misprediction rate; less than 0.01%.

Large Language Models (LLMs) have gained traction in domains from software development to cybersecurity, particularly for detecting vulnerabilities in program source code. Their ability to analyze large codebases and identify security weaknesses makes them valuable in software security analysis. However, their effectiveness declines in the absence of intermediate representations such as Abstract Syntax Trees (AST), Control Flow Graphs (CFG), and Data Flow Graphs (DFG), or even tokenized forms of code. In this research study, we assess the performance of LLMs in detecting vulnerabilities directly from raw source code, without structural representations. By designing context-specific prompts, we aim to enhance the model's understanding of code semantics. Our findings show that LLMs can partially identify vulnerabilities from raw code alone, reaching up to 43% accuracy. This indicate both the potential and current limitations of prompt-based LLMs for static vulnerability detection.

BGNN4VD: Constructing Bidirectional Graph Neural-Network for Vulnerability Detection

Current software defect prediction and code quality assessment methods treat these inherently related tasks independently, failing to leverage their complementary information. Existing graph-based approaches lack the ability to jointly model structural dependencies and quality characteristics, limiting their effectiveness in capturing the complex relationships between defect patterns and code quality indicators. This paper proposes a novel integrated model that simultaneously tackles both objectives using graph neural networks to leverage the inherent graph structure of software systems. Our novelty lies in the first-of-its-kind integration of multi-level graph representations (AST, CFG, DFG) with a dual-branch attention-based GNN architecture for simultaneous defect prediction and quality assessment. Our approach constructs multi-level graph representations by integrating abstract syntax trees, control flow graphs, and data flow graphs, capturing both syntactic and semantic relationships in source code. The proposed dual-branch GNN architecture employs shared representation learning with attention mechanisms and multi-task optimization to exploit complementary information between defect prediction and quality assessment tasks. Comprehensive experiments on six real-world software projects demonstrate significant improvements over traditional methods, achieving F1-scores of 0.811 and AUC values of 0.896 for defect prediction, while showing 9.3% average improvement in code quality assessment accuracy across multiple quality dimensions. The integration strategy proves effective in capturing complex structural dependencies and provides actionable insights for software development teams, establishing a foundation for intelligent software engineering tools that deliver comprehensive code analysis capabilities.

Insider threats pose a significant challenge to organizational cybersecurity, especially when coupled with sophisticated techniques such as IP spoofing to obfuscate the origin of malicious activity. This study aims to identify insider threats that exploit IP spoofing by leveraging machine learning algorithms, specifically Decision Tree and Random Forest models. A labeled dataset containing network traffic with features indicative of spoofed and legitimate IP activity was utilized. Preprocessing steps included feature selection, normalization, and data balancing to ensure model robustness. The Decision Tree model provided interpretable rules for classifying traffic patterns, while the Random Forest model improved predictive accuracy through ensemble learning. Both models were trained and tested using k-fold cross-validation to minimize overfitting and ensure generalization. Performance metrics such as accuracy, precision, recall, and F1-score were used to evaluate model effectiveness. Results indicated that the Random Forest outperformed the Decision Tree, achieving higher accuracy and better detection rates of spoofed insider activity. The findings demonstrate the feasibility of using ML-based approaches to detect complex insider threats that leverage IP spoofing, providing actionable insights for network security operations. Future work will explore real-time implementation and the integration of additional behavioral indicators to enhance detection capabilities in dynamic network environments. Keywords: Investigation, Machine learning algorithms, Detecting, Insider Threats, IP Spoofing, Organizational Networks.

Low-level languages like C/C++ are widely used in various applications for their performance and flexibility. Unfortunately, these languages are prone to memory corruption vulnerabilities, leading to control-flow hijacking attacks. Control flow integrity (CFI) is a general principle to enforce run-time control flow of a program to a pre-computed control-flow graph (CFG). While the traditional context-insensitive CFI falls short in protecting critical control transfers, recent context-sensitive CFI research shows promising improvements but has various limitations. We present Control Flow Integrity with Look Back (CFI-LB), a call-site sensitive CFI in which a conventional source-target control transfer is strengthened by a look back into its call-sites (return addresses). CFI-LB features the adaptive call-site sensitivity in which each indirect call has its own level of sensitivity and the multi-scope CFG to improve the security even if a precise context-sensitive static CFG is not available, especially for large programs such as GCC and NGINX. One of the CFGs is constructed by our localized concolic execution, which significantly extends the dynamic CFG with very low false positives. In addition, CFI-LB is the first CFI system explicitly designed to protect its reference monitors from race conditions. We have built a prototype of CFI-LB. The evaluation with SPEC CPU2006 benchmarks and NGINX indicates that CFI-LB has a low-performance overhead (less than 5% on average for the full protection) while increasing the security.

Smart contracts on blockchain platforms are susceptible to security issues that can lead to significant financial losses. This study converts the Solidity code into abstract syntax trees and generates control flow graphs and data flow graphs. These graphs train a graph convolutional network model to detect security weaknesses. The proposed system outperforms traditional tools, achieving higher accuracy, recall, precision, and F1 scores when detecting weaknesses such as integer overflow/underflow, reentrancy, delegate call to the untrusted callee, and time-based issues. This study demonstrates that leveraging control and data flow analysis with graph neural networks significantly enhances smart contract security and provides a robust and reliable solution.