Untitled

Chae, Heung Seok; Park, Jae Geol; Cui, Jian Feng; Lee, Joon Sang

doi:10.1002/spe.v40:6

Cited by 32 publications

(2 citation statements)

References 82 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Related to our work is the large body of research in worst-case execution time analysis-in particular for real-time systems [17][18][19][20]. There are many techniques for worst-case execution time estimation leveraging model checking [21][22][23], symbolic execution [24,25], integer linear programming [23,26], abstract interpretation [27], or a combination [22]. An overview can be found in Wilhelm et al [28].…”

Section: Related Workmentioning

confidence: 99%

Complexity vulnerability analysis using symbolic execution

Luckow

Kersten

Păsăreanu

2020

Software Testing Verif & Rel

View full text Add to dashboard Cite

We describe techniques based on symbolic execution for finding software vulnerabilities that are due to algorithmic complexity. Such vulnerabilities allow an attacker to mount denial-of-service attacks to deny service to benign users or to otherwise disable a software system. The techniques use an efficient guided symbolic execution of a program to compute bounds on the worstcase complexity (for increasing input sizes) and to generate test values that trigger the worst-case behaviours. The resulting bounds are fitted to a function to obtain a prediction of the worst-case program behaviour at any input size. Scalability is achieved by using path policies that guide the symbolic execution towards worst-case paths. The policies are learned from the worst-case results obtained with exhaustive exploration at small input sizes and are applied to guide exploration at larger input sizes, where unguided exhaustive exploration is not possible. To achieve precision in the analysis, the path policies take into account the history of choices made along the path when deciding which branch to execute next. Furthermore, the computation is contextpreserving, meaning that the decision for each branch depends on the history computed with respect to the enclosing method. We further report preliminary results on a complementary technique that uses machine learning for building the path policies that guide the search. The techniques are implemented in open-source projects that build on the Symbolic Pathfinder tool for analysing Java programs. Experimental evaluation shows that the techniques can find vulnerabilities in complex Java programs and can outperform previous symbolic approaches.

show abstract

Section: Related Workmentioning

confidence: 99%

Complexity vulnerability analysis using symbolic execution

Luckow

Kersten

Păsăreanu

2020

Software Testing Verif & Rel

View full text Add to dashboard Cite

show abstract

“…In order to execute complex JVM bytecode instructions, the processor translates them to a sequence of microcode instructions, using a statically known translation scheme. The timing behavior of high-level bytecode instructions can be derived by means of an automated analysis [10]. Additionally, the processor features novel cache architectures (e.g., method cache, stack cache), which allow to decouple the timing analysis of instructions from the analysis of caches.…”

Section: Java Optimized Processormentioning

confidence: 99%

Time-predictable code execution — Instruction-set support for the single-path approach

Geyer

Huber

Prokesch

et al. 2013

16th IEEE International Symposium on Object/Component/Service-Oriented Real-Time Distributed Computing (ISORC 2013)

View full text Add to dashboard Cite

When designing modern real-time systems, which have to deliver results at specified deadlines, knowing the worst-case execution time (WCET) of software components is of utmost importance. Although there has been much research in the field of WCET analysis in the last years, with a focus on improving the accuracy of processor models and WCET-calculation methods, researchers have paid little attention to exploring the impact of the instruction set architecture (ISA) on the time predictability of the code executing on a given real-time processor. In this paper we explore ISA extensions that allow compilers to generate highly time-predictable code. To this end, an existing instruction set has been extended by a number of instructions, and the LLVM compiler framework has been adapted to use these new instructions in its assembler-code generator. The timing behavior of the generated code has been evaluated by means of an instruction-set simulator. The results of the experiments allowed us to identify a promising combination of the newly introduced instructions. The use of these instructions leads to a reduction of the number of branches in the assembler code, thus improving time predictability while still providing competitive worst-case timing.

show abstract