A Theoretical Foundation of Sensitivity in an Abstract Interpretation Framework

Abstract

xx A Theoretical Foundation of Sensitivity in an Abstract Interpretation FrameworkSE-WON KIM, S-Core 1 XAVIER RIVAL, CNRS, ENS, INRIA Paris-Rocquencourt, PSL* University SUKYOUNG RYU, KAIST Program analyses often utilize various forms of sensitivity such as context sensitivity, call-site sensitivity, and object sensitivity. These techniques all allow for more precise program analyses, that are able to compute more precise program invariants, and to verify stronger properties. Despite the fact that sensitivity techniques are now part of the standard toolkit of static analyses designers and implementers, no comprehensive frameworks allow the description of all common forms of sensitivity. As a consequence, the soundness proofs of static analysis tools involving sensitivity often rely on ad hoc formalization, which are not always carried out in an abstract interpretation framework. Moreover, this also means that opportunities to identify similarities between analysis techniques to better improve abstractions or to tune static analysis tools can easily be missed.In this paper, we present and formalize a framework for the description of sensitivity in static analysis. Our framework is based on a powerful abstract domain construction, and utilizes reduced cardinal power to tie basic abstract predicates to the properties analyses are sensitive to. We formalize this abstraction, and the main abstract operations that are needed to turn it into a generic abstract domain construction. We demonstrate that our approach can allow for a more precise description of program states, and that it can also describe a large set of sensitivity techniques, both when sensitivity criteria are static (known before the analysis) or dynamic (inferred as part of the analysis), and sensitive analysis tuning parameters. Last, we show that sensitivity techniques used in state of the art static analysis tools can be described in our framework.

Lifting Numeric Relational Domains to Algebraic Data Types

“…Other works have used silhouettes [32]-abstractions of the shapes of the abstract values-to control disjunctions. Following [27], our disjunctions, that are guided by paths in values, can be understood as a form of control sensitivity. It is worth noticing that our disjuncts do not form a partition since some disjuncts may overlap-a degree of freedom that is advocated by [27].…”

“…Following [27], our disjunctions, that are guided by paths in values, can be understood as a form of control sensitivity. It is worth noticing that our disjuncts do not form a partition since some disjuncts may overlap-a degree of freedom that is advocated by [27]. Based on our present work, we will investigate whether we can re-cast our disjuncts as conjunctions of implications, which could both improve precision and lead to a more parsimonious representations of abstract values.…”

A Framework for Memory Efficient Context-Sensitive Program Analysis

“…Our paper introduces a systematic approach to generalize context-insensitive to context-sensitive analyses using BDDs. Kim et al [16] state the importance of utilizing different dimensions of sensitivity in static program analysis to improve the analysis precision. They present a general framework to capture many different dimensions of sensitivity, such as, context-, flow-, trace-sensitivity, that encompass a large variety of well-known analyses in all these dimensions and combination thereof.…”

datAFLow: Towards a Data-Flow-Guided Fuzzer

“…This definition allows us to explore data-flow-based coverage metrics with different sensitivities [32,36]. We adhere to the program analysis literature and define sensitivity as a coverage metric's ability to discriminate between a set of program behaviors [37]. In fuzzing, a coverage metric's sensitivity is its ability to preserve a chain of mutated test cases until they trigger a bug [32].…”