Abstract Interpretation of Indexed Grammars

Campion, Marco; Preda, Mila Dalla; Giacobazzi, Roberto

doi:10.1007/978-3-030-32304-2_7

Cited by 5 publications

(4 citation statements)

References 22 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…We weakened both the local backward-completeness, in presence of a GC, and the local forward-completeness properties in case only a concretization function is available (e.g., the case of convex polyhedra or the domain of formal languages [9]) in order to allow a limited amount of imprecision. This imprecision is measured according to a distance function formalized as a pre-metric compatible with the underlying pre-order relation.…”

Section: Discussionmentioning

confidence: 99%

A Formal Framework to Measure the Incompleteness of Abstract Interpretations

Campion,

Urban,

Dalla Preda

et al. 2023

Lecture Notes in Computer Science

Self Cite

View full text Add to dashboard Cite

HAL is a multi-disciplinary open access archive for the deposit and dissemination of scientific research documents, whether they are published or not. The documents may come from teaching and research institutions in France or abroad, or from public or private research centers. L'archive ouverte pluridisciplinaire HAL, est destinée au dépôt et à la diffusion de documents scientifiques de niveau recherche, publiés ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

show abstract

Section: Discussionmentioning

confidence: 99%

A Formal Framework to Measure the Incompleteness of Abstract Interpretations

Campion,

Urban,

Dalla Preda

et al. 2023

Lecture Notes in Computer Science

Self Cite

View full text Add to dashboard Cite

show abstract

“…We also plan to extend the concept of partial complete abstract interpretation to non-GCs/GIs. For example, to the case of convex polyhedra [Cousot and Halbwachs 1978] and symbolic abstract domains, such as the domain of regular or indexed grammars [Campion et al 2019].…”

Section: Discussionmentioning

confidence: 99%

Partial (In)Completeness in abstract interpretation: limiting the imprecision in program analysis

Campion

Preda

Giacobazzi

2022

Proc. ACM Program. Lang.

Self Cite

View full text Add to dashboard Cite

Imprecision is inherent in any decidable (sound) approximation of undecidable program properties. In abstract interpretation this corresponds to the release of false alarms, e.g., when it is used for program analysis and program verification. As all alarming systems, a program analysis tool is credible when few false alarms are reported. As a consequence, we have to live together with false alarms, but also we need methods to control them. As for all approximation methods, also for abstract interpretation we need to estimate the accumulated imprecision during program analysis. In this paper we introduce a theory for estimating the error propagation in abstract interpretation, and hence in program analysis. We enrich abstract domains with a weakening of a metric distance. This enriched structure keeps coherence between the standard partial order relating approximated objects by their relative precision and the effective error made in this approximation. An abstract interpretation is precise when it is complete. We introduce the notion of partial completeness as a weakening of precision. In partial completeness the abstract interpreter may produce a bounded number of false alarms. We prove the key recursive properties of the class of programs for which an abstract interpreter is partially complete with a given bound of imprecision. Then, we introduce a proof system for estimating an upper bound of the error accumulated by the abstract interpreter during program analysis. Our framework is general enough to be instantiated to most known metrics for abstract domains.

show abstract

“…Moreover, the new learner needs to be able to learn, in an approximate way, more complex rewriting rules in order to catch more sophisticated metamorphic engines and it should be able to generate a sound metamorphic signature, i.e., a set of rules that generate all the real metamorphic variants, namely, all the possible variants that the unknown metamorphic engine can create, admitting some false positives (spurious variants). Finally, new more expressive formal languages should be considered modeling code mutations, such as, e.g., indexed grammars [32,33] or context-sensitive grammars, and their respective learning algorithms.…”

Section: Discussion and Future Directionsmentioning

confidence: 99%

Learning metamorphic malware signatures from samples

Campion

Preda

Giacobazzi

2021

J Comput Virol Hack Tech

Self Cite

View full text Add to dashboard Cite

Metamorphic malware are self-modifying programs which apply semantic preserving transformations to their own code in order to foil detection systems based on signature matching. Metamorphism impacts both software security and code protection technologies: it is used by malware writers to evade detection systems based on pattern matching and by software developers for preventing malicious host attacks through software diversification. In this paper, we consider the problem of automatically extracting metamorphic signatures from the analysis of metamorphic malware variants. We define a metamorphic signature as an abstract program representation that ideally captures all the possible code variants that might be generated during the execution of a metamorphic program. For this purpose, we developed MetaSign: a tool that takes as input a collection of metamorphic code variants and produces, as output, a set of transformation rules that could have been used to generate the considered metamorphic variants. MetaSign starts from a control flow graph representation of the input variants and agglomerates them into an automaton which approximates the considered code variants. The upper approximation process is based on the concept of widening automata, while the semantic preserving transformation rules, used by the metamorphic program, can be viewed as rewriting rules and modeled as grammar productions. In this setting, the grammar recognizes the language of code variants, while the production rules model the metamorphic transformations. In particular, we formalize the language of code variants in terms of pure context-free grammars, which are similar to context-free grammars with no terminal symbols. After the widening process, we create a positive set of samples from which we extract the productions of the grammar by applying a learning grammar technique. This allows us to learn the transformation rules used by the metamorphic engine to generate the considered code variants. We validate the results of MetaSign on some case studies.

show abstract

Abstract Interpretation of Indexed Grammars

Cited by 5 publications

References 22 publications

A Formal Framework to Measure the Incompleteness of Abstract Interpretations

A Formal Framework to Measure the Incompleteness of Abstract Interpretations

Partial (In)Completeness in abstract interpretation: limiting the imprecision in program analysis

Learning metamorphic malware signatures from samples

Contact Info

Product

Resources

About