Active learning of points-to specifications

Abstract

When analyzing programs, large libraries pose significant challenges to static points-to analysis. A popular solution is to have a human analyst provide points-to specifications that summarize relevant behaviors of library code, which can substantially improve precision and handle missing code such as native code. We propose Atlas, a tool that automatically infers points-to specifications. Atlas synthesizes unit tests that exercise the library code, and then infers points-to specifications based on observations from these executions. Atlas automatically infers specifications for the Java standard library, and produces better results for a client static information flow analysis on a benchmark of 46 Android apps compared to using existing handwritten specifications.

Learning to find naming issues with big code and small supervision

“…API specifications are a key ingredient in modern static analysis. Atlas [14] leverages active learning to obtain points-to specifications. Uspec [22] learns API aliasing specifications with unsupervised learning.…”

Using active learning to synthesize models of applications that access databases

“…Other related techniques include an active learning technique for learning commutativity specifications of data structures [36], a technique for learning program input grammars [14], a technique for learning points-to specifications [15], and a technique for learning models of the design patterns that Java computations implement [46]. Unlike Konure, all of these techniques focus on characterizing specific aspects of program behavior and do not aspire to capture the complete behavior of the application.…”

Synthesizing replacement classes

“…Program speci cation inference. A number of techniques have been proposed to infer program speci cations [Albarghouthi et al 2016;Ammons et al 2002;Bastani et al 2015Bastani et al , 2018Flanagan and Leino 2001;Livshits et al 2009;Logozzo 2004;Nimmer and Ernst 2002;Pradel and Gross 2009;Ramanathan et al 2007;Sharma and Aiken 2014;Yorsh et al 2008]. Albarghouthi et al [Albarghouthi et al 2016] propose a technique for extracting the weakest speci cation of an open program that meets a user speci ed post-condition.…”

“…Albarghouthi et al [Albarghouthi et al 2016] propose a technique for extracting the weakest speci cation of an open program that meets a user speci ed post-condition. Bastani et al [Bastani et al 2018] automatically infer the behavior of libraries by synthesizing points-to speci cations. Logozzo [Logozzo 2004] proposes an approach to perform modular and automatic inference of class invariants.…”