Bounded Abstract Interpretation

Abstract

Abstract. In practice, software engineers are only able to spend a limited amount of resources on statically analyzing their code. Such resources may refer to their available time or their tolerance for imprecision, and usually depend on when in their workflow a static analysis is run. To serve these different needs, we propose a technique that enables engineers to interactively bound a static analysis based on the available resources. When all resources are exhausted, our technique soundly records the achieved verification results with a program instrumentation. Consequently, as more resources become available, any static analysis may continue from where the previous analysis left off. Our technique is applicable to any abstract interpreter, and we have implemented it for the .NET static analyzer Clousot. Our experiments show that bounded abstract interpretation can significantly increase the performance of the analysis (by up to 8x) while also increasing the quality of the reported warnings (more definite warnings that detect genuine bugs).

FRed: Conditional Model Checking via Reducers and Folders

“…Often, the program parts that could not be verified by the first analyzer are encoded with programs. Sometimes annotations (assertions) are added [19][20][21]46], while program trimming [32] adds assume statements to the original program. Reducer-based CMC [13] and program partitioning [43] output a new program describing a subset of the original program paths.…”

Failure-directed program trimming

“…Pre-processing for program analyzers. In the same spirit as this paper, prior work has also used program transformations to improve the precision or scalability of program analyzers [24,26,27,53,66,83,87]. For instance, a transformation for faster goal-directed search [66] moves all assertions to a single main procedure with the goal of speeding up analysis.…”

“…Recent techniques rely on the verification results of a full-fledged analyzer, such as an abstract interpreter or a model checker, to guide automatic test case generation tools [24,26,34,35] or other static analyzers [13,25,27,87], some even using slicing as an intermediate step [34]. In contrast, program trimming is more lightweight by not relying on previous analyzers and, thus, can be used as a preprocessing step for any safety checker.…”