Concerto: a framework for combined concrete and abstract interpretation

Abstract

interpretation promises sound but computable static summarization of program behavior. However, modern software engineering practices pose significant challenges to this vision, specifically the extensive use of frameworks and complex libraries. Frameworks heavily use reflection, metaprogramming, and multiple layers of abstraction, all of which confound even state-of-the-art abstract interpreters. Sound but conservative analysis of frameworks is impractically imprecise, and unsoundly ignoring reflection and metaprogramming is untenable given the prevalence of these features. Manually modeling framework behaviors offers excellent precision, at the cost of immense effort by the tool designer.To overcome the above difficulties, we present Concerto, a system for analyzing framework-based applications by soundly combining concrete and abstract interpretation. Concerto analyzes framework implementations using concrete interpretation, and application code using abstract interpretation. This technique is possible in practice as framework implementations typically follow a single path of execution when provided a concrete, application-specific configuration file which is often available at analysis time. Concerto exploits this configuration information to precisely resolve reflection and other metaprogramming idioms during concrete execution. In contrast, application code may have infinitely many paths of execution, so Concerto switches to abstract interpretation to analyze application code. Concerto is an analysis framework, and can be instantiated with any abstract interpretation that satisfies a small set of preconditions. In addition, unlike manual modeling, Concerto is not specialized to any specific framework implementation. We have formalized our approach and proved several important properties including soundness and termination. In addition, we have implemented an initial proof of concept prototype of Concerto for a subset of Java, and found that our combined interpretation significantly improves analysis precision and performance.Concerto: A Framework for Combined Concrete and Abstract Interpretation 43:3 a concrete, application-specific configuration file. Statically executable refers to a program fragment that: a) can be completely and deterministically evaluated at analysis time, and b) will yield the same program state after evaluation at both runtime and analysis time; the init method is an example of statically executable code. Conversely, application code contains unbounded control-flow paths. As a result, a one-size-fits-all approach to program analysis is unwise for framework-based applications.We present Concerto, a system for soundly combining mostly-concrete interpretation, an extension to concrete interpretation we introduce and formalize in this paper, and abstract interpretation. By combining these two techniques, Concerto leverages the strengths of both approaches while avoiding their weaknesses. Concerto analyzes framework implementations using mostly-concrete interpretation, and application cod...

Automated Safety Verification of Programs Invoking Neural Networks

“…The program-analysis literature provides countless examples of powerful analysis combinations. To name a few, dynamic symbolic execution [29,10] and hybrid fuzzing [45,58,69] combine random testing and symbolic execution, numerous tools broadly combine static and dynamic analysis [6,20,21,49,30,13,14,22,61], and many tools combine different types of static analysis [7,1,34]. In contrast to neuro-aware program analysis, almost all these tools target homogeneous, instead of heterogeneous, systems.…”

“…In contrast to neuro-aware program analysis, almost all these tools target homogeneous, instead of heterogeneous, systems. Concerto [61] is a notable exception that targets applications using frameworks such as Spring and Struts. It combines abstract and concrete interpretation, where, on a high level, concrete interpretation is used to analyze framework code, whereas abstract interpretation is used for application code.…”

Accelerating JavaScript static analysis via dynamic shortcuts

“…Combined Analysis. The most related previous work is combined analysis that utilizes dynamic analysis during Java static analysis introduced by Toman and Grossman [42]. They proved that their combined analysis is sound and showed that it could significantly improve the precision and performance of Java static analysis by evaluating their tool, Concerto.…”

Optimizing asynchronous JavaScript applications

“…Park et al [176] describe an approach which uses dynamic analysis as a shortcut to speed up static analysis of JavaScript. Toman and Grossman [212] combine concrete and abstract interpretation to analyze programs that make extensive use of third party libraries and otherwise inaccessible code. Godefroid et al [99] present DART, a fully automated testing framework that combines static analysis to determine the API of an application with dynamic analysis of generated random tests to analyze the behavior of the application.…”