Context-sensitive program analysis as database queries

Abstract

Program analysis has been increasingly used in software engineering tasks such as auditing programs for security vulnerabilities and finding errors in general. Such tools often require analyses much more sophisticated than those traditionally used in compiler optimizations. In particular, context-sensitive pointer alias information is a prerequisite for any sound and precise analysis that reasons about uses of heap objects in a program. Context-sensitive analysis is challenging because there are over 10 14 contexts in a typical large program, even after recursive cycles are collapsed. Moreover, pointers cannot be resolved in general without analyzing the entire program.This paper presents a new framework, based on the concept of deductive databases, for context-sensitive program analysis. In this framework, all program information is stored as relations; data access and analyses are written as Datalog queries. To handle the large number of contexts in a program, the database represents relations with binary decision diagrams (BDDs). The system we have developed, called bddbddb, automatically translates database queries into highly optimized BDD programs.Our preliminary experiences suggest that a large class of analyses involving heap objects can be described succinctly in Datalog and implemented efficiently with BDDs. To make developing application-specific analyses easy for programmers, we have also created a language called PQL that makes a subset of Datalog queries more intuitive to define. We have used the language to find many security holes in Web applications.

More Sound Static Handling of Java Reflection

“…This effectively propagates information back to the source of an unknown object. Similar reasoning has been employed in other work [Livshits et al 2005;Li et al 2014]. Yet our approach generalizes past techniques significantly: we support interprocedural reasoning, leverage information from strings and not just casts, and introduce "invented" objects that fully materialize at the point of a cast and subsequently aid the analysis modeling.…”

“…• We augment prior algorithms for inter-related reflection and points-to analysis [Livshits et al 2005;Livshits 2006] with a substring analysis, as well as a string flow analysis. The insight behind this treatment is that reflection is often used to dynamically access entities with partially known names, and the dynamic part of the configuration is limited to package prefixes, method name suffixes, etc.…”

“…Fortunately, a large amount of research in points-to analysis has focused on specifying analyses declaratively [Reps 1994;Whaley et al 2005;Lam et al 2005;Whaley and Lam 2004;Bravenboer and Smaragdakis 2009b;Kastrinis and Smaragdakis 2013a;Bravenboer and Smaragdakis 2009a;Kastrinis and Smaragdakis 2013b;Naik et al 2006;Liang and Naik 2011;Guarnieri and Livshits 2009], in the Datalog programming language. Datalog is ideal for encoding mutually recursive logic-recursion is the backbone of the language.…”

Optimizing Inequality Joins in Datalog with Approximated Constraint Propagation

“…Moreover, the filtered generator sets are potentially much smaller than the original sets, thus resulting in a Cartesian product much smaller than the original one. In this small example the filtered generator sets for l, p and f are all reduced from [0, 9] to respectively [1,8], [2,9] and [1,8]. Our approach is inspired by the well-known bounds consistency technique [5], in CP implemented by finite-domain constraint propagators.…”

Dedalus: Datalog in Time and Space

“…In recent years, there has been a resurgence of interest in Datalog as the foundation for applied, domain-specific languages in a wide variety of areas, including networking [20], distributed systems [5,8], natural language processing [11], robotics [4], compiler analysis [14], security [13,17,32] and computer games [31]. The resulting languages have been promoted for their compact and natural representations of tasks in their respective domains, in many cases leading to code that is orders of magnitude shorter than equivalent imperative programs.…”