Evaluating Design Tradeoffs in Numeric Static Analysis for Java

Wei, Shiyi; Mardziel, Piotr; Ruef, Andrew; Foster, Jeffrey S.; Hicks, Michael

doi:10.1007/978-3-319-89884-1_23

Cited by 10 publications

(3 citation statements)

References 58 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The impact of different abstract-interpretation configurations has been previously evaluated [54] for Java programs and partially inspired this work. To the best of our knowledge, we are the first to propose tailoring abstract interpreters to custom usage scenarios using optimization.…”

Section: Related Workmentioning

confidence: 99%

Automatically Tailoring Abstract Interpretation to Custom Usage Scenarios

Mansur

Mariano

Christakis

et al. 2021

Computer Aided Verification

View full text Add to dashboard Cite

In recent years, there has been significant progress in the development and industrial adoption of static analyzers, specifically of abstract interpreters. Such analyzers typically provide a large, if not huge, number of configurable options controlling the analysis precision and performance. A major hurdle in integrating them in the software-development life cycle is tuning their options to custom usage scenarios, such as a particular code base or certain resource constraints.In this paper, we propose a technique that automatically tailors an abstract interpreter to the code under analysis and any given resource constraints. We implement this technique in a framework, tAIlor, which we use to perform an extensive evaluation on real-world benchmarks. Our experiments show that the configurations generated by tAIlor are vastly better than the default analysis options, vary significantly depending on the code under analysis, and most remain tailored to several subsequent code versions.

show abstract

Section: Related Workmentioning

confidence: 99%

Automatically Tailoring Abstract Interpretation to Custom Usage Scenarios

Mansur

Mariano

Christakis

et al. 2021

Computer Aided Verification

View full text Add to dashboard Cite

show abstract

“…First, T P over-approximates formulas translated from the assembly, but E does not have front ends supporting SMTLIB2 or assembly. Second, E requires a third-party pointer analysis to reason about aliasing, which is a source of imprecision [Wei et al 2018]. While in the assembly-level symbolic execution, such information has been precisely and implicitly encoded in the formulas.…”

Section: Polyhedra Abstractionmentioning

confidence: 99%

Program analysis via efficient symbolic abstraction

Yao

Shi²,

Huang

et al. 2021

Proc. ACM Program. Lang.

View full text Add to dashboard Cite

This paper concerns the scalability challenges of symbolic abstraction: given a formula ϕ in a logic L and an abstract domain A , find a most precise element in the abstract domain that over-approximates the meaning of ϕ. Symbolic abstraction is an important point in the space of abstract interpretation, as it allows for automatically synthesizing the best abstract transformers. However, current techniques for symbolic abstraction can have difficulty delivering on its practical strengths, due to performance issues. In this work, we introduce two algorithms for the symbolic abstraction of quantifier-free bit-vector formulas, which apply to the bit-vector interval domain and a certain kind of polyhedral domain, respectively. We implement and evaluate the proposed techniques on two machine code analysis clients, namely static memory corruption analysis and constrained random fuzzing. Using a suite of 57,933 queries from the clients, we compare our approach against a diverse group of state-of-the-art algorithms. The experiments show that our algorithms achieve a substantial speedup over existing techniques and illustrate significant precision advantages for the clients. Our work presents strong evidence that symbolic abstraction of numeric domains can be efficient and practical for large and realistic programs.

show abstract

“…Wei et al [307] evaluated different program analyses, including representations for integers and heap abstractions. They and we both found that polygons are expensive and not very helpful; simpler analyses can suffice.…”

Section: Related Work: Array Boundsmentioning

confidence: 99%