Flow logics for constraint based analysis

Abstract

A b s t r a c t . Flow logic offers a compact and versatile notation for expressing the acceptability of solutions to program analysis problems. In contrast to previous logical formulations of program analysis it aims at integrating existing approaches to data flow analysis and control flow analysis. It is able to deal with a broad variety of language paradigms, program properties, kinds of formal semantics, and methods used for computing the best solution.In this paper we illustrate how a compositional flow logic (in "succinct" form) can be systematically transformed into an efficient exhaustive procedure for computing the best solution of a set of constraints generated. This involves transformations to attribute grammars and to specifications of the ("verbose") form used in control flow analysis.

Static validation of security protocols

“…Using the techniques of [62] the analysis is transformed into a verbose specification [63]; this means that ψ and ϑ become global components. This is obtained by adding further labels to the syntax and making every analysis component global by using the new labels to link the values of the components to specific places in the syntax.…”

Interprocedural Control Flow Analysis

“…This paper presents an approach to program analysis that allows the simultaneous formulation of techniques for Control and Data Flow Analysis while taking the overall path recommended by Abstract Interpretation. To keep the specification compact we present the Control Flow Analysis in the form of a succinct flow logic [17]. Throughout the development we maintain a clear separation between environment-like data and store-like data so that the analysis more clearly corresponds to the semantics.…”

Extracting a data flow analyser in constructive logic

“…In contrast, we have also shown how to handle interprocedural data flow analysis in a natural manner; this is due to the fact that we use the general setting of Flow Logic [18] and constraint-based analysis. Research on mechanical verification of the Java byte code verifier includes that of Barthe et al [2] who have shown how to formalise the Java Card byte code verification in the proof assistant Coq by isolating the byte code verification in an executable semantics of the language.…”

“…Formula (18) reads: if the abstract state approximate all earlier states (well-founded induction hypothesis); and evolves, by performing a return instruction, into ; then, approximates as well.…”