Gamifying Program Analysis

Fava, Daniel Schnetzer; Signoles, Julien; Lemerre, Matthieu; Schäf, Martin; Tiwari, Ashish

doi:10.1007/978-3-662-48899-7_41

Cited by 3 publications

(4 citation statements)

References 18 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Binary Fission was developed as part of the Crowd Sourced Formal Verification (CSFV) program, funded by DARPA in the United States. This program has resulted in the creation of ten games focused on the intersection with formal software verification [7,18,12]; a summary of the games developed in this program can be found in [5], and many of the games can be played at verigames.com.…”

Section: Related Workmentioning

confidence: 99%

Crowdsourcing program preconditions via a classification game

Fava

Shapiro

Osborn

et al. 2016

Proceedings of the 38th International Conference on Software Engineering

Self Cite

View full text Add to dashboard Cite

Invariant discovery is one of the central problems in software verification. This paper reports on an approach that addresses this problem in a novel way; it crowdsources logical expressions for likely invariants by turning invariant discovery into a computer game. The game, called Binary Fission, employs a classification model. In it, players compose preconditions by separating program states that preserve or violate program assertions. The players have no special expertise in formal methods or programming, and are not specifically aware they are solving verification tasks. We show that Binary Fission players discover concise, general, novel, and human readable program preconditions. Our proof of concept suggests that crowdsourcing offers a feasible and promising path towards the practical application of verification technology.

show abstract

Section: Related Workmentioning

confidence: 99%

Crowdsourcing program preconditions via a classification game

Fava

Shapiro

Osborn

et al. 2016

Proceedings of the 38th International Conference on Software Engineering

Self Cite

View full text Add to dashboard Cite

show abstract

“…For example, a loop invariant can indicate a relation among the program variables at the loop entrance. Invariants help prove program correctness, e.g., classical verification approaches by Floyd-Hoare and Dijkstra [13,21] can be automated when given needed loop invariants and the infamous Heartbleed bug can be avoided by preserving an invariant capturing the proper size of the received payload message [16]. Invariants also help developers understand programs, e.g., showing interesting or unexpected behaviors, and even discover nonfunctional bugs, e.g., revealing that the program has an unusual high runtime complexity [37].…”

Section: Introductionmentioning

confidence: 99%

SLING: using dynamic analysis to infer program invariants in separation logic

Zheng

Nguyen

2019

Proceedings of the 40th ACM SIGPLAN Conference on Programming Language Design and Implementation

View full text Add to dashboard Cite

We introduce a new dynamic analysis technique to discover invariants in separation logic for heap-manipulating programs. First, we use a debugger to obtain rich program execution traces at locations of interest on sample inputs. These traces consist of heap and stack information of variables that point to dynamically allocated data structures. Next, we iteratively analyze separate memory regions related to each pointer variable and search for a formula over predefined heap predicates in separation logic to model these regions. Finally, we combine the computed formulae into an invariant that describes the shape of explored memory regions.We present SLING, a tool that implements these ideas to automatically generate invariants in separation logic at arbitrary locations in C programs, e.g., program pre and postconditions and loop invariants. Preliminary results on existing benchmarks show that SLING can efficiently generate correct and useful invariants for programs that manipulate a wide variety of complex data structures.

show abstract

“…As discussed in the introduction, several projects investigated the idea of crowdsourcing verification tasks [7,8,12,13,21,23,30]. The main focus of these projects is to investigate to gamification potential and how to create a problem representation that is appealing to gamers.…”

Section: Related Workmentioning

confidence: 99%

“…For example, one of the developed games, GhostMap [23,30], crowdsources the problem of finding suitable refinements in a CEGAR-based model checker. Another game, Xylem [13], crowdsources predicate discovery to assist the abstract interpretation tool Frama-C. Other tools, like BinaryFission [12] crowdsource invariant discovery to obtain more readable invariants than existing machine learning approaches, and Paradox or Pipejam [8] turn constraint systems from type checking into puzzle games.…”

Section: Introductionmentioning

confidence: 99%

Abduction by Non-Experts

Bjørner¹,

Jovanović²,

Lepoint³

et al.

Kalpa Publications in Computing

Self Cite

View full text Add to dashboard Cite

Crowdsourcing promises to quasi-automate tasks that cannot be automated otherwise. Success stories like natural language translation or recognition of cats in images show that carefully crafted crowdsourcing tasks solve large problem instances which could not be solved otherwise. To utilize crowdsourcing, one has to define the problem in a way that is easy to split into small tasks, that the tasks are easy to solve for humans and hard to solve for a machine, and that the machine can efficiently check if the solution is correct.In this paper we discuss a novel approach of using crowdsourcing to assist software verification. We argue that Horn clauses form a good base for crowdsourcing since they are easy to subdivide, and that logic abduction is a suitable task since it is hard to find abductive inferences for Horn clauses automatically, but it is easy to check if an inference makes a Horn clause valid. We describe a prototype implementation, we show how crowdsourcing integrates in the verification process, and present preliminary results.

show abstract

Gamifying Program Analysis

Cited by 3 publications

References 18 publications

Crowdsourcing program preconditions via a classification game

Crowdsourcing program preconditions via a classification game

SLING: using dynamic analysis to infer program invariants in separation logic

Abduction by Non-Experts

Contact Info

Product

Resources

About