Mining Control Flow Abnormality for Logic Error Isolation

Liu, Chao; Yan, Xifeng; Han, Jiawei

doi:10.1137/1.9781611972764.10

Cited by 25 publications

(17 citation statements)

References 33 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…To evaluate bug localisation techniques, the Siemens Programs [15] are often used [1,2,13] as a reference suite of C programs artificially instrumented with different bugs. More specifically, it usually is just a small subset of this benchmark which is used.…”

Section: Discussionmentioning

confidence: 99%

“…Approaches range from static code analysis and mining of software repositories and bug databases [8,9,10] to dynamic program verification. The latter focus on the data flow [11,12] or, like all call graph based techniques, on the control flow [13,14]. In the following, we will first discuss the application of data mining techniques in this context -bug localisation is just one application.…”

Section: Related Workmentioning

confidence: 99%

“…This leads to potentially faulty pieces of code. A similar approach, but with a focus on the control flow, is [13]. It instruments condition statements and calculates a ranking based on its evaluation frequencies.…”

Section: Mining Software Metrics and Invariantsmentioning

confidence: 99%

See 2 more Smart Citations

Mining Edge-Weighted Call Graphs to Localise Software Bugs

Eichinger¹,

Böhm²,

Huber³

Machine Learning and Knowledge Discovery in Databases

View full text Add to dashboard Cite

An important problem in software engineering is the automated discovery of noncrashing occasional bugs. In this work we address this problem and show that mining of weighted call graphs of program executions is a promising technique. We mine weighted graphs with a combination of structural and numerical techniques. More specifically, we propose a novel reduction technique for call graphs which introduces edge weights. Then we present an analysis technique for such weighted call graphs based on graph mining and on traditional feature selection schemes. The technique generalises previous graph mining approaches as it allows for an analysis of weights. Our evaluation shows that our approach finds bugs which previous approaches cannot detect so far. Our technique also doubles the precision of finding bugs which existing techniques can already localise in principle.

show abstract

Section: Discussionmentioning

confidence: 99%

Section: Related Workmentioning

confidence: 99%

See 1 more Smart Citation

Mining Edge-Weighted Call Graphs to Localise Software Bugs

Eichinger¹,

Böhm²,

Huber³

Machine Learning and Knowledge Discovery in Databases

View full text Add to dashboard Cite

show abstract

“…Using machine learning techniques to diagnose failure is not new [3,2,6,12,14,15]. Discriminative frequent pattern analysis [6], software behavior graph analysis [14], a Bayesian analysis based approach [13], and control flow analysis to identify logic error [15] are a few examples.…”

Section: Related Workmentioning

confidence: 99%

“…Discriminative frequent pattern analysis [6], software behavior graph analysis [14], a Bayesian analysis based approach [13], and control flow analysis to identify logic error [15] are a few examples. These techniques do not focus on extracting symbolic relationships, however.…”

Section: Related Workmentioning

confidence: 99%

Finding Symbolic Bug Patterns in Sensor Networks

Khan

Abdelzaher

Ahmadi

2009

Distributed Computing in Sensor Systems

Self Cite

View full text Add to dashboard Cite

Abstract. This paper presents a failure diagnosis algorithm for summarizing and generalizing patterns that lead to instances of anomalous behavior in sensor networks. Often multiple seemingly different event patterns lead to the same type of failure manifestation. A hidden relationship exists, in those patterns, among event attributes that is somehow responsible for the failure. For example, in some system, a message might always get corrupted if the sender is more than two hops away from the receiver (which is a distance relationship) irrespective of the senderId and receiverId. To uncover such failure-causing relationships, we present a new symbolic pattern extraction technique that identifies and symbolically expresses relationships correlated with anomalous behavior. Symbolic pattern extraction is a new concept in sensor network debugging that is unique in its ability to generalize over patterns that involve different combinations of nodes or message exchanges by extracting their common relationship. As a proof of concept, we provide synthetic traffic scenarios where we show that applying symbolic pattern extraction can uncover more complex bug patterns that are crucial to the understanding of real causes of problems. We also use symbolic pattern extraction to diagnose a real bug and show that it generates much fewer and more accurate patterns compared to previous approaches.

show abstract

Static detection of logic vulnerabilities in Java web applications

Fang

Zhang

Kong

et al. 2013

Security Comm Networks

View full text Add to dashboard Cite

This paper concerns about logic vulnerabilities that result from faulty logic of a web application. Logic vulnerabilities typically accompany with the exposure of unexpected functionalities and lead to the bypass of the intended constraints. From a semantic perspective, logic vulnerabilities occur when mistakes arise in the control flows guarding the processes of invoking critical functionalities. In this paper, we propose the first lightweight static analysis approach to automatically detect logic vulnerabilities in Java web applications. Logic errors in our approach are characterized as erroneous invocations of functionalities. Program-slicing technique has been leveraged to capture the processes of invoking critical functionalities. A back-tracing algorithm is originally designed to extract control flows guarding functionality-invocation processes. Finally, logic vulnerability detection is transformed into mining abnormal functionality-invocation processes in a cluster of similar ones by comparing these processes' control flows. We implemented our approach in a prototype tool named logic vulnerability detector and evaluated it on seven real-world applications scaled from thousands to million lines of code. The evaluation results show that our approach achieves bigger coverage with acceptable cost and better scalability than previous approaches.

show abstract

Mining Control Flow Abnormality for Logic Error Isolation

Cited by 25 publications

References 33 publications

Mining Edge-Weighted Call Graphs to Localise Software Bugs

Mining Edge-Weighted Call Graphs to Localise Software Bugs

Finding Symbolic Bug Patterns in Sensor Networks

Static detection of logic vulnerabilities in Java web applications

Contact Info

Product

Resources

About