Model Counting for Complex Data Structures

Filieri, Antonio; Frias, Marcelo F.; PăźSăźReanu, Corina S.; Visser, Willem

doi:10.1007/978-3-319-23404-5_15

Cited by 18 publications

(7 citation statements)

References 43 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…[16] proposes a precise QIF analysis method by reducing the problem to a model counting of integral points within a given domain (polyhedra), which enables us to use a symbolic counting tool such as LattE [18]. [11] proposes an approximated counting methods for complex data structures such as linked lists dynamically generated in a heap by keeping the numeric fields in the generated memory cells symbolic.…”

Section: Quantitative Information Flow and Model Countingmentioning

confidence: 99%

See 1 more Smart Citation

Counting Algorithms for Recognizable and Algebraic Series

Chu

Hashimoto

Seki

2018

IEICE Trans. Inf. & Syst.

View full text Add to dashboard Cite

SUMMARYFormal series are a natural extension of formal languages by associating each word with a value called a coefficient or a weight. Among them, recognizable series and algebraic series can be regarded as extensions of regular languages and context-free languages, respectively. The coefficient of a word w can represent quantities such as the cost taken by an operation on w, the probability that w is emitted. One of the possible applications of formal series is the string counting in quantitative analysis of software. In this paper, we define the counting problems for formal series and propose algorithms for the problems. The membership problem for an automaton or a grammar corresponds to the problem of computing the coefficient of a given word in a given series. Accordingly, we define the counting problem for formal series in the following two ways. For a formal series S and a natural number d, we define CC(S , d) to be the sum of the coefficients of all the words of length d in S and S C(S , d) to be the number of words of length d that have non-zero coefficients in S. We show that for a given recognizable series S and a natural number d, CC(S , d) can be computed in O(η log d) time where η is an upper-bound of time needed for a single state-transition matrix operation, and if the state-transition matrices of S are commutative for multiplication, S C(S , d) can be computed in polynomial time of d. We extend the notions to tree series and discuss how to compute them efficiently. Also, we propose an algorithm that computes CC(S , d) in square time of d for an algebraic series S. We show the CPU time of the proposed algorithm for computing CC(S , d) for some contextfree grammars as S, one of which represents the syntax of C language. To examine the applicability of the proposed algorithms to string counting for the vulnerability analysis, we also present results on string counting for Kaluza Benchmark.

show abstract

Section: Quantitative Information Flow and Model Countingmentioning

confidence: 99%

“…For QIF analysis or probabilistic testing of programs that dynamically generate such data structures, counting methods for those data structures have also been studied [11]. Tree series is an extension of formal series from strings to trees, which assigns a value of a semiring to each tree [10].…”

Section: Introductionmentioning

confidence: 99%

Counting Algorithms for Recognizable and Algebraic Series

Chu

Hashimoto

Seki

2018

IEICE Trans. Inf. & Syst.

View full text Add to dashboard Cite

show abstract

“…Notably, besides the number of bits required to represent the numerical values, the complexity of this algorithm does not depend on the actual size of the variable domains. This makes the computation feasible for very large input domains, allowing its application to probabilistic program analysis [31,26,23]. Several implementations of this algorithm are available, the most popular being LattE [83] and Barvinok [85].…”

Section: Exact and Numeric Computationmentioning

confidence: 99%

“…Other finite domains, such as bounded data structures [23] and regular languages [55,1], are active topics of study in applied model counting. The problem of counting the number of distinct truth assignments for a propositional formula is called #SAT, or propositional model counting.…”

Section: Exact and Numeric Computationmentioning

confidence: 99%

Probabilistic Program Analysis

Dwyer

Filieri

Geldenhuys

et al. 2017

Lecture Notes in Computer Science

Self Cite

View full text Add to dashboard Cite

This paper provides a survey of recent work on adapting techniques for program analysis to compute probabilistic characterizations of program behavior. We survey how the frameworks of data flow analysis and symbolic execution have incorporated information about input probability distributions to quantify the likelihood of properties of program states. We identify themes that relate and distinguish a variety of techniques that have been developed over the past 15 years in this area. In doing so, we point out opportunities for future research that builds on the strengths of different techniques.

show abstract

“…Unfortunately, knowing q(u) and M sub exactly is expensive. The former is the subject of recent research on model counting and probabilistic symbolic execution [13,33,14,10], and the latter has been studied in [5]. Thus, in this work, we develop techniques to estimate their values.…”

Section: Probability Estimationmentioning

confidence: 99%

Towards Concolic Testing for Hybrid Systems

Kong

Chen

et al. 2016

FM 2016: Formal Methods

View full text Add to dashboard Cite

Abstract. Hybrid systems exhibit both continuous and discrete behavior. Analyzing hybrid systems is known to be hard. Inspired by the idea of concolic testing (of programs), we investigate whether we can combine random sampling and symbolic execution in order to effectively verify hybrid systems. We identify a sufficient condition under which such a combination is more effective than random sampling. Furthermore, we analyze different strategies of combining random sampling and symbolic execution and propose an algorithm which allows us to dynamically switch between them so as to reduce the overall cost. Our method has been implemented as a web-based checker named HYCHECKER. HYCHECKER has been evaluated with benchmark hybrid systems and a water treatment system in order to test its effectiveness.

show abstract

Model Counting for Complex Data Structures

Cited by 18 publications

References 43 publications

Counting Algorithms for Recognizable and Algebraic Series

Counting Algorithms for Recognizable and Algebraic Series

Probabilistic Program Analysis

Towards Concolic Testing for Hybrid Systems

Contact Info

Product

Resources

About