Model Counting for Recursively-Defined Strings

Trinh, Minh-Thai; Chu, Duc-Hiep; Jaffar, Joxan

doi:10.1007/978-3-319-63390-9_21

Cited by 17 publications

(19 citation statements)

References 30 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Its successor, S3P [136], guides the search towards a "minimal solution" for satisfiable problems and enables conflict clause learning for string theory. The latest version, called S3# [137] implements an algorithm for counting the models of string constraints.…”

Section: Word-based Scs Approachesmentioning

confidence: 99%

See 1 more Smart Citation

A Novel Approach to String Constraint Solving

Amadini

Gange

Stuckey

et al. 2017

Lecture Notes in Computer Science

View full text Add to dashboard Cite

String constraint solving refers to solving combinatorial problems involving constraints over string variables. String solving approaches have become popular over the last years given the massive use of strings in different application domains like formal analysis, automated testing, database query processing, and cybersecurity. This paper reports a comprehensive survey on string constraint solving by exploring the large number of approaches that have been proposed over the last decades to solve string constraints.

show abstract

Section: Word-based Scs Approachesmentioning

confidence: 99%

“…As also noted in [5], DPLL(T)-based string solvers like Z3str2 [148], Z3str3 [26], CVC4 [89], S3 [135][136][137], Norn [4],…”

Section: Theoretical Aspectsmentioning

confidence: 99%

A Novel Approach to String Constraint Solving

Amadini

Gange

Stuckey

et al. 2017

Lecture Notes in Computer Science

View full text Add to dashboard Cite

show abstract

“…Further innovations from the string solving community, such as work on the decidability of string constraints involving complex functions [12,20] or support for recursive string operations [35,36], are likely to improve the performance of our approach in future. We incorporate our techniques at the level of the DSE engine rather than the constraint solver, which allows our tool to leverage advances in string solving techniques; at the same time, we can take advantage of the native regular expression matcher and can avoid having to integrate implementation language-specific details for regular expressions into the solver.…”

Section: Related Workmentioning

confidence: 99%

Sound regular expression semantics for dynamic symbolic execution of JavaScript

Loring

Mitchell

Kinder

2019

Proceedings of the 40th ACM SIGPLAN Conference on Programming Language Design and Implementation

View full text Add to dashboard Cite

Support for regular expressions in symbolic execution-based tools for test generation and bug finding is insufficient. Common aspects of mainstream regular expression engines, such as backreferences or greedy matching, are ignored or imprecisely approximated, leading to poor test coverage or missed bugs. In this paper, we present a model for the complete regular expression language of ECMAScript 2015 (ES6), which is sound for dynamic symbolic execution of the test and exec functions. We model regular expression operations using string constraints and classical regular expressions and use a refinement scheme to address the problem of matching precedence and greediness. We implemented our model in ExpoSE, a dynamic symbolic execution engine for JavaScript, and evaluated it on over 1,000 Node.js packages containing regular expressions, demonstrating that the strategy is effective and can significantly increase the number of successful regular expression queries and therefore boost coverage.CCS Concepts • Software and its engineering → Software verification and validation; Dynamic analysis; • Theory of computation → Regular languages.

show abstract

“…Due to the importance of model counting in quantitative program analyses, model counting constraint solvers are gaining increasing attention [3,20,31]. ABC is the only one that supports string, numeric and mixed constraints.…”

Section: Related Workmentioning

confidence: 99%

Incremental Attack Synthesis

Saha

Eiers

Kadron

et al. 2019

SIGSOFT Softw. Eng. Notes

View full text Add to dashboard Cite

Information leakage is a significant problem in modern software systems. Information leaks due to side channels are especially hard to detect and analyze. In this paper, we present techniques for automated synthesis of adaptive side-channel attacks that recover secret values. Our attack synthesis techniques iteratively generate inputs which, when fed to code that accesses the secret, reveal partial information about the secret based on the side-channel observations, reducing the remaining uncertainty about the secret in each attack step. Our approach is incremental, reusing results from prior iterations in each attack step to improve the efficiency of attack synthesis. We use symbolic execution to extract path constraints, automata-based model counting to estimate probabilities of execution paths, and meta-heuristics to maximize information gain based on entropy in order to minimize the number of synthesized attack steps.

show abstract

Model Counting for Recursively-Defined Strings

Cited by 17 publications

References 30 publications

A Novel Approach to String Constraint Solving

A Novel Approach to String Constraint Solving

Sound regular expression semantics for dynamic symbolic execution of JavaScript

Incremental Attack Synthesis

Contact Info

Product

Resources

About