String Analysis via Automata Manipulation with Logic Circuit Representation

Wang, Hung-En; Tsai, Tzung-Lin; Lin, Chun-Han; Yu, Fang; Jiang, Jie-Hong R.

doi:10.1007/978-3-319-41528-4_13

Cited by 30 publications

(29 citation statements)

References 30 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…SLOG [145] is a string analysis tool based on an NFA manipulation engine with logic circuit representation. Automata manipulations can be performed implicitly using logic circuits while determinization is largely avoided.…”

Section: Automata-based Scs Approachesmentioning

confidence: 99%

A Novel Approach to String Constraint Solving

Amadini

Gange

Stuckey

et al. 2017

Lecture Notes in Computer Science

View full text Add to dashboard Cite

String constraint solving refers to solving combinatorial problems involving constraints over string variables. String solving approaches have become popular over the last years given the massive use of strings in different application domains like formal analysis, automated testing, database query processing, and cybersecurity. This paper reports a comprehensive survey on string constraint solving by exploring the large number of approaches that have been proposed over the last decades to solve string constraints.

show abstract

Section: Automata-based Scs Approachesmentioning

confidence: 99%

A Novel Approach to String Constraint Solving

Amadini

Gange

Stuckey

et al. 2017

Lecture Notes in Computer Science

View full text Add to dashboard Cite

show abstract

“…[42,18]) and many current existing benchmarks (e.g. [50,30,59,57,42]). Based on the semantic conditions, we developed a conceptually simple and generic decision procedure with an extensible architecture that allow a user to easily incorporate a user-defined function.…”

Section: Resultsmentioning

confidence: 99%

“…Our next set of benchmarks, SLOG, came from the SLOG tool [57] and consist of 3,392 instances. They are derived from the security analysis of real web applications and contain 1-211 string variables (average 6.5) and 1-182 atomic formula (average 5.8).…”

Section: Benchmarksmentioning

confidence: 99%

“…This is done by imposing syntactic restrictions including acyclicity [6,3], solved form [28], and straight-line [42,30,18]. These restrictions are known to be satisfied by many existing string constraint benchmarks, e.g., Kaluza [50], Stranger [59], SLOG [57,30], and mutation XSS benchmarks of [42]. However, these results are unfortunately rather fragmented, and it is difficult to extend the comparatively limited number of supported string operations.…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Decision procedures for path feasibility of string-manipulating programs with complex operations

Chen

Hague

Lin

et al. 2019

Proc. ACM Program. Lang.

View full text Add to dashboard Cite

The design and implementation of decision procedures for checking path feasibility in string-manipulating programs is an important problem, with such applications as symbolic execution of programs with strings and automated detection of cross-site scripting (XSS) vulnerabilities in web applications. A (symbolic) path is given as a finite sequence of assignments and assertions (i.e. without loops), and checking its feasibility amounts to determining the existence of inputs that yield a successful execution. Modern programming languages (e.g. JavaScript, PHP, and Python) support many complex string operations, and strings are also often implicitly modified during a computation in some intricate fashion (e.g. by some autoescaping mechanisms).In this paper we provide two general semantic conditions which together ensure the decidability of path feasibility: (1) each assertion admits regular monadic decomposition (i.e. is an effectively recognisable relation), and (2) each assignment uses a (possibly nondeterministic) function whose inverse relation preserves regularity. We show that the semantic conditions are expressive since they are satisfied by a multitude of string operations including concatenation, one-way and two-way finite-state transducers, replaceAll functions (where the replacement string could contain variables), string-reverse functions, regularexpression matching, and some (restricted) forms of letter-counting/length functions. The semantic conditions also strictly subsume existing decidable string theories (e.g. straightline fragments, and acyclic logics), and most existing benchmarks (e.g. most of Kaluza's, and all of SLOG's, Stranger's, and SLOTH's benchmarks). Our semantic conditions also yield a conceptually simple decision procedure, as well as an extensible architecture of a string solver in that a user may easily incorporate his/her own string functions into the solver by simply providing code for the pre-image computation without worrying about other parts of the solver. Despite these, the semantic conditions are unfortunately too general to provide a fast and complete decision procedure. We provide strong theoretical evidence for this in the form of complexity results. To rectify this problem, we propose two solutions. Our main solution is to allow only partial string functions (i.e., prohibit nondeterminism) in condition (2). This restriction is satisfied in many cases in practice, and yields decision procedures that are effective in both theory and practice. Whenever nondeterministic functions are still needed (e.g. the string function split), our second solution is to provide a syntactic fragment that provides a support of nondeterministic functions, and operations like one-way transducers, replaceAll (with constant replacement string), the string-reverse function, concatenation, and regular-expression matching. We show that this fragment can be reduced to an existing solver SLOTH that exploits fast model checking algorithms like IC3.We provide an efficient implementation of our decision p...

show abstract

“…We evaluate the impact of each simplification technique as implemented in cvc4 on three benchmark sets that use extended string operators: CMU, a dataset obtained from symbolic execution of Python code [15]; TermEq, a benchmark set consisting of the verification of term equivalences over strings [14]; and Slog, a benchmark set extracted from vulnerability testing of web applications [22]. The Slog set uses the replace function extensively but does not contain other extended functions.…”

Section: Discussionmentioning

confidence: 99%

High-Level Abstractions for Simplifying Extended String Constraints in SMT

Reynolds

Nötzli

Barrett

et al. 2019

Computer Aided Verification

View full text Add to dashboard Cite

Satisfiability Modulo Theories (SMT) solvers with support for the theory of strings have recently emerged as powerful tools for reasoning about string-manipulating programs. However, due to the complex semantics of extended string functions, it is challenging to develop scalable solvers for the string constraints produced by program analysis tools. We identify several classes of simplification techniques that are critical for the efficient processing of string constraints in SMT solvers. These techniques can reduce the size and complexity of input constraints by reasoning about arithmetic entailment, multisets, and string containment relationships over input terms. We provide experimental evidence that implementing them results in significant improvements over the performance of state-of-the-art SMT solvers for extended string constraints.

show abstract

String Analysis via Automata Manipulation with Logic Circuit Representation

Cited by 30 publications

References 30 publications

A Novel Approach to String Constraint Solving

A Novel Approach to String Constraint Solving

Decision procedures for path feasibility of string-manipulating programs with complex operations

High-Level Abstractions for Simplifying Extended String Constraints in SMT

Contact Info

Product

Resources

About