Structurally Defined Conditional Data-Flow Static Analysis

Sherman, Elena; Dwyer, Matthew B.

doi:10.1007/978-3-319-89963-3_15

Cited by 12 publications

(9 citation statements)

References 19 publications

(23 reference statements)

Supporting

Mentioning

Contrasting

Order By: Relevance

“…It is also possible to speed up verification processes in a stateless way. The technique of conditional model checking is used to split programs into parts that can be independently verified [89]. [13,14] can be used to increase the confidence in the results of verification tools, because it is possible to take a witness-based results validator to "replay" the verification.…”

Section: Improvement Of Effectiveness and Efficiency Storing Intermediate Results Can Be Used To Improve The Effectiveness And Efficiencymentioning

confidence: 99%

Verification Artifacts in Cooperative Verification: Survey and Unifying Component Framework

Beyer

Wehrheim

2020

Lecture Notes in Computer Science

View full text Add to dashboard Cite

The goal of cooperative verification is to combine verification approaches in such a way that they work together to verify a system model. In particular, cooperative verifiers provide exchangeable information (verification artifacts) to other verifiers or consume such information from other verifiers with the goal of increasing the overall effectiveness and efficiency of the verification process. This paper first gives an overview over approaches for leveraging strengths of different techniques, algorithms, and tools in order to increase the power and abilities of the state of the art in software verification. To limit the scope, we restrict our overview to tools and approaches for automatic program analysis. Second, we specifically outline cooperative verification approaches and discuss their employed verification artifacts. Third, we formalize all artifacts in a uniform way, thereby fixing their semantics and providing verifiers with a precise meaning of the exchanged information.

show abstract

Section: Improvement Of Effectiveness and Efficiency Storing Intermediate Results Can Be Used To Improve The Effectiveness And Efficiencymentioning

confidence: 99%

Verification Artifacts in Cooperative Verification: Survey and Unifying Component Framework

Beyer

Wehrheim

2020

Lecture Notes in Computer Science

View full text Add to dashboard Cite

show abstract

“…CoVeriTest [11] recently generalized this approach. Conditional static analysis [49] splits the program paths into subsets, runs one dataflow analysis on each subset and finally combines the results of these restricted analyses.…”

Section: Related Workmentioning

confidence: 99%

FRed: Conditional Model Checking via Reducers and Folders

Beyer

Jakobs

2020

Software Engineering and Formal Methods

View full text Add to dashboard Cite

There are many hard verification problems that are currently only solvable by applying several verifiers that are based on complementing technologies. Conditional model checking (CMC) is a successful solution for cooperation between verification tools. In CMC, the first verifier outputs a condition describing the state space that it successfully verified. The second verifier uses the condition to focus its verification on the unverified state space. To use arbitrary second verifiers, we recently proposed a reducer-based approach. One can use the reducer-based approach to construct a conditional verifier from a reducer and a (non-conditional) verifier: the reducer translates the condition into a residual program that describes the unverified state space and the verifier can be any off-the-shelf verifier (that does not need to understand conditions). Until now, only one reducer was available. But for a systematic investigation of the reducer concept, we need several reducers. To fill this gap, we developed FRed, a Framework for exploring different REDucers. Given an existing reducer, FRed allows us to derive various new reducers, which differ in their trade-off between size and precision of the residual program. For our experiments, we derived seven different reducers. Our evaluation on the largest and most diverse public collection of verification problems shows that we need all seven reducers to solve hard verification tasks that were not solvable before with the considered verifiers.

show abstract

“…the condition θ is either determined from the analysis design [42], [43], where θ is applicable to all program states, or determined during program analysis execution [44], where θ is composed of the conditions assumed to hold for a certain set of states. Elena Sherman automatic generate the condition θ to decompose the program's state space into multiple partitions based on the program's control flow graph, and each partition corresponds to a set of paths expressed as a set of CFG branches [45].…”

Section: Conditional Static Analysismentioning

confidence: 99%

A Value Set Analysis Refinement Approach Based on Conditional Merging and Lazy Constraint Solving

Lin¹,

Jiang²,

Wang³

et al. 2019

IEEE Access

View full text Add to dashboard Cite

Value set analysis is a common static binary program analysis approach. Value set analysis attempts to identify a tight over-approximation of the program state at any given point in the program and can be used to detect vulnerability. Existing memory corruption detection analysis technologies based on value set analysis have a high false positive rate, because value set analysis suffers from a lack of accuracy. We observed that two main sources of imprecision in value set analysis are merge operation and failed branch conditions tracking. In order to address above problems, in this paper, we propose a value set analysis refinement approach based on conditional merging and lazy constraint solving. We propose a variable dependence analysis algorithm to divide program paths into subsets and only merge the states which satisfy the condition that the states are from the same subset, which reduces the imprecision from the merging operation. We collect path predicates as path constraint and solve the path constraint using Satisfiability Modulo Theories (SMT) solver lazily to get a tighter number range of the variable when a variable need be refined, which reduces the imprecision from the failed branch conditions tracking. We implement a prototype system RVSA based on the proposed approach and verify its effectiveness according to experimentation. Compared with state-of-the-art approach, the experimental results demonstrate that the false positive rate is reduced by 12.9%. Furthermore, using our proposed approach, 25 zero-day vulnerabilities are found in the Netgear httpd binary.

show abstract

Structurally Defined Conditional Data-Flow Static Analysis

Cited by 12 publications

References 19 publications

Verification Artifacts in Cooperative Verification: Survey and Unifying Component Framework

Verification Artifacts in Cooperative Verification: Survey and Unifying Component Framework

FRed: Conditional Model Checking via Reducers and Folders

A Value Set Analysis Refinement Approach Based on Conditional Merging and Lazy Constraint Solving

Contact Info

Product

Resources

About