The synergy of precise and fast abstractions for program verification

Sharygina, Natasha; Tonetta, Stefano; Tsitovich, Aliaksei

doi:10.1145/1529282.1529404

Cited by 4 publications

(5 citation statements)

References 20 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…some s ∈ S have also been noted by previous authors (e.g. (Clarke, Grumberg, and Long 1994;Sharygina, Tonetta, and Tsitovich 2009)) and studied in some depth by Sadeqi (2014).…”

Section: Spurious Pathssupporting

confidence: 66%

“…Each refinement iteration first identifies an error in abstract abstraction, and then refines the abstraction so that the same error will never occur again. Similar ideas have been used in many other abstraction refinement methods (e.g., (Clarke et al 2002;Smaus and Hoffmann 2008;Sharygina, Tonetta, and Tsitovich 2009)). One difference between refinements in CE-GAR and our method is that in CEGAR the refinement tries to produce a non-spurious solution path while in our method the refinement only makes sure paths of fixed length k (e.g., k = 2 in our 8-Puzzle experiment) are not spurious.…”

Section: Related Workmentioning

confidence: 92%

“…some s ∈ S have been explicitly distinguished from paths containing a spurious edge by a few authors in the past (e.g. (Clarke et al 2002;Qian and Nymeyer 2004;Smaus and Hoffmann 2008;Sharygina, Tonetta, and Tsitovich 2009)). The work we present in this paper is the first to distinguish two different types of such paths-state-specific and state-independent (defined below)-and to use this understanding to develop a new technique (operator chains) to eliminate spurious paths.…”

Section: Spurious Pathsmentioning

confidence: 99%

See 2 more Smart Citations

The Spurious Path Problem in Abstraction

Fan

Holte

2021

SOCS

View full text Add to dashboard Cite

Abstraction is a powerful technique in search and planning. A fundamental problem of abstraction is that it can create spurious paths, i.e., abstract paths that do not correspond to valid concrete paths. In this paper, we define spurious paths as a generalization of spurious states. We show that spurious paths can be categorized into two types: state-independent spurious paths and state-specific spurious paths. We present a practical method that eliminates state-independent spurious paths, as well as state-specific spurious paths when integrated with mutex detection methods. We provide syntactical conditions under which our method can remove state-independent spurious paths completely. We demonstrate that eliminating spurious paths can improve a heuristic substantially, even in abstract spaces that are free of spurious states.

show abstract

“…some s ∈ S have also been noted by previous authors (e.g. (Clarke, Grumberg, and Long 1994;Sharygina, Tonetta, and Tsitovich 2009)) and studied in some depth by Sadeqi (2014).…”

Section: Spurious Pathssupporting

confidence: 66%

Section: Related Workmentioning

confidence: 92%

Section: Spurious Pathsmentioning

confidence: 99%

See 1 more Smart Citation

The Spurious Path Problem in Abstraction

Fan

Holte

2021

SOCS

View full text Add to dashboard Cite

show abstract

“…Since most model checkers deal only with quantifier-free formulas, the computation of S P requires the elimination of the existential quantifiers. This may result in a bottleneck and some techniques compute weaker/more abstract systems (cfr., e.g., [20]). Implicit predicate abstraction Implicit predicate abstraction [22] embeds the definition of the predicate abstraction in the encoding of the path.…”

Section: Implicit Abstractionmentioning

confidence: 99%

IC3 Modulo Theories via Implicit Predicate Abstraction

Cimatti

Griggio

Mover

et al. 2014

Tools and Algorithms for the Construction and Analysis of Systems

Self Cite

View full text Add to dashboard Cite

We present a novel approach for generalizing the IC3 algorithm for invariant checking from finite-state to infinite-state transition systems, expressed over some background theories. The procedure is based on a tight integration of IC3 with Implicit (predicate) Abstraction, a technique that expresses abstract transitions without computing explicitly the abstract system and is incremental with respect to the addition of predicates. In this scenario, IC3 operates only at the Boolean level of the abstract state space, discovering inductive clauses over the abstraction predicates. Theory reasoning is confined within the underlying SMT solver, and applied transparently when performing satisfiability checks. When the current abstraction allows for a spurious counterexample, it is refined by discovering and adding a sufficient set of new predicates. Importantly, this can be done in a completely incremental manner, without discarding the clauses found in the previous search. The proposed approach has two key advantages. First, unlike current SMT generalizations of IC3, it allows to handle a wide range of background theories without relying on ad-hoc extensions, such as quantifier elimination or theory-specific clause generalization procedures, which might not always be available, and can moreover be inefficient. Second, compared to a direct exploration of the concrete transition system, the use of abstraction gives a significant performance improvement, as our experiments demonstrate.

show abstract

“…While there are no, to the best of our knowledge, tools for model checking mobile code, there is a number of general purpose software model checking tools working at the code level. Most of the code verifiers employ a counterexample guided abstraction refinement to cope with the complexity of verification of real programs (see, for example, [BR01], [STT09] describing respectively the basic and optimized abstraction-refinement techniques). Among such tools are SLAM [BCLR04], COMFORT [CISW05], BLAST [BCH + 04] and SATABS [CKSY05] (each designed for C programming language with SATABS being the most complete tool as it provides both full support for ANSI-C and sound treatment of unbounded thread creation in concurrent programs) and JPF and a tool of Stoller for Java (described above).…”

Section: Related Workmentioning

confidence: 99%

A model checking-based approach for security policy verification of mobile systems

2011

Self Cite

View full text Add to dashboard Cite

This article describes an approach for the automated verification of mobile systems. Mobile systems are characterized by the explicit notion of location (e.g., sites where they run) and the ability to execute at different locations, yielding a number of security issues. To this aim, we formalize mobile systems as Labeled Kripke Structures, encapsulating the notion of location net that describes the hierarchical nesting of the threads constituting the system. Then, we formalize a generic security-policy specification language that includes rules for expressing and manipulating the code location. In contrast to many other approaches, our technique supports both access control and information flow specification. We developed a prototype framework for model checking of mobile systems. It works directly on the program code (in contrast to most traditional process-algebraic approaches that can model only limited details of mobile systems) and uses abstraction-refinement techniques, based also on location abstractions, to manage the program state space. We experimented with a number of mobile code benchmarks by verifying various security policies. The experimental results demonstrate the validity of the proposed mobile system modeling and policy specification formalisms and highlight the advantages of the model checking-based approach, which combines the validation of security properties with other checks, such as the validation of buffer overflows.

show abstract

The synergy of precise and fast abstractions for program verification

Cited by 4 publications

References 20 publications

The Spurious Path Problem in Abstraction

The Spurious Path Problem in Abstraction

IC3 Modulo Theories via Implicit Predicate Abstraction

A model checking-based approach for security policy verification of mobile systems

Contact Info

Product

Resources

About