Adaptive Static Analysis via Learning with Bayesian Optimization

作     者：Heo, Kihong Oh, Hakjoo Yang, Hongseok Yi, Kwangkeun 

作者机构：Seoul Natl Univ Seoul South Korea Korea Univ Seoul South Korea Univ Oxford Oxford England 

出 版 物：《ACM TRANSACTIONS ON PROGRAMMING LANGUAGES AND SYSTEMS》 (美国计算机学会程序设计语言与系统汇刊)

年 卷 期：2018年第40卷第4期

页      面：14-14页

核心收录：

学科分类：08[工学] 0835[工学-软件工程] 0812[工学-计算机科学与技术（可授工学、理学学位）] 

基　　金：Samsung Research Funding & Incubation Center of Samsung Electronics [SRFC-IT1701-09] Institute for Information & communications Technology Promotion (IITP) - Korea government(MSIT) [2017-0-00184] Institute for Information & Communications Technology Promotion (IITP) - Korea government (MSIT) [B0717-16-0098] 

主　　题：Static program analysis data-driven program analysis Bayesian optimization 

摘      要：Building a cost-effective static analyzer for real-world programs is still regarded an art. One key contributor to this grim reputation is the difficulty in balancing the cost and the precision of an analyzer. An ideal analyzer should be adaptive to a given analysis task and avoid using techniques that unnecessarily improve precision and increase analysis cost. However, achieving this ideal is highly nontrivial, and it requires a large amount of engineering efforts. In this article, we present a new learning-based approach for adaptive static analysis. In our approach, the analysis includes a sophisticated parameterized strategy that decides, for each part of a given program, whether to apply a precision-improving technique to that part or not. We present a method for learning a good parameter for such a strategy from an existing codebase via Bayesian optimization. The learnt strategy is then used for new, unseen programs. Using our approach, we developed partially flow- and context-sensitive variants of a realistic. C static analyzer. The experimental results demonstrate that using Bayesian optimization is crucial for learning from an existing codebase. Also, they show that among all program queries that require flow- or context-sensitivity, our partially flow- and context-sensitive analysis answers 75% of them, while increasing the analysis cost only by 3.3x of the baseline flow- and context-insensitive analysis, rather than 40x or more of the fully sensitive version.