检索结果-内蒙古大学图书馆

Test Case Generation for Ethereum Smart Contracts Based on Cross-Contract data flow analysis

IEEE TRANSACTIONS ON RELIABILITY 2024年

作者： Wang, Xingya Yang, Yumao Liu, Linwei Chen, Zhenyu Huang, Song Nanjing Tech Univ Coll Comp & Informat Engn Coll Artificial Intelligence Nanjing 211816 Peoples R China Army Engn Univ PLA Coll Command & Control Engn Nanjing 210007 Peoples R China Nanjing Univ State Key Lab Novel Software Technol Nanjing 210000 Peoples R China

Smart contracts manage numerous digital assets, their security requirements are particularly prominent. Testing is an effective way to ensure the reliability of smart contracts. Current test case generation methods do not consider the impact of state variables and cross-contract calls on constraint conditions, leading to low test coverage for cross-contracts. In this regard, we propose a Cross-contract data flow analysis based Test case Generation (CDA-TG) method for Ethereum smart contracts. First, for each function in the target contract, CDA-TG generates its invocation sequence based on the principle of prioritizing functions that define or modify state variables. Then, for each parameter, CDA-TG performs cross-contract data flow analysis on the target contract, extracting the hard-coded values to build its parameter input pool. On this basis, CDA-TG applies the function invocation sequences to generate an initial set of test cases, where the value of each parameter is selected randomly from its parameter input pool. Finally, to further improve the branch coverage, CDA-TG applies the multiobjective sorting algorithm DynaMOSA to optimize the initial test cases. Our empirical study on 66 real smart contracts verified that CDA-TG can significantly improve the branch coverage of smart contracts, with a 8.86% improvement compared to the state-of-the-art test case generation method AGSolT in cross-contract scenario.

关键词： Cross-contract data flow analysis Ethereum smart contract state variable test case generation

来源：评论

学校读者我要写书评

暂无评论

Manim-DFA: Visualising data flow analysis and Abstract Interpretation Algorithms with Automated Video Generation 17

Manim-DFA: Visualising Data Flow Analysis and Abstract Inter...

引用

17th International Conference on Computer Supported Education, CSEDU 2025

作者： Berg, Lucas Yernaux, Gonzague Vandeloise, Mikel Vanhoof, Wim Faculty of Computer Science University of Namur Belgium

ISBN: (纸本)9789897587467

In this paper, we introduce Manim-DFA, an extension of the Manim library for generating video visualisations to teach data flow analysis and abstract interpretation. Despite the importance of data flow analysis in static program analysis, educational visualisation tools remain scarce. Manim-DFA addresses this gap by enabling educators to animate control flow graphs and lattice structures, illustrating their transformation during program analysis. Currently, the tool supports automated animation of the worklist algorithm, as well as lattice visualisation. Designed with established pedagogical principles, Manim-DFA promotes active learning, reduces cognitive load, and enhances conceptual understanding. Preliminary evaluations suggest that it effectively complements traditional resources and supports autonomous learning. Copyright © 2025 by SCITEPRESS - Science and Technology Publications, Lda.

关键词： data flow analysis

来源：评论

学校读者我要写书评

暂无评论

OctopusTaint: Advanced data flow analysis for Detecting Taint-Based Vulnerabilities in IoT/IIoT Firmware 24

OctopusTaint: Advanced Data Flow Analysis for Detecting Tain...

引用

31st Conference on Computer and Communications Security

作者： Qasem, Abdullah Debbabi, Mourad Soeanu, Andrei Concordia Univ Secur Res Ctr Montreal PQ Canada

ISBN: (纸本)9798400706363

The widespread integration of Internet of Things (IoT) and Industrial IoT (IIoT) devices in respectively home and business environments offers both benefits and perils. While these devices, such as IP cameras and network routers improve operational efficiency with their user-friendly web interfaces, they also broaden the potential for cybersecurity vulnerabilities. Recent studies highlight the vulnerability of these devices to taint-based attacks, demonstrating that even attackers with limited permissions can gain control of a device. Current state-of-the-art solutions for mitigating these risks primarily utilize Dynamic Symbolic Execution (DSE). Although effective, DSE is computationally costly and challenging for large-scale analysis. Besides, during inspection, these approaches typically exhibit over-taint behavior by producing a large number of alerts, many of which are false positives due to ineffective handling of sanitization measures that might be in place. To overcome these limitations, we introduce OctopusTaint, an innovative static-based taint analysis approach that integrates advanced data flow analysis with backtracking techniques. OctopusTaint is distinguished by its integration of a sanitization inspection module and sophisticated post-processing filters. These features are specifically designed to minimize false positives effectively while ensuring the accurate identification of genuine security threats. OctopusTaint also excels in tracking transformed tainted inputs across NVRAM, identifying new user-defined taint source functions while addressing the challenges associated with indirect calls and aliasing. Through comparative performance evaluations, OctopusTaint demonstrates superior performance over the current state-of-the-art solutions, SaTC, EmTaint, and MangoDFA. It reports genuine extra tainted sinks in considerable less time (24% faster). Furthermore, OctopusTaint identifies 82% of tainted sinks within EmTaint's labeled dataset while exhibit

关键词： Vulnerability Detection IoT and IIoT Security Firmware analysis Static analysis Taint analysis data flow analysis Sanitization Inspection

来源：评论

学校读者我要写书评

暂无评论

Electric Load Profile of 5G Base Station in Distribution Systems Based on data flow analysis

引用

IEEE TRANSACTIONS ON SMART GRID 2022年第3期13卷 2452-2466页

作者： Zou, Yao Wang, Qianggang Chi, Yuan Wang, Jian Lei, Chao Zhou, Niancheng Xia, Qinqin Chongqing Univ State Key Lab Power Transmiss Equipment & Syst Se Chongqing 400044 Peoples R China Hohai Univ Coll Energy & Elect Engn Nanjing 211100 Peoples R China Hong Kong Polytech Univ Ctr Adv Reliabil & Safety Hong Kong Peoples R China Hong Kong Polytech Univ Dept Elect Engn Hong Kong Peoples R China

This paper proposes an electric load demand model of the 5th generation (5G) base station (BS) in a distribution system based on data flow analysis. First, the electric load model of a 5G BS is developed according to its components and their characteristics. Second, critical factors of the power consumption of 5G BS, including area, data flow with uncertainty number of activated terminals and data usage of the terminal, are discussed. A statistical model of the number of activated terminals and data usage of the terminal are established using a probability distribution, and Monte Carlo sampling is used to handle the uncertainties. Then, the model is extended for multiple terminal connections. A case study is conducted to analyze the impact of the critical factors on the load of 5G BS and the influence of 5G BSs load on the other loads in three typical areas. Numerical results demonstrate that the proposed model is effective and can be employed as an accurate representation of the 5G BS load profile for the analysis of load characteristics. Case studies also show that the 5G BS loads have diverse impact on different typical areas in a distribution system.

关键词： 5G mobile communication Power demand Load modeling Downlink Monte Carlo methods Wireless communication data models Electric load profile 5G base station data flow analysis distribution system Monte Carlo sampling

来源：评论

学校读者我要写书评

暂无评论

Towards Inter-Service data flow analysis of Serverless Applications 31

Towards Inter-Service Data Flow Analysis of Serverless Appli...

引用

31st IEEE International Conference on Software analysis, Evolution and Reengineering, SANER 2024

作者： Raffa, Giuseppe Blasco, Jorge O'Keeffe, Dan Dash, Santanu Kumar Royal Holloway University London United Kingdom Universidad Politecnica Madrid Spain

ISBN: (纸本)9798350330663

The recent advent of serverless applications has created a need for static analysis tools to analyse them. However, the event-driven architecture of serverless applications, along with the black-box nature of the services they invoke, make static analysis challenging. In this work, we propose a novel approach to statically analysing serverless applications, with a focus on the identification of data flows that can lead to code injection and information leakage. To reach our goal, we first design a new suite of microbenchmarks, which we publicly release. The microbenchmarks are based on documented serverless-specific vulnerabilities and the characterization of an existing dataset. We then introduce our static analysis approach and show how it can factor in the effect of platform services and eventtriggered code execution by extracting relevant information from both infrastructure and application code. This information is used to obtain a synchronous equivalent of the underlying asynchronous system, which can be inspected with a general-purpose static analysis tool. Preliminary evaluation results using a prototype implementation of our approach and the microbenchmark suite confirm the potential of our analysis technique. © 2024 IEEE.

关键词： data flow analysis

来源：评论

学校读者我要写书评

暂无评论

AndroEvolve: automated Android API update with data flow analysis and variable denormalization

引用

EMPIRICAL SOFTWARE ENGINEERING 2022年第3期27卷 1-31页

作者： Haryono, Stefanus A. Thung, Ferdian Lo, David Jiang, Lingxiao Lawall, Julia Kang, Hong Jin Serrano, Lucas Muller, Gilles Singapore Management Univ Sch Comp & Informat Syst Singapore Singapore Inria Paris France Sorbonne Univ Inria LIP6 Paris France

The Android operating system is frequently updated, with each version bringing a new set of APIs. New versions may involve API deprecation;Android apps using deprecated APIs need to be updated to ensure the apps' compatibility with old and new Android versions. Updating deprecated APIs is a time-consuming endeavor. Hence, automating the updates of Android APIs can be beneficial for developers. CocciEvolve is the state-of-the-art approach for this automation. However, it has several limitations, including its inability to resolve out-of-method variables and the low code readability of its updates due to the addition of temporary variables. In an attempt to further improve the performance of automated Android API update, we propose an approach named AndroEvolve, that addresses the limitations of CocciEvolve through the addition of data flow analysis and variable name denormalization. data flow analysis enables AndroEvolve to resolve the value of any variable within the file scope. Variable name denormalization replaces temporary variables that may present in the CocciEvolve update with appropriate values in the target file. We have evaluated the performance of AndroEvolve and the readability of its updates on 372 target files containing 565 deprecated API usages. Each target file represents a file from an Android application that uses a deprecated API in its code. AndroEvolve successfully updates 481 out of 565 deprecated API invocations correctly, achieving an accuracy of 85.1%. Compared to CocciEvolve, AndroEvolve produces 32.9% more instances of correct updates. Moreover, our manual and automated evaluation shows that AndroEvolve updates are more readable than CocciEvolve updates.

关键词： Program transformation Android data flow analysis Readability API deprecation API update

来源：评论

学校读者我要写书评

暂无评论

data flow analysis of Asynchronous Systems using Infinite Abstract Domains 1

引用

30th European Symposium on Programming (ESOP) Held as Part of the 24th European Joint Conferences on Theory and Practice of Software (ETAPS)

作者： Athaiya, Snigdha Komondoor, Raghavan Kumar, K. Narayan Indian Inst Sci Bengaluru India Chennai Math Inst Chennai Tamil Nadu India

ISBN: (数字)9783030720193

ISBN: (纸本)9783030720193;9783030720186

Asynchronous message-passing systems are employed frequently to implement distributed mechanisms, protocols, and processes. This paper addresses the problem of precise data flow analysis for such systems. To obtain good precision, data flow analysis needs to somehow skip execution paths that read more messages than the number of messages sent so far in the path, as such paths are infeasible at run time. Existing data flow analysis techniques do elide a subset of such infeasible paths, but have the restriction that they admit only finite abstract analysis domains. In this paper we propose a generalization of these approaches to admit infinite abstract analysis domains, as such domains are commonly used in practice to obtain high precision. We have implemented our approach, and have analyzed its performance on a set of 14 benchmarks. On these benchmarks our tool obtains significantly higher precision compared to a baseline approach that does not elide any infeasible paths and to another baseline that elides infeasible paths but admits only finite abstract domains.

关键词： data flow analysis Message-passing systems

来源：评论

学校读者我要写书评

暂无评论

A Comprehensive Dynamic data flow analysis of Object-Oriented Programs 17

A Comprehensive Dynamic Data Flow Analysis of Object-Oriente...

引用

17th International Conference on Evaluation of Novel Approaches to Software Engineering (ENASE)

作者： Troost, Laura Kuchen, Herbert Univ Munster Inst Pract Comp Sci Leonardo Campus Munster Germany

ISBN: (纸本)9789897585685

Studies have shown that in the area of testing data-flow coverage is often more effective in exposing errors compared to other approaches such as branch coverage. Thus, evaluating and generating test cases with respect to the data-flow coverage is desirable. Unfortunately, data-flow coverage is rarely considered in practice due to the lack of appropriate tools. Existing tools are typically based on static analysis and cannot distinguish between traversable and non-traversable data flows. They also have typically difficulties with properly handling aliasing and complex data structures. Thus, we propose a tool for dynamically analyzing the data-flow coverage which avoids all these drawbacks. In combination with our existing test-case generator, it enables the creation of an (almost) minimal set of test cases that guarantee all data flows to be covered. We have evaluated our tool based on a couple of benchmarks.

关键词： data flow analysis Bytecode analysis Java Instrumentation

来源：评论

学校读者我要写书评

暂无评论

Dflow: A data flow analysis tool for C/C plus

引用

IEEJ TRANSACTIONS ON ELECTRICAL AND ELECTRONIC ENGINEERING 2021年第12期16卷 1635-1641页

作者： Yan, Qiaoqiao Li, Yongjun Wu, Yuanhao Zhou, Jialong Northwestern Polytech Univ Sch Comp Xian 710072 Shaanxi Peoples R China

.Abstract syntax trees (ASTs), control flow graphs (CFGs), and data flow analysis (DFA) are prerequisites for static and dynamic analysis and vulnerability detection for programs;thus, obtaining them is significant. Recently, many tools related to generating ASTs, CFGs, and DFA have been proposed. However, most tools can only construct ASTs, very few can construct ASTs and CFGs, and almost none can construct all three. The vast majority of AST, CFG, and DFA tools are for other languages (e.g., Java and Python), and while a few are for C/C++, they are implemented in other languages, creating complex working environments, and overreliance on other language-related libraries. To address these shortcomings, we present a DFA tool, Dflow, for C/C++. First, a lexical/grammatical analyzer generated by Flex and Bison is used to analyze the program. Second, an AST is constructed from the results;then, a CFG is obtained from the analysis results and the information from the AST. Finally, based on the AST and CFG, DFA is performed, and the vulnerabilities of simple programs are determined. We test some common vulnerable code and common weakness enumeration slicing code, which show the effectiveness of Dflow in program data flow analysis and vulnerability checking. The results show that our tool can implement ASTs, CFGs, and DFA, and we add some rules to the tool for vulnerability detection. (c) 2021 Institute of Electrical Engineers of Japan. Published by Wiley Periodicals LLC.

关键词： abstract syntax tree control flow graph data flow analysis

来源：评论

学校读者我要写书评

暂无评论

data flow analysis Using Matrix Calculations

Data Flow Analysis Using Matrix Calculations

引用

2021 International Russian Automation Conference, RusAutoCon 2021

作者： Panchenko, O.V. Kazan National Research Technological University Department of Intelligent Systems and Information Resource Management Kazan Russia

ISBN: (纸本)9780738131566

In recent decades, many household items have become computerized, collecting data and sending it for further processing. Consequently, the number of data flow structure requirements to analyze data in real-time is steadily increasing. Besides, sensors, remote sensing, social networks, and other fields of activity generate data in the form of arrays. However, the projects use existing statistical data streams for matrix calculations. From a theoretical point of view, matrices and matrix transformations are widely used to solve many problems in computer science, such as machine learning, electrical circuit analysis, and image and graph processing. Thus, it will be possible to build different algorithms for many spheres, based on the basic matrix operations. Thus, the main goals of this work are to provide matrix calculations for data flow analysis. To do this, you need to add matrix data structures for built-in support for matrices as stream elements and matrix operations. Besides, these matrix classes must be used for operators that do not alter or storing state. © 2021 IEEE.

关键词： data flow analysis

来源：评论

学校读者我要写书评

暂无评论

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案：

请选择收藏分类：

通借通还

建议与咨询 留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案： 新增检索档案 确定 取消

请选择收藏分类： 新增自定义分类 确定 取消

通借通还

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

请选择保存的检索档案：

请选择收藏分类：