检索结果-内蒙古大学图书馆

Dynamic data-flow analysis with Dacite: Evaluating an Integrated data-flow Visualization Approach 1

18th International Conference on Evaluation of Novel Approaches to Software Engineering (ENASE)

作者： Troost, Laura Neugebauer, Jonathan Kuchen, Herbert Univ Munster Dept Informat Syst Munster Germany

ISBN: (数字)9783031641824

ISBN: (纸本)9783031641817;9783031641824

According to different studies, analyzing the data-flow coverage when testing programs is a highly effective approach to ensure software quality. However, there is a need for tools making an effective and comprehensible visualization of a program's data flow easily accessible. With Dacite, we intend to meet this need by visualizing data-flows of Java programs within multiple editing environments based on the Language Server Protocol (LSP). We present our visualization approach and outline how we used the LSP for realizing the visualization. We evaluate Dacite based on a usability study giving insights in the effectiveness and comprehensibility of the data-flow visualization.

关键词： data-flow analysis Bytecode analysis Java instrumentation Software testing Language server protocol Usability testing

来源：评论

学校读者我要写书评

暂无评论

Visualizing Dynamic data-flow analysis of Object-Oriented Programs Based on the Language Server Protocol 18

Visualizing Dynamic Data-Flow Analysis of Object-Oriented Pr...

引用

18th International Conference on Evaluation of Novel Approaches to Software Engineering (ENASE)

作者： Troost, Laura Neugebauer, Jonathan Kuchen, Herbert Univ Munster Dept Informat Syst Munster Germany

ISBN: (纸本)9789897586477

Although studies emphasized the effectiveness of analyzing data-flow coverage as opposed to branch coverage in the area of testing, there is still a lack of appropriate tools. We propose an approach to visualize data flows of programs within code editors based on the Language Server Protocol (LSP). For this purpose, we define extensions of the LSP to increase usability in the given application. Furthermore, we present a prototype with implementations of a language server as well as the two language clients IntelliJ IDEA and Visual Studio Code. Moreover, we outline how the different components can interact effectively based on the LSP to enable the analysis and visualization of data-flows. We evaluate our prototype based on various benchmarks.

关键词： data-flow analysis Bytecode analysis Java Instrumentation Software Testing Integrated Development Environment Language Server Protocol

来源：评论

学校读者我要写书评

暂无评论

Efficient Interprocedural data-flow analysis Using Treedepth and Treewidth 1

引用

24th International Conference on Verification, Model Checking, and Abstract Interpretation (VMCAI) part of the 50th ACM SIGPLAN Symposium on Principles of Programming Languages (POPL)

作者： Goharshady, Amir Kafshdar Zaher, Ahmed Khaled Hong Kong Univ Sci & Technol Clear Water Bay Hong Kong Peoples R China

ISBN: (数字)9783031249501

ISBN: (纸本)9783031249495;9783031249501

We consider interprocedural data-flow analysis as formalized by the standard IFDS framework, which can express many widelyused static analyses such as reaching definitions, live variables, and nullpointer. We focus on the well-studied on-demand setting in which queries arrive one-by-one in a stream and each query should be answered as fast as possible. While the classical IFDS algorithm provides a polynomialtime solution for this problem, it is not scalable in practice. More specifically, it will either require a quadratic-time preprocessing phase or takes linear time per query, both of which are untenable for modern huge codebases with hundreds of thousands of lines. Previous works have already shown that parameterizing the problem by the treewidth of the program's control-flow graph is promising and can lead to significant gains in efficiency. Unfortunately, these results were only applicable to the limited special case of same-context queries. In this work, we obtain significant speedups for the general case of on-demand IFDS with queries that are not necessarily same-context. This is achieved by exploiting a new graph sparsity parameter, namely the treedepth of the program's call graph. Our approach is the first to exploit the sparsity of control-flow graphs and call graphs at the same time and parameterize by both the treewidth and the treedepth. We obtain an algorithm with a linear preprocessing phase that can answer each query in constant time wrt the size of the input. Finally, our experimental results demonstrate that our approach significantly outperforms the classical IFDS and its on-demand variant.

关键词： Static analysis data-flow analysis IFDS Parameterized algorithms

来源：评论

学校读者我要写书评

暂无评论

SafeDrop: Detecting Memory Deallocation Bugs of Rust Programs via Static data-flow analysis

引用

ACM TRANSACTIONS ON SOFTWARE ENGINEERING AND METHODOLOGY 2023年第4期32卷 82-82页

作者： Cui, Mohan Chen, Chengjun Xu, Hui Zhou, Yangfan Fudan Univ Sch Comp Sci Shanghai Peoples R China Shanghai Key Lab Intelligent Informat Proc Shanghai Peoples R China

Rust is an emerging programming language that aims to prevent memory-safety bugs. However, the current design of Rust also brings side effects, which may increase the risk of memory-safety issues. In particular, it employs ownership-based resource management and enforces automatic deallocation of unused resources without using the garbage collector. It may therefore falsely deallocate reclaimed memory and lead to use-after-free or double-free issues. In this article, we study the problem of invalid memory deallocation and propose SafeDrop, a static path-sensitive data-flow analysis approach to detect such bugs. Our approach analyzes each function of a Rust crate iteratively in a flow-sensitive and field-sensitive way. It leverages a modified Tarjan algorithm to achieve scalable path-sensitive analysis and a cache-based strategy for efficient inter-procedural analysis. We have implemented our approach and integrated it into the Rust compiler. Experiment results show that the approach can successfully detect all such bugs in our experiments with a limited number of false positives and incurs a very small overhead compared to the original compilation time.

关键词： Rust data-flow analysis meet over path path sensitivity

来源：评论

学校读者我要写书评

暂无评论

Accelerating data-flow analysis with Full-Partitioning 19

Accelerating Data-Flow Analysis with Full-Partitioning

引用

19th IEEE International Symposium on Parallel and Distributed Processing with Applications (IEEE ISPA)

作者： Zhang, Yuantong Chen, Liwei Nie, Xiaofan Zhang, Zhijie Wei, Haolai Shi, Gang Chinese Acad Sci Inst Informat Engn Beijing Peoples R China Univ Chinese Acad Sci Sch Cyber Secur Beijing Peoples R China

ISBN: (纸本)9781665435741

data-flow analysis is a classical way to deal with program optimization and program analysis issues. However, the classical iterative data-flow analysis prone to low efficiency when applied to vulnerability detection, because more exhaustive information is required. Therefore, we propose the full-partitioned interprocedural data-flow analysis. In this way, all works to a program are carried out to procedures strictly. We also introduce the novel Pointee Objects Intermediate Representation object to replace the real pointees during interprocedural pointer analysis. It aims to solve the representation of pointee objects when interprocedural pointer analysis is full-partitioned. The interprocedural data-flow analysis is realized by using the function summary. We have observed a significant increase in efficiency and a good capability to support the use-after-free detection.

关键词： full partition data-flow analysis use-after-free detection

来源：评论

学校读者我要写书评

暂无评论

Optimal and Perfectly Parallel Algorithms for On-demand data-flow analysis 1

引用

29th European Symposium on Programming (ESOP) held as part of the European Joint Conferences on Theory and Practice of Software (ETAPS)

作者： Chatterjee, Krishnendu Goharshady, Amir Kafshdar Ibsen-Jensen, Rasmus Pavlogiannis, Andreas IST Austria Klosterneuburg Austria Univ Liverpool Liverpool Merseyside England Aarhus Univ Aarhus Denmark

ISBN: (数字)9783030449148

ISBN: (纸本)9783030449148;9783030449131

Interprocedural data-flow analyses form an expressive and useful paradigm of numerous static analysis applications, such as live variables analysis, alias analysis and null pointers analysis. The most widely-used framework for interprocedural data-flow analysis is IFDS, which encompasses distributive data-flow functions over a finite domain. On-demand data-flow analyses restrict the focus of the analysis on specific program locations and data facts. This setting provides a natural split between (i) an offine (or preprocessing) phase, where the program is partially analyzed and analysis summaries are created, and (ii) an online (or query) phase, where analysis queries arrive on demand and the summaries are used to speed up answering queries. In this work, we consider on-demand IFDS analyses where the queries concern program locations of the same procedure (aka same-context queries). We exploit the fact that flow graphs of programs have low treewidth to develop faster algorithms that are space and time optimal for many common data-flow analyses, in both the preprocessing and the query phase. We also use treewidth to develop query solutions that are embarrassingly parallelizable, i.e. the total work for answering each query is split to a number of threads such that each thread performs only a constant amount of work. Finally, we implement a static analyzer based on our algorithms, and perform a series of on-demand analysis experiments on standard benchmarks. Our experimental results show a drastic speed-up of the queries after only a lightweight preprocessing phase, which significantly outperforms existing techniques.

关键词： data-flow analysis IFDS Treewidth

来源：评论

学校读者我要写书评

暂无评论

GPU-Based Static data-flow analysis for Fast and Scalable Android App Vetting 34

GPU-Based Static Data-Flow Analysis for Fast and Scalable An...

引用

34th IEEE International Parallel and Distributed Processing Symposium (IPDPS)

作者： Yu, Xiaodong Wei, Fengguo Ou, Xinming Becchi, Michela Bicer, Tekin Yao, Danfeng (Daphne) Virginia Tech Dept Comp Sci Blacksburg VA 24061 USA Univ S Florida Dept Comp Sci & Engn Tampa FL 33620 USA North Carolina State Univ Dept Elect & Comp Engn Raleigh NC USA Argonne Natl Lab Data Sci & Learning Div Lemont IL 60439 USA Virginia Tech Blacksburg VA USA Google Android Secur & Privacy Grp Menlo Pk CA USA

ISBN: (纸本)9781728168760

Many popular vetting tools for Android applications use static code analysis techniques. In particular, Interprocedural data-flow Graph (IDFG) construction is the computation at the core of Android static data-flow analysis and consumes most of the analysis time. Many analysis tools use a worklist algorithm, an iterative fixed-point approach, to construct the IDFG. In this paper, we observe that a straightforward GPU parallelization of the worklist algorithm leads to significant underutilization of the GPU resources. We identify four performance bottlenecks, namely, frequent dynamic memory allocations, high branch divergence, workload imbalance, and irregular memory access patterns. Accordingly, we propose GDroid, a GPU-based worklist algorithm implementation with multiple fine-grained optimizations tailored to common characteristics of Android applications. The optimizations considered are: matrix-based data structure, memory access-based node grouping, and worklist merging. Our experimental evaluation, performed on 1000 Android applications, shows that the proposed optimizations are beneficial to performance, and GDroid can achieve up to 128X speedups against a plain GPU implementation.

关键词： GPU static program analysis data-flow analysis Android security mobile application vetting worklist algorithm application-specific optimization

来源：评论

学校读者我要写书评

暂无评论

Discovering software vulnerabilities using data-flow analysis and machine learning 2018

Discovering software vulnerabilities using data-flow analysi...

引用

13th International Conference on Availability, Reliability and Security (ARES)

作者： Kronjee, Jorrit Hommersom, Arjen Vranken, Harald Open Univ Netherlands Heerlen Netherlands Radboud Univ Nijmegen Nijmegen Netherlands

ISBN: (纸本)9781450364485

We present a novel method for static analysis in which we combine data-flow analysis with machine learning to detect SQL injection (SQLi) and Cross-Site Scripting (XSS) vulnerabilities in PHP applications. We assembled a dataset from the National Vulnerability database and the SAMATE project, containing vulnerable PHP code samples and their patched versions in which the vulnerability is solved. We extracted features from the code samples by applying data-flow analysis techniques, including reaching definitions analysis, taint analysis, and reaching constants analysis. We used these features in machine learning to train various probabilistic classifiers. To demonstrate the effectiveness of our approach, we built a tool called WIRECAML, and compared our tool to other tools for vulnerability detection in PHP code. Our tool performed best for detecting both SQLi and XSS vulnerabilities. We also tried our approach on a number of open-source software applications, and found a previously unknown vulnerability in a photo-sharing web application.

关键词： Software security vulnerability detection static code analysis machine learning data-flow analysis

来源：评论

学校读者我要写书评

暂无评论

Lifting inter-app data-flow analysis to large app sets

引用

AUTOMATED SOFTWARE ENGINEERING 2018年第2期25卷 315-346页

作者： Sattler, Florian von Rhein, Alexander Berger, Thorsten Johansson, Niklas Schalck Hardo, Mikael Mark Apel, Sven Univ Passau Passau Germany CQSE GmbH Munich Germany Chalmers I Univ Gothenburg Gothenburg Sweden IT Univ Copenhagen Copenhagen Denmark

Mobile apps process increasing amounts of private data, giving rise to privacy concerns. Such concerns do not arise only from single apps, which might-accidentally or intentionally-leak private information to untrusted parties, but also from multiple apps communicating with each other. Certain combinations of apps can create critical data flows not detectable by analyzing single apps individually. While sophisticated tools exist to analyze data flows inside and across apps, none of these scale to large numbers of apps, given the combinatorial explosion of possible (inter-app) data flows. We present a scalable approach to analyze data flows across Android apps. At the heart of our approach is a graph-based data structure that represents inter-app flows efficiently. Following ideas from product-line analysis, the data structure exploits redundancies among flows and thereby tames the combinatorial explosion. Instead of focusing on specific installations of app sets on mobile devices, we lift traditional data-flow analysis approaches to analyze and represent data flows of all possible combinations of apps. We developed the tool Sifta and applied it to several existing app benchmarks and real-world app sets, demonstrating its scalability and accuracy.

关键词： Android data-flow analysis Inter-app communication Variability-aware analysis Variational data structures

来源：评论

学校读者我要写书评

暂无评论

Discovering and understanding android sensor usage behaviors with data flow analysis

引用

WORLD WIDE WEB-INTERNET AND WEB INFORMATION SYSTEMS 2018年第1期21卷 105-126页

作者： Liu, Xing Liu, Jiqiang Wang, Wei He, Yongzhong Zhang, Xiangliang Beijing Jiaotong Univ Beijing Key Lab Secur & Privacy Intelligent Trans 3 Shangyuancun Beijing 100044 Peoples R China King Abdullah Univ Sci & Technol Div Comp Elect & Math Sci & Engn Thuwal Saudi Arabia

Today's Android-powered smartphones have various embedded sensors that measure the acceleration, orientation, light and other environmental conditions. Many functions in the third-party applications (apps) need to use these sensors. However, embedded sensors may lead to security issues, as the third-party apps can read data from these sensors without claiming any permissions. It has been proven that embedded sensors can be exploited by well designed malicious apps, resulting in leaking users' privacy. In this work, we are motivated to provide an overview of sensor usage patterns in current apps by investigating what, why and how embedded sensors are used in the apps collected from both a Chinese app. market called "AppChina" and the official market called "Google Play". To fulfill this goal, We develop a tool called "SDFDroid" to identify the used sensors' types and to generate the sensor data propagation graphs in each app. We then cluster the apps to find out their sensor usage patterns based on their sensor data propagation graphs. We apply our method on 22,010 apps collected from AppChina and 7,601 apps from Google Play. Extensive experiments are conducted and the experimental results show that most apps implement their sensor related functions by using the third-party libraries. We further study the sensor usage behaviors in the third-party libraries. Our results show that the accelerometer is the most frequently used sensor. Though many third-party libraries use no more than four types of sensors, there are still some third-party libraries registering all the types of sensors recklessly. These results call for more attentions on better regulating the sensor usage in Android apps.

关键词： Android system Sensor usage data-flow analysis Clustering

来源：评论

学校读者我要写书评

暂无评论

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案：

请选择收藏分类：

通借通还

建议与咨询 留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案： 新增检索档案 确定 取消

请选择收藏分类： 新增自定义分类 确定 取消

通借通还

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

请选择保存的检索档案：

请选择收藏分类：