检索结果-内蒙古大学图书馆

2019 ivannikov Ispras Open Conference, ISPras 2019

作者： Malyshev, Nikita Dudina, Irina Kutz, Daniil Novikov, Alexander Vartanov, Sergey Ivannikov Institute for System Programming RAS Russia Lomonosov Moscow State University Moscow Russia

ISBN: (纸本)9781728160559

This paper studies the performance and working aspects of SMT solvers on processing formulas acquired during path-sensitive static analysis and dynamic symbolic execution. We review some general patterns of building SMT formulas in the QF_BV logic during analysis and related technical specifics. We also provide the results of comparing different solvers on two sets of requests obtained by Svace static analyzer and Anxiety dynamic symbolic execution tool. It turns out that Yices2 solver performs the best, although, for Svace, notable part of requests can be done better by other solvers. In return, Yices2 misses some features crucial to top-tier analyzers such as deterministic time limit. A brief attempt at making machine learning based solver portfolio shows that solving time can be enhanced, but requires some serious work on feature selection, while technical difficulties may render it unpractical. For Anxiety we found out that with Yices2 incremental solving is almost always faster (sometimes dozens of times faster) than non-incremental. Moreover, the more queries we solve incrementally, the higher acceleration we get. © 2019 IEEE.

关键词： Static analysis

来源：评论

学校读者我要写书评

暂无评论

Research on automatic generation of fuzz-target for software library functions

Research on automatic generation of fuzz-target for software...

引用

2022 ivannikov Open Conference, ISPras 2022

作者： Tran, Chi Thien Ponomarev, Dmitry Kuznhesov, Andrey Programming of the Ras Ivannikov Institute for System Moscow Russia Llc 'Fobos-nt' Moscow Russia

ISBN: (纸本)9798350398533

To avoid re-development, software libraries are widely used. However, the automated testing of software libraries remains challenging. This article focuses on the use of fuzzing technology and automatic code generation for testing software libraries. Since late of 2020, the instrument Futag [1] - Fuzz-targets automatic generator for software libraries - has been developed in ivannikov institute for system programming of Russian academy of science. The instrument gathers data on the building process, generates the fuzz-targets for library functions, and performs static analysis to find entity dependencies in library source code. As result, Futag has found bugs in software libraries such as libpng, tinyxml2, libpq-standalone, etc. © 2022 IEEE.

关键词： Software testing

来源：评论

学校读者我要写书评

暂无评论

Devirtualization for static analysis with low level intermediate representation

Devirtualization for static analysis with low level intermed...

引用

2022 ivannikov Open Conference, ISPras 2022

作者： Galustov, Artemiy Borodin, Alexey Belevantsev, Andrey Ivannikov Institute for System Programming of the Ras Russia Lomonosov Moscow State University Moscow Russia

ISBN: (纸本)9798350398533

We propose a points-to analysis that can recover targets for function pointer calls, virtual calls and method calls for using in a static analysis. We use a flow-insensitive analysis, and the analysis results are intended for flow- and path-sensitive analysis which can improve the initial analysis precision within a single function. We implemented the proposed approach in a static analyzer for finding errors in C, C++, Go, Java and Kotlin programs. The devirtualization algorithm is fast enough and spends less than 6% of the total analysis time. It can work for projects like Tizen 7 with 27.5 MLoc of source code. © 2022 IEEE.

关键词： Static analysis

来源：评论

学校读者我要写书评

暂无评论

Strong Optimistic Solving for Dynamic Symbolic Execution

Strong Optimistic Solving for Dynamic Symbolic Execution

引用

2022 ivannikov Memorial Workshop, IVMEM 2022

作者： Parygina, Darya Vishnyakov, Alexey Fedotov, Andrey Ivannikov Institute for System Programming of the RAS Russia Lomonosov Moscow State University Moscow Russia

ISBN: (数字)9781665492973

ISBN: (纸本)9781665492973

Dynamic symbolic execution (DSE) is an effective method for automated program testing and bug detection. It is increasing the code coverage by the complex branches exploration during hybrid fuzzing. DSE tools invert the branches along some execution path and help fuzzer examine previously unavailable program parts. DSE often faces over-and underconstraint problems. The first one leads to significant analysis complication while the second one causes inaccurate symbolic *** propose strong optimistic solving method that eliminates irrelevant path predicate constraints for target branch inversion. We eliminate such symbolic constraints that the target branch is not control dependent on. Moreover, we separately handle symbolic branches that have nested control transfer instructions that pass control beyond the parent branch scope, e.g. return, goto, break, etc. We implement the proposed method in our dynamic symbolic execution tool *** evaluate the strong optimistic strategy, the optimistic strategy that contains only the last constraint negation, and their combination. The results show that the strategies combination helps increase either the code coverage or the average number of correctly inverted branches per one minute. It is optimal to apply both strategies together in contrast with other configurations. © 2022 IEEE.

关键词： Security of data

来源：评论

学校读者我要写书评

暂无评论

Interprocedural static analysis for Go with closure support

Interprocedural static analysis for Go with closure support

引用

2022 ivannikov Open Conference, ISPras 2022

作者： Borodin, Alexey Dvortsova, Varvara Volkov, Alexander Ivannikov Institute for System Programming of the Ras Russia Lomonosov Moscow State University Moscow Russia

ISBN: (纸本)9798350398533

We present an interprocedural static analysis to detect errors in the Go source code. The analysis supports most of the language features, while the main focus of the paper is closures and defer statements. The analysis we have developed demonstrates good scalability and performance. It is able to analyze a project of 1.1 million lines in 12 minutes. © 2022 IEEE.

关键词： Static analysis

来源：评论

学校读者我要写书评

暂无评论

ISPras@FinTOC-2021 Shared Task: Two-stage TOC generation model 3

ISPRAS@FinTOC-2021 Shared Task: Two-stage TOC generation mod...

引用

3rd Financial Narrative Processing Workshop, FNP 2021

作者： Kozlov, Ilya Belyaeva, Oksana Bogatenkova, Anastasiya Perminov, Andrew Ivannikov Institute for System Programming of the RAS 25 Alexander Solzhenitsyn Str. Moscow109004 Russia

We propose a two-stage approach for TOC generation from financial documents. This work connected with participation in FinTOC-2021 Shared Task: "Financial Document Structure Extraction". The competition contains two subtasks: title detection and TOC generation. Our model consists of two classifiers: the first binary classifier separates title lines from non-title, the second one determines the title level. In the title detection task, we got 0.813 and 0.787 F1 measure, in the TOC generation task we got 37.9 and 42.1 the harmonic mean between Inex F1 score and Inex level accuracy for English and French documents respectively. With these results, our approach took third place among all submissions. As a team, we took second place in the competition in all categories. © Proceedings of the 3rd Financial Narrative Processing Workshop, FNP 2021. All rights reserved.

关键词： Finance

来源：评论

学校读者我要写书评

暂无评论

Python Fuzzing for Trustworthy Machine Learning Frameworks

引用

Journal of Mathematical Sciences (United States) 2024年第2期285卷 180-188页

作者： Yegorov, I. Kobrin, E. Parygina, D. Vishnyakov, A. Fedotov, A. Ivannikov Institute for System Programming of the RAS Moscow Russian Federation Lomonosov Moscow State University Moscow Russian Federation

Ensuring the security and reliability of machine learning frameworks is crucial for building trustworthy AI-based systems. Fuzzing, a popular technique in the secure software development lifecycle (SSDLC), can be used to develop secure and robust software. Popular machine learning frameworks such as PyTorch and TensorFlow are complex and written in multiple programming languages including C/C++ and Python. We propose a dynamic analysis pipeline for Python projects using the Sydr-Fuzz toolset. Our pipeline includes fuzzing, corpus minimization, crash triaging, and coverage collection. Crash triaging and severity estimation are important steps to ensure that the most critical vulnerabilities are addressed promptly. Furthermore, the proposed pipeline is integrated in GitLab CI. To identify the most vulnerable parts of the machine learning frameworks, we analyze their potential attack surfaces and develop fuzz targets for PyTorch, TensorFlow, and related projects such as h5py. Applying our dynamic analysis pipeline to these targets, we were able to discover 3 new bugs and propose fixes for them. © The Author(s), under exclusive licence to Springer Nature Switzerland AG 2024.

关键词：

来源：评论

学校读者我要写书评

暂无评论

Docreader labeling system for line type classifier 4

Docreader labeling system for line type classifier

引用

4th Scientific-Practical Workshop Information Technologies: Algorithms, Models, systems, ITAMS 2021

作者： Kozlov, Ilya S. Ivannikov Institute for System Programming of the RAS Alexander Solzhenitsyn st. 25 Moscow109004 Russia

We develop the document analysis system, which is able to extract text and text metadata (such as font size and style), and restore the document structure. Some parts of the pipeline are based on machine learning thus requiring training and the labeled dataset, creating a training dataset is based on manual labeling. In this article, we describe an approach to the creation of a labeling system in the task of multiclass classification of document lines (paragraphs). The pipeline consists of several stages ranged from getting the source documents to getting a ready-to-learn dataset. An approach to the analysis of scanned documents and documents in docx and txt format is considered. In our work, we focus on intra-team labeling, thus we do not consider some problems, common for the crowdsourcing approach (such as unscrupulous annotators). © 2021 Copyright for this paper by its authors.

关键词： Pipelines

来源：评论

学校读者我要写书评

暂无评论

A Comprehensive Approach to Finding Resource Leaks via Static Analysis

A Comprehensive Approach to Finding Resource Leaks via Stati...

引用

2024 ivannikov Open Conference, ISPras 2024

作者： Malyshev, Nikita Borodin, Alexey Belevantsev, Andrey Ivannikov Institute for System Programming of the RAS Moscow Russia Lomonosov Moscow State University Moscow Russia

ISBN: (纸本)9798331526023

In the last 15 years many dedicated leak detection tools utilizing novel approaches were designed. Unfortunately, most of them are hard to implement and fully utilize in the scope of a multi-purpose industrial analyzer. In this paper we present a full-fledged approach to static analysis through the lens of resource leak detection. We show how general analysis architecture without much of a focus for specific defects can still be effective at finding leaks both in terms of performance and number of warnings. We briefly describe an overall structure of the Svace static analyzer and how it achieves context and path sensitivities as well as interprocedurality, while allowing for checking many program properties and being highly extensible. We also show how to use this system to implement leak detection algorithm with including a few unique extensions that we have never seen in other instruments. Our test results show a low false positive rate, relatively good performance for a multi-detector static analyzer and great scalability potential both in terms of adding new algorithms and analyzing millions of lines of code. © 2024 IEEE.

关键词： Information leakage

来源：评论

学校读者我要写书评

暂无评论

User Defined Checkers for Static Analysis with Symbolic Execution

User Defined Checkers for Static Analysis with Symbolic Exec...

引用

2024 ivannikov Memorial Workshop, IVMEM 2024

作者： Galustov, Artemiy Borodin, Alexey Ivannikov Institute for System Programming of the RAS Moscow Russia Lomonosov Moscow State University Moscow Russia

ISBN: (纸本)9798331504663

Many modern static analysis tools provide toolkits that allow creation of custom checkers by end users. The majority of existing solutions choose AST-based approaches to provide a simpler declarative API. Solutions based on dataflow analysis or symbolic execution use complex explicit APIs that require much more expertise to achieve decent results compared to AST-based checkers. Even though the latter approach is much more powerful simplicity of the former made it much more *** this paper we introduce SvaceAPI a tool to write checkers based on symbolic execution in a declarative way. We describe a simple pattern-based API that leverages symbolic execution and attributes provided by Svace. Testing the API on a couple of checkers and open source programs across the variety of languages showed the same quality results as for built-in Svace checkers without noticeable performance regressions. © 2024 IEEE.

关键词： Open source software

来源：评论

学校读者我要写书评

暂无评论

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案：

请选择收藏分类：

通借通还

建议与咨询 留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案： 新增检索档案 确定 取消

请选择收藏分类： 新增自定义分类 确定 取消

通借通还

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

请选择保存的检索档案：

请选择收藏分类：