Implementations of static analyses are usually tailored toward a single goal to be efficient, hampering reusability and adaptability of the components of an analysis. To solve these issues, we propose to implement static analyses as highly-configurable software product lines (SPLs). Furthermore, we also discuss an implementation of an SPL for static analyses -- called OPAL -- that uses advanced language features offered by the Scala programming language to get an easily adaptable and (type-)safe software product line. OPAL is a general purpose library for static analysis of Java Bytecode that is already successfully used. We present OPAL and show how a design based on software produce line engineering benefits the implementation of static analyses with the framework.
Slicing is a powerful technique that can help a developer to understand how the interaction of different parts of a program causes a specific outcome. Dynamic slicing uses runtime information to compute a precise slice for a given execution. However, dynamic slicing is not possible without a static analysis of the underlying code to reveal dependencies between the instructions that have been recorded. In this paper, we present a new algorithm for computing dynamic slices. We describe how the optimization framework Soot was used to compute specialized intraprocedural dependency graphs that better reflect the programmer's view of a program than previous approaches. Combining these dependency graphs with recorded execution traces allowed us to create debuggable dynamic slices. For this, a mapping of the debugger's model of the execution to the static code model of Soot was needed, and could be found with only few ambiguities. This results in the ability to produce a dynamic slice that can not only be visualized, but explored interactively and adjusted to better answer specific questions.
One approach to defending against malicious Android applications has been to analyze them to detect potential information leaks. This paper describes a new static taint analysis for Android that combines and augments the FlowDroid and Epicc analyses to precisely track both inter-component and intra-component data flow in a set of Android applications. The analysis takes place in two phases: given a set of applications, we first determine the data flows enabled individually by each application, and the conditions under which these are possible; we then build on these results to enumerate the potentially dangerous data flows enabled by the set of applications as a whole. This paper describes our analysis method, implementation, and experimental results.
Points-to analysis that scales to large programs is still an open area of research and there are several trade-offs between speed and precision. In this paper, we report advances in achieving extremely fast and scalable analysis for field-sensitive inclusion-based points-to analysis. The first algorithm is based on an explicit representation, sparse bit-vector set representation. The second algorithm is a refinement of the first using symbolic set representations using binary decision diagrams. The first algorithm scales extremely well when compared with the state-of-the-art points-to analysis problems solving the same problem, while the second reduces the memory footprint tremendously, using, on average, 4.6x less memory than the first, and even performs slightly faster points-to set propagation. The techniques that we introduce are a judicious combination of several heuristics involving sparse bit-vector set representations, prioritized processing of worklists for efficient iteration while computing fixed-points, and usage of binary decision diagrams for storing (but not propagating) points-to sets. The implementation of our approaches scales to large real life Java applications. We evaluated our implementation on benchmark applications from two recent releases of DaCapo benchmark suite using a recent version of Java Standard Library (JRE 1.7_03). Using our techniques we can propagate points-to information on all the benchmarks in less than a minute, using at most 2GB of memory for explicit representation and, at most 600MB for symbolic representation. Comparison with the fastest and the most closely related explicit and symbolic approaches reveals that our techniques are more scalable than related explicit approaches, and in terms of time, on average 4x times faster than the current state-of-the-art.
Program analyses developed over the last three decades have demonstrated the ability to prove non-trivial properties of real-world programs. This ability in turn has applications to emerging software challenges in security, software-defined networking, cyber-physical systems, and beyond. The diversity of such applications necessitates adapting the underlying program analyses to client needs, in aspects of scalability, applicability, and accuracy. Today's program analyses, however, do not provide useful tuning knobs. This talk presents a general computer-assisted approach to effectively adapt program analyses to diverse clients. The approach has three key ingredients. First, it poses optimization problems that expose a large set of choices to adapt various aspects of an analysis, such as its cost, the accuracy of its result, and the assumptions it makes about missing information. Second, it solves those optimization problems by new search algorithms that efficiently navigate large search spaces, reason in the presence of noise, interact with users, and learn across programs. Third, it comprises a program analysis platform that facilitates users to specify and compose analyses, enables search algorithms to reason about analyses, and allows using large-scale computing resources to parallelize analyses.
