GFTrans: an on-the-fly static analysis framework for code performance profiling

Static analysis frameworks (SAFs) such as Soot and WALA have been a fundamental support in today’s software analysis. They usually adopt various analysis techniques to transform programs into different representations which imply specific properties, e.g., call graph can demonstrate the calling relationships between methods in a program, and users rely on these program representations for further analysis like vulnerability detection and privacy leakage recognition. Hence, providing proper program representation is essential for SAFs. We conducted a systematic empirical study on program representation faults of static analysis frameworks. In our study, we first collect 141 issues from four popular SAFs and summarize their root causes, symptoms, and fix strategies, and reveal nine findings and some implications to avoid and detect program representation faults. Additionally, we implemented an automated testing framework named SAScope based on the metamorphic and differential testing motivated by findings and implications. Overall, SAScope can detect 19 program representation faults where 6 of them have been confirmed or fixed, demonstrating its effectiveness.

Space-efficient data structures for sparse matrices typically yield programs in which not all data dependencies can be determined at compile time. Automatic parallelization of such codes is usually done at run time, e.g. by applying the inspector-executor technique, incurring tremendous overhead. - Program comprehension techniques have been shown to improve automatic parallelization of dense matrix computations. We investigate how this approach can be generalized to sparse matrix codes. We propose a speculative program comprehension and parallelization method. Placement of parallelized run-time tests is supported by a static data flow analysis framework.

The results described in this paper is motivated by the desire to study the interface between the structure of control flow and data dependencies. The complexity of the control flow and the complexity of the data dependencies are necessarily intertwined. An increase in the complexity of the data dependencies will result from an increase in control flow complexity. A control flow alternation construct can result in an increase in the number of variable definitions that may be referenced. This increase in the number of referable definitions may extend far beyond the range of the alternation construct.In order to study the interface between control structure and data dependencies, a general abstraction describing the static structure of software is developed. The abstraction proposed in this paper is called Generalized Program Graph (GPG) and is a synthesis of the control flow graph and data dependency graph. Various sources of data dependencies in a program and live definitions of variables are discussed. An algorithm for constructing a GPG from a given source program in imperative languages is included. Some results of the analysis of the GPG structures and the interface between control and data dependency complexity are also presented. It appears that the GPG can directly be applied in the studies of software module interconnection complexity. Other important theoretical and practical application of the GPG are discussed. Because the GPG includes both the control flow and data dependency information in one abstraction, it can be used as an implementation model for the development of measurement and analysis tools for empirical research.

Mobile applications (apps) have long invaded the realm of desktop apps, and hybrid apps become a promising solution for supporting multiple mobile platforms. Providing both platform-specific functionalities via native code like native apps and user interactions via JavaScript code like web apps, hybrid apps help developers build multiple apps for different platforms without much duplicated efforts. However, most hybrid apps are developed in multiple programming languages with different semantics, which may be vulnerable to programmer errors. Moreover, because untrusted JavaScript code may access device-specific features via native code, hybrid apps may be vulnerable to various security attacks. Unfortunately, no existing tools can help hybrid app developers by detecting errors or security holes. In this paper, we present HybriDroid, the first static analysis framework for Android hybrid apps. We investigate the semantics of Android hybrid apps especially for the interoperation mechanism of Android Java and JavaScript. Then, we design and implement a static analysis framework that analyzes inter-communication between Android Java and JavaScript. As example analyses supported by HybriDroid, we implement a bug detector that identifies programmer errors due to the hybrid semantics, and a taint analyzer that finds information leaks cross language boundaries. Our empirical evaluation shows that the tools are practically usable in that they found previously uncovered bugs in real-world Android hybrid apps and possible information leaks via a widely-used advertising platform.

Matlab is an extremely popular programming language used by scientists, engineers, researchers and students world-wide. Despite its popularity, it has received very little attention from compiler researchers. This paper introduces McSaf, an open-source static analysis framework which is intended to enable more compiler research for Matlab and extensions of Matlab. The framework is based on an intermediate representation (IR) called McLast, which has been designed to capture all the key features of Matlab, while at the same time being simple for program analysis. The paper describes both the IR and the procedure for creating the IR from the higher-level AST. The analysis framework itself provides visitor-based traversals including fixed-point-based traversals to support both forwards and backwards analyses. McSaf has been implemented as part of the McLab project, and the framework has already been used for a variety of analyses, both for Matlab and the AspectMatlab extension.KeywordsAnalysis FrameworkAssignment StatementNode TypeIntermediate RepresentationClass HierarchyThese keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.

The Android operating system is currently the most popular mobile operating system in the world. Android is based on Linux and therefore inherits its features including its Inter-Process Communication (IPC) mechanisms. These mechanisms are used by processes to communicate with one another and are extensively used in Android. While Android-specific IPC mechanisms have been studied extensively, Unix domain sockets have not been examined comprehensively, despite playing a crucial role in the IPC of highly privileged system daemons. In this paper, we propose Sausage, an efficient novel static analysis framework to study the security properties of these sockets. Sausage considers access control policies implemented in the Android security model, as well as authentication checks implemented by the daemon binaries. It is a fully static analysis framework, specifically designed to analyze Unix domain socket usage in Android system daemons, at scale. We use this framework to analyze 200 Android images across eight popular smartphone vendors spanning Android versions 7–9. As a result, we uncover multiple access control misconfigurations and insecure authentication checks. Our notable findings include a permission bypass in highly privileged Qualcomm system daemons and an unprotected socket that allows an untrusted app to set the scheduling priority of other processes running on the system, despite the implementation of mandatory SELinux policies. Ultimately, the results of our analysis are worrisome; all vendors except the Android Open Source Project (AOSP) have access control issues, allowing an untrusted app to communicate to highly privileged daemons through Unix domain sockets introduced by hardware manufacturer or vendor customization.

In static analysis frameworks for Java, the bytecode frontend serves as a critical component, transforming complex, stack-based Java bytecode into a more analyzable register-based, typed 3-address code representation. This transformation often significantly influences the overall performance of analysis frameworks, particularly when processing large-scale Java applications, rendering the efficiency of the bytecode frontend paramount for static analysis. However, the bytecode frontends of currently dominant Java static analysis frameworks, Soot and WALA, despite being time-tested and widely adopted, exhibit limitations in efficiency, hindering their ability to offer a better user experience. To tackle efficiency issues, we introduce a new bytecode frontend. Typically, bytecode frontends consist of two key stages: (1) translating Java bytecode to untyped 3-address code, and (2) performing type inference on this code. For 3-address code translation, we identified common patterns in bytecode that enable more efficient processing than traditional methods. For type inference, we found that traditional algorithms often include redundant computations that hinder performance. Leveraging these insights, we propose two novel approaches: pattern-aware 3-address code translation and pruning-based type inference , which together form our new frontend and lead to significant efficiency improvements. Besides, our approach can also generate SSA IR, enhancing its usability for various static analysis techniques. We implemented our new bytecode frontend in Tai-e, a recent state-of-the-art static analysis framework for Java, and evaluated its performance across a diverse set of Java applications. Experimental results demonstrate that our frontend significantly outperforms Soot, WALA, and SootUp (an overhaul of Soot)—in terms of efficiency, being on average 14.2×, 14.5×, and 75.2× faster than Soot, WALA, and SootUp, respectively. Moreover, additional experiments reveal that our frontend exhibits superior reliability in processing Java bytecode compared to these tools, thus providing a more robust foundation for Java static analysis.

As technology advances, microprocessors that integrate multiple cores on a single chip are becoming increasingly common. How to use these processors to improve the performance of a single program has been a challenge. For general-purpose applications, it is especially difficult to create efficient parallel execution due to the complex control flow and ambiguous data dependences. Thread-level speculation and transactional memory provide two hardware mechanisms that are able to optimistically parallelize potentially dependent threads. However, a compiler that performs detailed performance trade-off analysis is essential for generating efficient parallel programs for these hardwares. This compiler must be able to take into consideration the cost of intra-thread as well as inter-thread value communication. On the other hand, the ubiquitous existence of complex, input-dependent control flow and data dependence patterns in general-purpose applications makes it impossible to have one technique optimize all program patterns. In this paper, we propose three optimization techniques to improve the thread performance: (i) scheduling instruction and generating recovery code to reduce the critical forwarding path introduced by synchronizing memory resident values; (ii) identifying reduction variables and transforming the code the minimize the serializing execution; and (iii) dynamically merging consecutive iterations of a loop to avoid stalls due to unbalanced workload. Detailed evaluation of the proposed mechanism shows that each optimization technique improves a subset but none improve all of the SPEC2000 benchmarks. On average, the proposed optimizations improve the performance by 7% for the set of the SPEC2000 benchmarks that have already been optimized for register-resident value communication.

The cross-cultural affective analysis is a key field of natural language processing. Traditional methods are constrained to single cultural contexts and static analysis frameworks, and struggle to capture the expressive diversity and dynamic contextual dependence arising from cultural differences. This paper proposes a hybrid neural network model based on Transformer-LSTM to automatically classify positive, negative, and neutral emotions by fusing multilingual text data with cultural background information. The model uses Transformer's self-attention mechanism to analyze the global semantic association between emotion words and cultural expressions, combines LSTM's temporal modeling ability to capture emotion evolution rules in text sequences, and optimizes feature interaction through encoder-decoder collaboration mechanism. Experiments based on the Sentiment140 dataset containing 1.5 million multilingual texts show that the accuracy of the model in neutral emotion classification reaches 91.6% (3.2% higher than the baseline model), the negative emotion F1 value increases to 0.872, and the AUC-ROC curve shows significant robustness across cultural scenarios. The research provides data-driven intelligent analytics solutions for intercultural communication and affective computing.

As source code dependencies are usually stored in some precompiled executable representation like bytecode, static analysis frameworks for high-level languages have to be specifically adapted so they can meaningfully analyse these libraries too. This adaptation is not trivial, since compilation is in general not injective, the semantics of low-level instruction sets are often not specified adequately, and the structure of the high-level sources and the low-level target is considerably different. This is also true for the functional Erlang programming language and its assembly-like BEAM bytecode. In this paper, we present a structuring algorithm capable of recovering the Erlang syntax tree of functional branching expressions compiled to BEAM. The implementation of the presented algorithm is part of the RefactorErl static analyser framework. Therefore, the tool is able to represent the semantics of the BEAM programs with an Erlang syntax tree and perform further semantic analysis on it to discover the source dependencies.

Android Operating System becomes a major target for malicious attacks. Static analysis approach is widely used to detect malicious applications. Most of existing studies on static analysis frameworks are limited to certain features. This paper presents an Android Static Analysis Framework (ASAF) which models the overall static analysis phases and approaches for Android applications. ASAF can be implemented for different purposes including Android malicious apps detection. The proposed framework utilizes a parsing tool, Android Static Parse (ASParse) which is also introduced in this paper. Through the extendibility of the ASParse tool, future research studies can easily extend the parsed features and the parsed files to perform parsing based on their specific requirements and goals. Moreover, a case study is conducted to illustrate the implementation of the proposed ASAF.

Static analysis of JavaScript programs to detect errors in them is a challenging task. Especially when the program imports massive JavaScript libraries such as jQuery and MooTools, analyzing the whole program and the libraries is expensive and extremely declines the analysis efficiency. In this paper, we introduce a novel approach to solve the problem by modularizing the analysis. We separate the analysis of JavaScript libraries by using types extracted from their corresponding specifications in TypeScript and the analysis of JavaScript applications by a static analysis framework. We use DefinitelyTyped, an open-source repository that provides TypeScript declaration files of over 300 popular JavaScript libraries, and we extend SAFE, an open-source analysis framework for JavaScript.

The development of a high-quality data-flow analysis---one that is precise and scalable---is a challenging task. A concrete client analysis not only requires data-flow but, in addition, type-hierarchy, points-to, and call-graph information, all of which need to be obtained by wisely chosen and correctly parameterized algorithms. Therefore, many static analysis frameworks have been developed that provide analysis writers with generic data-flow solvers as well as those additional pieces of information. Such frameworks ease the development of an analysis by requiring only a description of the data-flow problem to be solved and a set of framework parameters. Yet, analysis writers often struggle when an analysis does not behave as expected on real-world code. It is usually not apparent what causes a failure due to the complex interplay of the several algorithms and the client analysis code within such frameworks. In this work, we present some of the insights we gained by instrumenting the LLVM-based static analysis framework PhASAR for C/C++ code and show the broad area of applications at which flexible instrumentation supports analysis and framework developers. We present five cases in which instrumentation gave us valuable insights to debug and improve both, the concrete analyses and the underlying PhASAR framework.

When interacting with Android apps, users may not always get what they expect. For instance, when clicking on a button labeled "upload picture", the app may actually leak the user's location while uploading photos to a cloud service. In this paper we present BACKSTAGE, a static analysis framework that binds UI elements to their corresponding callbacks, and further extracts actions in the form of Android sensitive API calls that may be triggered by events on such UI elements. We illustrate the inner workings of the analysis implemented by BACKSTAGE and then compare it against similar frameworks.

The lack of customizable Android static analysis tools has caused analysts to devote a large chunk of the company resources on developing custom tools that become irrelevant once the project is complete. Lack of sufficiently maintained documentation for the available static analysis frameworks has further added fuel to the fire. With more and more malwares being released into the Android market, there is an urgent need for a an extensible static analysis framework that can be utilized to develop tools on the fly without reinventing the wheel and thus saving a lot of time and money. The proposed solution attempts to fill that void.