Control Flow Analysis Research Articles

Control-flow analysis of dynamic languages via pointer analysis

We demonstrate how to map a control-flow analysis for a higher-order language (dynamic languages are typically higher-order) into a pointer analysis for a first-order language, such as C. This allows us to use existing pointer analysis tools to perform a control-flow analysis, exploiting their technical advancements and the engineering effort that went into developing them. We compare the results of two recent parallel pointer analysis tools with a parallel control-flow analysis tool. While it has been known that a control-flow analysis of higher-order languages and a pointer analysis of first-order languages are very similar, we demonstrate that these two analyses are actually more similar than previously thought. We present the first mapping between a high-order control-flow analysis and a pointer analysis.

Cross-Kernel Control-Flow--Graph Analysis for Event-Driven Real-Time Systems

Embedded real-time control systems generally have a dedicated purpose and fixed set of functionalities. This manifests in a large amount of implicit and explicit static knowledge, available already at compile time. Modern compilers can extract and exploit this information to perform extensive whole-program analyses and interprocedural optimizations. However, these analyses typically end at the application--kernel boundary, thus control-flow transitions between different threads are not covered, yet. This restriction stems from the pessimistic assumption of a probabilistic scheduling policy of the underlying operating system, impeding detailed predictions of the overall system behavior. Real-time operating systems, however, do provide deterministic and exactly specified scheduling decisions, as embedded control systems rely on a timely and precise behavior. In this paper, we present an approach that incorporates the RTOS semantics into the control-flow analysis, to cross the application--kernel boundary. By combining operating system semantics, the static system configuration and the application logic, we determine a cross-kernel control-flow--graph, that provides a global view on all possible execution paths of a real-time system. Having this knowledge at hand, enables us to tailor the operating system kernel more closely to the particular application scenario. On the example of a real-world safety-critical control system, we present two possible use cases: Run-time optimizations, by means of specialized system calls for each call site, allow to speed up the kernel execution path by 33 percent in our benchmark scenario. An automated generation of OS state assertions on the expected system behavior, targeting transient hardware fault tolerance, leverages significant robustness improvements.

Research on Detecting Design Pattern Variants from Source Code Based on Constraints

Identifying design patterns from source code is one of the most promising methods for improving software maintainability, reusing experience and facilitating software refactoring In the process of design pattern application, different methods of instantiation usually lead to generation of pattern variants. The detection of these variants from source code is a key point and a challenge of reverse engineering. In this paper, we propose an approach of detecting design pattern variants from source code based on constraints. More specifically, we first propose the method to describe the design pattern variants based on constraints, input the constraint conditions of design patterns into the library of pattern features, conduct static analysis on source code including analysis of control flow and data flow to obtain representations of pattern participants in the source code, conduct matching with the predicate matching tool, and then merge the instances by clustering analysis and obtain the final collection of pattern instances. Finally, a tool of extracting design pattern variants from source code is implemented and the feasibility of our approach is verified through the results of running it on three open source software.

Screening smartphone applications using malware family signatures

The sharp increase in smartphone malware has become one of the most serious security problems. Since the Android platform has taken the dominant position in smartphone popularity, the number of Android malware has grown correspondingly and represents critical threat to the smartphone users. This rise in malware is primarily attributable to the occurrence of variants of existing malware. A set of variants stem from one malware can be considered as one malware family, and malware families cover more than half of the Android malware population. A conventional technique for defeating malware is the use of signature matching which is efficient from a time perspective but not very practical because of its lack of robustness against the malware variants. As a counter approach for handling the issue of variants behavior analysis techniques have been proposed but require extensive time and resources. In this paper, we propose an Android malware detection mechanism that uses automated family signature extraction and family signature matching. Key concept of the mechanism is to extract a set of family representative binary patterns from evaluated family members as a signature and to classify each set of variants into a malware family via an estimation of similarity to the signatures. The proposed family signature and detection mechanism offers more flexible variant detection than does the legacy signature matching, which is strictly dependent on the presence of a specific string. Furthermore, compared with the previous behavior analysis techniques considering family detection, the proposed family signature has higher detection accuracy without the need for the significant overhead of data and control flow analysis. Using the proposed signature, we can detect new variants of known malware efficiently and accurately by static matching. We evaluated our mechanism with 5846 real world Android malware samples belonging to 48 families collected in April 2014 at an anti-virus company; experimental results showed that; our mechanism achieved greater than 97% accuracy in detection of variants. We also demonstrated that the mechanism has a linear time complexity with the number of target applications.

A NOVEL METHODOLOGY FOR TEST SCENARIO GENERATION BASED ON CONTROL FLOW ANALYSIS OF UML 2.X SEQUENCE DIAGRAMS

Now a days UML is widely used for preparing design documents. It helps to specify, construct, visualize and document artifacts of software systems. This paper presents an approach to test the software in the early stage (design phase) of software development life cycle, so that it can help the software testers in the later stages. This paper focuses on generating test scenarios from UML 2.x Sequence diagrams. The most challenging problem in generating test scenarios from UML 2.x sequence diagram is the presence of fragments such as alt, loop, break, par, opt etc. We propose an intermediate control flow graph in a testable form named Sequence Control Flow Graph (SCFG) resulting from the control flow analysis of UML 2.x sequence diagrams. We also propose a systematic approach named Sequence Test Scenario Generation Algorithm (STSGA) for generating test scenarios from UML 2.x Sequence diagrams. The test scenarios generated by our approach are suitable for detection of scenario faults, use case dependency and system testing.

The Perspective on Data and Control Flow Analysis in Topological Functioning Models by Petri Nets

Abstract The perspective on integration of two mathematical formalisms, i.e., Colored Petri Nets (CPNs) and Topological Functioning Model (TFM), is discussed in the paper. The roots of CPNs are in modeling system functionality. The TFM joins principles of system theory and algebraic topology, and formally bridges the solution domain with the problem domain. It is a base for further automated construction of software design models. The paper discusses a perspective on check of control and data flows in the TFM by CPNs formalism. The research result is definition of mappings from TFMs to CPNs.

Pushdown flow analysis with abstract garbage collection

AbstractIn the static analysis of functional programs, pushdown flow analysis and abstract garbage collection push the boundaries of what we can learn about programs statically. This work illuminates and poses solutions to theoretical and practical challenges that stand in the way of combining the power of these techniques. Pushdown flow analysis grants unbounded yet computable polyvariance to the analysis of return-flow in higher-order programs. Abstract garbage collection grants unbounded polyvariance to abstract addresses which become unreachable between invocations of the abstract contexts in which they were created. Pushdown analysis solves the problem of precisely analyzing recursion in higher-order languages; abstract garbage collection is essential in solving the “stickiness” problem. Alone, our benchmarks demonstrate that each method can reduce analysis times and boost precision by orders of magnitude. We combine these methods. The challenge in marrying these techniques is not subtle: computing the reachable control states of a pushdown system relies on limiting access during transition to the top of the stack; abstract garbage collection, on the other hand, needs full access to the entire stack to compute a root set, just as concrete collection does. Conditional pushdown systems were developed for just such a conundrum, but existing methods are ill-suited for the dynamic nature of garbage collection. We show fully precise and approximate solutions to the feasible paths problem for pushdown garbage-collecting control-flow analysis. Experiments reveal synergistic interplay between garbage collection and pushdown techniques, and the fusion demonstrates “better-than-both-worlds” precision.

Designing and Implementing Control Flow Graph for Magic 4th Generation Language

A good compiler which implements many optimizations during its compilation phases must be able to perform several static analysis techniques such as control flow or data flow analysis. Besides compilers, these techniques are common for static analyzers as well to retrieve information from source code, for example for code auditing, quality assurance or testing purposes. Implementing control flow analysis requires handling many special structures of the target language. In our paper we present our experiences in implementing control flow graph (CFG) construction for a special 4th generation language called Magic. While we were designing and implementing the CFG for this language, we identified dierences compared to 3rd generation languages mostly because of the unique programming technique of Magic (e.g. data access, parallel task execution, events). Our work was motivated by our industrial partner who needed precise static analysis tools (e.g. for quality assurance or testing purposes) for this language. We believe that our experiences for Magic, as a representative of 4GLs, might be generalized for other languages too.

Formalisation and analysis of Dalvik bytecode

With the large, and rapidly increasing, number of smartphones based on the Android platform, combined with the open nature of the platform that allows “apps” to be downloaded and executed on the smartphone, misbehaving and malicious (malware) apps are set to become a serious problem. To counter this problem, automated tools for analysing and verifying apps are essential. Furthermore, to ensure high-fidelity of such tools, it is essential to formally specify both semantics and analyses.In this paper we present, to the best of our knowledge, the first formalisation of the complete Dalvik bytecode language including reflection features and the first formally specified control flow analysis for the language, including advanced control flow features such as dynamic dispatch, exceptions, and reflection. To determine which features to include in the formalisation and analysis, 1700 Android apps from the Google Play app market (formerly known as Android Market) were downloaded and examined.

Combining and Relating Control Effects and their Semantics

Combining local exceptions and first class continuations leads to programs with complex control flow, as well as the possibility of expressing powerful constructs such as resumable exceptions. We describe and compare games models for a programming language which includes these features, as well as higher-order references. They are obtained by contrasting methodologies: by annotating sequences of moves with "control pointers" indicating where exceptions are thrown and caught, and by composing the exceptions and continuations monads. The former approach allows an explicit representation of control flow in games for exceptions, and hence a straightforward proof of definability (full abstraction) by factorization, as well as offering the possibility of a semantic approach to control flow analysis of exception-handling. However, establishing soundness of such a concrete and complex model is a non-trivial problem. It may be resolved by establishing a correspondence with the monad semantics, based on erasing explicit exception moves and replacing them with control pointers.

Discussig of Electricity Embedded Software Testing Technology

Focusing on the feature of embedded software in power industry and to ensure its high reliability, the authors of this article introduced a comprehensive and effective testing technique based on the theory and practice of embedded test, with two phases: static test and dynamic unit test. It focus on the coding rule checking, quality metrics, analysis, flow control and data flow analysis and coverage analysis techniques.

Control Flow Analysis of Automotive Software Components Using Model-Based Specifications of Dynamic Behavior

Control Flow Analysis of Automotive Software Components Using Model-Based Specifications of Dynamic Behavior

Practical Integrated Analysis of Pointers, Dataflow and Control Flow

This article presents a family of static analyses to determine pointer targets, control flow, and dataflow in combination. The integrated solution to these mutually dependent problems approaches the result from the optimistic side. It is a general strategy for static program analysis and does not need any upfront approximation for one of the problems to overcome the mutual dependencies. A degenerated case yields Andersen’s famous pointer analysis; otherwise, the analyses are flow-sensitive and can support direct and indirect strong updates, within the same cubic asymptotic complexity as known for Andersen, albeit with larger constants. Surprisingly, the ideas behind the integrated analysis are intuitive. The strategy we describe naturally evolves from considering the mutual dependencies between the three problems, or from generalizing Andersen’s analysis to flow sensitivity. Such a flow-sensitive Andersen analysis not only computes pointer targets with higher precision than the original analysis, but it also creates an interprocedural SSA form at the same time. Our extensive experimental evaluation shows that the integrated solution is practical as it can be applied to reasonably large real-world programs within a few seconds or minutes. This uses some optimizations which together achieve a speedup of more than 100 for several programs. We compare several members of the family of analyses, from flow- and field-insensitive to flow- and field-sensitive with strong updates, both with and without optimizations. This gives some insights into the effects of these dimensions of precision on the results. It also sheds new light on the benefits of flow sensitivity versus the costs associated with it.

Adaptive loop caching using lightweight runtime control flow analysis

Loop caches provide an effective method for decreasing memory hierarchy energy consumption by storing frequently executed code (critical regions) in a more energy efficient structure than the level one cache. However, due to code structure restrictions or costly design time pre-analysis efforts, previous loop cache designs are not suitable for all applications and system scenarios. We present an adaptive loop cache that is amenable to a wider range of system scenarios, which can provide an additional 20% average instruction cache energy savings (with individual benchmark energy savings as high as 69%) compared to the next best loop cache, the preloaded loop cache.

Control Flow Analysis of Generalised Boolean Networks

Generalised Boolean Networks are a well known qualitative model used to analyse the evolution of genetic networks as well as generic biological pathways. Despite the qualitative abstraction due to the few threshold concentration values considered for each biological element in the model, the complexity of the execution of a Generalised Boolean model could be non trivial. In this paper, we propose a tailored process algebra, called Sim-πn, reminiscent of the π-calculus to model GBNs. We further apply the Control Flow Analysis methodology to the resulting computational model for making static (and therefore less computationally expensive) predictions on the dynamical evolution of the investigated networks. The scope is twofold: helping in the setting up of the model, for checking its completeness, and checking the evolution of the model, in terms of the possibility to reach particular threshold values of the biological elements in the model, when varying the initial conditions.

Control-flow analysis of functional programs

We present a survey of control-flow analysis of functional programs, which has been the subject of extensive investigation throughout the past 30 years. Analyses of the control flow of functional programs have been formulated in multiple settings and have led to many different approximations, starting with the seminal works of Jones, Shivers, and Sestoft. In this article, we survey control-flow analysis of functional programs by structuring the multitude of formulations and approximations and comparing them.

Extensible intraprocedural flow analysis at the abstract syntax tree level

We have developed a new approach for implementing precise intraprocedural control-flow and dataflow analyses at the abstract syntax tree level. Our approach is declarative, making use of reference attribute grammars augmented with circular attributes and collection attributes. This results in concise executable specifications of the analyses, allowing extensions both to the language and with further source code analyses.To evaluate the new approach, we have implemented control flow, dataflow and dead assignment analyses for Java, by extending the JastAdd Extensible Java Compiler. We have compared our results to several well-known analysis frameworks and tools, using a set of Java programs as benchmarks. These results show that our approach performs well concerning both efficiency and preciseness.

Automatic test case selection for regression testing of composite service based on extensible BPEL flow graph

Services are highly reusable, flexible and loosely coupled components whose changes make the evolution and maintenance of composite services more complex. The changes of composite service mainly cover three types, i.e., the processes, bindings, and interfaces. In this article, an approach is proposed to select test cases for regression testing of different versions of BPEL (business process execution language) composite service where these changes are involved. The approach identifies the changes by performing control flow analysis and comparing the paths in a new version of composite service with those in the old one using a kind of eXtensible BPEL flow graph (XBFG). Message sequence is appended to XBFG path so that XBFG can fully describe the behavior of composite service. The binding and predicate constraint information added in different XBFG elements can be used for path selection and even for test case generation. Both theoretic analysis and case study show that the proposed approach is effective.

Control-flow analysis of function calls and returns by abstract interpretation

Abstract interpretation techniques are used to derive a control-flow analysis for a simple higher-order functional language. The analysis approximates the interprocedural control-flow of both function calls and returns in the presence of first-class functions and tail-call optimization. In addition to an abstract environment, the analysis computes for each expression an abstract call-stack, effectively approximating where function calls return. The analysis is systematically derived by abstract interpretation of the stack-based CaEK abstract machine of Flanagan et al. using a series of Galois connections. We prove that the analysis is equivalent to an analysis obtained by first transforming the program into continuation-passing style and then performing control flow analysis of the transformed program. We then show how the analysis induces an equivalent constraint-based formulation, thereby providing a rational reconstruction of a constraint-based CFA from abstract interpretation principles.

A symbolic analysis framework for static analysis of imperative programming languages

We present a generic symbolic analysis framework for imperative programming languages. Our framework is capable of computing all valid variable bindings of a program at given program points. This information is invaluable for domain-specific static program analyses such as memory leak detection, program parallelization, and the detection of superfluous bound checks, variable aliases and task deadlocks.We employ path expression algebra to model the control flow information of programs. A homomorphism maps path expressions into the symbolic domain. At the center of the symbolic domain is a compact algebraic structure called supercontext. A supercontext contains the complete control and data flow analysis information valid at a given program point.Our approach to compute supercontexts is based purely on algebra and is fully automated. This novel representation of program semantics closes the gap between program analysis and computer algebra systems, which makes supercontexts an ideal symbolic intermediate representation for all domain-specific static program analyses.Our approach is more general than existing methods because it can derive solutions for arbitrary (even intra-loop and nested loop) nodes of reducible and irreducible control flow graphs. We prove the correctness of our symbolic analysis method. Our experimental results show that the problem sizes arising from real-world applications such as the SPEC95 benchmark suite are tractable for our symbolic analysis framework.