Control Flow Analysis Research Articles

Software Weakness Detection in Solidity Smart Contracts Using Control and Data Flow Analysis: A Novel Approach with Graph Neural Networks

Smart contracts on blockchain platforms are susceptible to security issues that can lead to significant financial losses. This study converts the Solidity code into abstract syntax trees and generates control flow graphs and data flow graphs. These graphs train a graph convolutional network model to detect security weaknesses. The proposed system outperforms traditional tools, achieving higher accuracy, recall, precision, and F1 scores when detecting weaknesses such as integer overflow/underflow, reentrancy, delegate call to the untrusted callee, and time-based issues. This study demonstrates that leveraging control and data flow analysis with graph neural networks significantly enhances smart contract security and provides a robust and reliable solution.

CFIEE: An Open-Source Critical Metadata Extraction Tool for RISC-V Hardware-Based CFI Schemes

Control flow critical metadata play a key role in hardware-based control flow integrity (CFI) mechanisms that effectively monitor and secure program control flow based on pre-extracted metadata. The existing control flow analysis tools exhibit some deficiencies, including inadequate compatibility with the RISC-V architecture, a steep learning curve, limited automation capabilities, and restricted data output formats. CFIEE is an open-source tool with a graphical interface for the automated extraction of control flow critical metadata. The tool possesses the capability to analyze RISC-V binary executables, transforming the binary into an intermediate representation (IR) in the form of the disassembled code, and extracting the critical metadata required for studying hardware-based CFI mechanism through a designed control flow transfer relationship analysis algorithm. The extracted metadata include program basic blocks and their corresponding hash values, control flow graphs, function call relationships, distribution of forward transfer instructions, etc. We selected 15 embedded system programs with processor adaptation for functional verification. The results demonstrate the CFIEE’s capability to automatically analyze programs within the supported RISC-V instruction set and generate comprehensive and precise metadata files. This tool can significantly enhance the efficiency of control flow metadata extraction and furnish configurable metadata for the hardware-based security mechanisms.

An Inclusive Report on Robust Malware Detection and Analysis for Cross-Version Binary Code Optimizations

Numerous practices exist for binary code similarity detection (BCSD), such as Control Flow Graph, Semantics Scrutiny, Code Obfuscation, Malware Detection and Analysis, vulnerability search, etc. On the basis of professional knowledge, existing solutions often compare particular syntactic aspects retrieved from binary code. They either have substantial performance overheads or have inaccurate detection. Furthermore, there aren't many tools available for comparing cross-version binaries, which may differ not only in programming with proper syntax but also marginally in semantics. This Binary code similarity detection is existing for past 10 years, but this research area is not yet systematically analysed. The paper presents a comprehensive analysis on existing Cross-version Binary Code Optimization techniques on four characteristics: 1. Structural analysis, 2. Semantic Analysis, 3. Syntactic Analysis, 4. Validation Metrics. It helps the researchers to best select the suitable tool for their necessary implementation on binary code analysis. Furthermore, this paper presents scope of the area along with future directions of the research.

A buffer overflow detection and defense method based on RISC-V instruction set extension

Buffer overflow poses a serious threat to the memory security of modern operating systems. It overwrites the contents of other memory areas by breaking through the buffer capacity limit, destroys the system execution environment, and provides implementation space for various system attacks such as program control flow hijacking. That makes it a wide range of harms. A variety of security technologies have been proposed to deal with system security problems including buffer overflow. For example, No eXecute (NX for short) is a memory management technology commonly used in Harvard architecture. It can refuse the execution of code which residing in a specific memory, and can effectively suppress the abnormal impact of buffer overflow on control flow. Therefore, in recent years, it has also been used in the field of system security, deriving a series of solutions based on NX technology, such as ExecShield, DEP, StackGuard, etc. However, these security solutions often rely too much on the processor architecture so that the protection coverage is insufficient and the accuracy is limited. Especially in the emerging system architecture field represented by RISC-V, there is still a lack of effective solutions for buffer overflow vulnerabilities. With the continuous rapid development of the system architecture, it is urgent to develop defense methods that are applicable to different system application environments and oriented to all executable memory spaces to meet the needs of system security development. Therefore, we propose BOP, A new system memory security design method based on RISC-V extended instructions, to build a RISC-V buffer overflow detection and defense system and deal with the buffer overflow threat in RISC-V. According to this method, NX technology can be combined with program control flow analysis, and NX bit mechanism can be used to manage the executability of memory space, so as to achieve a more granular detection and defense of buffer overflow attacks that may occur in RISC-V system environment. In addition, The memory management and control function of BOP is not only very suitable for solving the security problems in the existing single architecture system, but also widely applicable to the combination of multiple heterogeneous systems.Graphical abstract

A bytecode‐based integrated detection and repair method for reentrancy vulnerabilities in smart contracts

AbstractThe reentrancy vulnerability in smart contracts has caused significant losses in the digital currency economy. Existing solutions for detecting and repairing this vulnerability are limited in scope and lack a comprehensive framework. Additionally, there is currently a lack of guidance methods for effectively pinpointing the location of vulnerabilities. The proposed bytecode‐level method addresses these challenges by incorporating a detection module, an auxiliary localization module, and a repair module. An opcode classification method is introduced using vulnerability features and a BiLSTM‐Attention‐based sequence model to enhance detection accuracy. To overcome difficulties in vulnerability localization, an auxiliary localization method based on data flow and control flow analysis is proposed, enabling developers to better locate vulnerabilities. Current reentrancy vulnerability repair methods are analyzed and strategies for three reachable patterns are proposed. The bytecode rewriting strategy utilizes Trampoline technology for repair, while a fuel optimization method reduces bytecode generation length to optimize gas costs. Through extensive experimental validation, the effectiveness and superiority of the proposed methods are confirmed, further validating the feasibility of the entire framework. Experimental results demonstrate that the framework offers enhanced protection against reentrancy vulnerability attacks in smart contracts.

Passive Flow Control of Ahmed Body using Control Rod

In the current study, numerical analysis of passive control flow with a control rod for Ahmed body is performed at different slant angles and velocities and placed rod locations on the slant surface. The aim of the study is to improve aerodynamic performance by preventing flow separation on the slant surface of Ahmed body using a control rod. This passive flow control method uses a control rod that has not been applied for simplified ground vehicles before. Therefore, it can be said that this study is a new example in point of a passive flow control application for Ahmed body. The solution of the study is performed by using the Computational Fluid Dynamics (CFD) method. The solutions are firstly performed for baseline geometry, and the results are compared with experimental data reported in the literature for validation. CFD solutions are carried out by means of the ANSYS and RNG k- turbulence model is used to simulate flow-field since it captures the effect of turbulent flow. The solutions used a control rod with a 20 mm diameter performed at a dimensionless location (X/L=0.057 and 0.153) for Ahmed body. The results are presented visually in the figures, and drag coefficient values are also given in Table format. It is concluded that the rod application is useful for some specified slant angles and velocities since flow separation delays and suppresses the slant surface. The maximum drag reduction is achieved at about 6.153% at a slant angle of 35° and 20 m/s velocity of air, and location of control rod of 0.057, while the minimum drag reduction is about 1.048% at slant angle of 25° and velocity of air at 40 m/s and location of control rod of 0.153.

Compilation of dynamic sparse tensor algebra

Many applications, from social network graph analytics to control flow analysis, compute on sparse data that evolves over the course of program execution. Such data can be represented as dynamic sparse tensors and efficiently stored in formats (data layouts) that utilize pointer-based data structures like block linked lists, binary search trees, B-trees, and C-trees among others. These specialized formats support fast in-place modification and are thus better suited than traditional, array-based data structures like CSR for storing dynamic sparse tensors. However, different dynamic sparse tensor formats have distinct benefits and drawbacks, and performing different computations on tensors that are stored in different formats can require vastly dissimilar code that are not straightforward to correctly implement and optimize. This paper shows how a compiler can generate efficient code to compute tensor algebra operations on dynamic sparse tensors that may be stored in a wide range of disparate formats. We propose a language for precisely specifying recursive, pointer-based data structures, and we show how this language can express many different dynamic data structures, including all the ones named above as well as many more. We then describe how, given high-level specifications of such dynamic data structures, a compiler can emit code to efficiently access and compute on dynamic sparse tensors that are stored in the aforementioned data structures. We evaluate our technique and find it generates efficient dynamic sparse tensor algebra kernels that have performance comparable to, if not better than, state-of-the-art libraries and frameworks such as PAM, Aspen, STINGER, and Terrace. At the same time, our technique supports a wider range of tensor algebra operations---such as those that simultaneously compute with static and dynamic sparse tensors---than Aspen, STINGER, and Terrace, while also achieving significantly better performance than PAM for those same operations.

Wave-based in-plane vibration analysis of multiple coupled beam structures with arbitrary connection angle and elastic boundary restraints

Beam structures are widely used in various engineering branches, and the investigation on their dynamic behavior is of fundamental significance for the efficient design and vibration control of complex beam structures. In this work, a unified wave-based model for the in-plane vibration analysis of multiple coupled beams with arbitrary connection angle and boundary conditions is established, in which the vibrations within structures are described as wave propagation along structural elements, accompanying with wave reflection and transmission at some particular positions (such as the boundaries or structural joints). The reflection and transmission matrices corresponding to the incident waves propagating to the angular joint from various directions and the wave reflection matrix at the elastic boundary are derived. The natural and forced in-plane vibrations of multiple coupled beams can be analyzed concisely and systematically by assembling these wave reflection and transmission matrices. The accuracy of this approach is validated by comparing the dynamic characteristics obtained by the current approach with finite element method. Then, the influences of boundary stiffnesses and joint angle on wave reflection and transmission matrices are investigated. The results show that it is possible to know which wave type is dominant in structure at a certain frequency or angle, which shows certain significance for future work of vibration control and power flow analysis. The unified analysis model established in this paper can not only analyze the vibration characteristics of complex coupled beams but also reveal how waves are reflected and transmitted in the structure.

Runtime Complexity Bounds Using Squeezers

Determining upper bounds on the time complexity of a program is a fundamental problem with a variety of applications, such as performance debugging, resource certification, and compile-time optimizations. Automated techniques for cost analysis excel at bounding the resource complexity of programs that use integer values and linear arithmetic. Unfortunately, they fall short when the complexity depends more intricately on the evolution of data during execution. In such cases, state-of-the-art analyzers have shown to produce loose bounds, or even no bound at all. We propose a novel technique that generalizes the common notion of recurrence relations based on ranking functions. Existing methods usually unfold one loop iteration and examine the resulting arithmetic relations between variables. These relations assist in establishing a recurrence that bounds the number of loop iterations. We propose a different approach, where we derive recurrences by comparing whole traces with whole traces of a lower rank, avoiding the need to analyze the complexity of intermediate states. We offer a set of global properties, defined with respect to whole traces, that facilitate such a comparison and show that these properties can be checked efficiently using a handful of local conditions. To this end, we adapt state squeezers , an induction mechanism previously used for verifying safety properties. We demonstrate that this technique encompasses the reasoning power of bounded unfolding, and more. We present some seemingly innocuous, yet intricate, examples that previous tools based on cost relations and control flow analysis fail to solve, and that our squeezer-powered approach succeeds.

Performance evaluation of complex multi-thread applications through execution path analysis

The sporadic latency problems of multi-threaded applications remain a major concern for developers. A performance issue may be caused by internal factors such as an error in the code, inadequate database design or external factors such as thread imbalances, resource contention or system overload. In complex applications such as the Chromium browser, which is our focus in this paper, being able to collect precise unified information from several layers of the application or system is the first challenge. There exists a built-in tracer for Chromium, however, it provides a limited view of the application execution. The correlated analysis of the data collected from the multiple execution levels of the application is another challenge. In this paper, after explaining our tracing method for collecting data from the application and the operating system kernel simultaneously, we translate the multi-level tracing data into a unified model. We then use this model to perform kernel-level control flow analysis for user-level browser actions, to detect latency issues and identify their main causes. We show the effectiveness of the proposed method by detecting three Chromium performance bugs and finding their root-causes. Although our use-cases are based on the Chromium browser, the proposed method and lessons learned could be adapted for analysis of other complex multi-threaded applications.

An improving approach to analyzing change impact of C programs

A seemingly small change in the software can usually have a big impact. Impact analysis is an assessment of multiple risks associated with the changes. Research over the past 20 years has shown that impact analysis can decrease the time and effort needed in the development and regression testing and reduce the negative effects of change on other parts of the software system. These researches used program slicing, control flow analysis, call graph to analyze intraprocedural and interprocedural impact. However, most of them only analyze the methods affected by changes of simple variables or statements, which have coarse granularity and can provide limited help. To solve these problems, we propose an improving approach that can analyze the finer granularity change impact of multiple types of variables. This approach first breaks code changes into a combination of basic operations on variables and adopts corresponding analysis mechanisms for different types of variables. The code is preprocessed before analysis to gather essential information such as global variables table, function summaries, and pointer information map. In the intraprocedural analysis, we first divide the variables into two types: definition point and use point. For the use point, a data flow graph is used to analyze its change impact. For the definition point, we first find the paths where it is and analyze the variables on these paths that are controlled by it. In addition, to deal with the change impact of complex variables in the C programs, we have proposed a corresponding analysis procedure and algorithm. In interprocedural analysis, the impacted methods are searched according to their relationship and the global variable information table. A prototype system is developed based on our approach. In our evaluation, we demonstrate that the prototype system can be used to support various software development and maintenance tasks.

Software engineering techniques for statically analyzing mobile apps: research trends, characteristics, and potential for industrial adoption

Mobile platforms are rapidly and continuously changing, with support for new sensors, APIs, and programming abstractions. Static analysis is gaining a growing interest, allowing developers to predict properties about the run-time behavior of mobile apps without executing them. Over the years, literally hundreds of static analysis techniques have been proposed, ranging from structural and control-flow analysis to state-based analysis.In this paper, we present a systematic mapping study aimed at identifying, evaluating and classifying characteristics, trends and potential for industrial adoption of existing research in static analysis of mobile apps. Starting from over 12,000 potentially relevant studies, we applied a rigorous selection procedure resulting in 261 primary studies along a time span of 9 years. We analyzed each primary study according to a rigorously-defined classification framework. The results of this study give a solid foundation for assessing existing and future approaches for static analysis of mobile apps, especially in terms of their industrial adoptability.Researchers and practitioners can use the results of this study to (i) identify existing research/technical gaps to target, (ii) understand how approaches developed in academia can be successfully transferred to industry, and (iii) better position their (past and future) approaches for static analysis of mobile apps.

Modelling and analysing IoT systems

The Internet of Things is deeply shaping our society and our lives. Smart devices automatically collect, aggregate and exchange data on our behalf and free us from the drudgery of doing it. These data are often crucial because critical decisions, such as controlling cyber-physical systems, are made depending on them or because they feed learning algorithms. Safety and security issues related to devices and to data can have a major impact on smart systems and can have serious consequences if they oversee essential services, such as delivering power, water, transport, and so on. For this reason, it is crucial to identify the most critical components in a network of devices and to evaluate how they are vulnerable to accidental or to intentional failures. We propose to use the process calculus IoT-LySa to model systems and to apply a Control Flow Analysis to statically predict the manipulation of data, as well as on which data the critical decisions depend, in particular those affecting actuations. By exploiting suitable metrics, we can use the results of the analysis so as to provide system administrators with estimates of the safety and security of their systems.

Context-Sensitive Data Race Detection for Concurrent Programs

Data races have become one of the severe issues affecting the correctness of concurrent programs. Existing detection tools for data races have many false positives and false negatives. To improve the correctness, this paper proposes a context-sensitive approach to detect data races in concurrent programs. Several program analysis techniques are conducted to reduce false positives and false negatives. First, control-flow analysis is used to construct call graphs, in which escape analysis is employed to find escaped objects among threads. Second, context-sensitive alias analysis is employed to find alias objects. Finally, happens-before analysis is conducted to reduce false positives and false negatives. We develop a prototype tool ConRacer based on WALA and evaluate it on several benchmarks. We also compare ConRacer with existing static and dynamic tools. The experimental results show that ConRacer can effectively detect data races and reduce false positives and false negatives.

An Algorithm-Centric Approach to Enhance Business Process Compliance Management

The diversity of enterprise domains is one of the significant factors that add to the challenges confronting organizations when managing compliance, and it, therefore, contributes to the cost of compliance. In particular, there is an indication that the inadequacy of a general approach to analyzing compliance documents impedes adequate compliance management practice. Taking an algorithmic-centric approach to tackling this challenge, this paper proposed algorithms and techniques intended to aid useful extraction, classification and analysis of dataflow, control flow, and time constraints in compliance management domain for different stakeholders. The algorithms and techniques were implemented and validated through two case studies and afterward evaluated for its adoption in practice.

ANOVUL: Detection of logic vulnerabilities in annotated programs via data and control flow analysis

Logic vulnerabilities are largely dependent on the expected functions of web applications. Their appearance depends on both application logic and related security policy which may change based on modifications in business requirements. Accordingly, there are no specific and common patterns for logic vulnerabilities moreover, a security policy is required for their detection. In this study, a vulnerability detection method is proposed to detect logic vulnerabilities via analysing the program source code. Security checks enforce some constraints in the application so that the application behaves according to the logic intended by the programmer. The main goal is to find the vulnerabilities caused by bypassing some security checks. In this method, known as annotation-based vulnerability detection approach (ANOVUL), control and data flows are analysed to detect the application logic vulnerabilities. To analyse the flows of the program, access control and authenticity labelling are used. To evaluate ANOVUL, the authors have collected a data set. This comprises of PHP applications with reported logic vulnerabilities that have common vulnerabilities and exposures (CVE) identifiers. Based on the results, a 73% detection rate was achieved in the data set. The proposed method can detect logic vulnerabilities that are not detectable using conventional methods.

BBB-CFI

Code-reuse attack is a concrete threat to computing systems because it can evade conventional security defenses. Control flow integrity (CFI) is proposed to repel this threat. However, former implementations of CFI suffer from two major drawbacks: complex offline processing on programs and high overheads at runtime. Therefore, it is impractical for performance-constrained devices to adopt the technology, leaving them vulnerable to exploitation. In this article, we develop a cross-layer approach named basic-block-boundary-based control flow integrity (BBB-CFI) to minimize the overheads of both offline analysis and runtime checking. Our approach employs basic block information inside the binary code and read-only data to enforce CFI. We identify a key binary-level property called basic block boundary , and based on it we propose the code-inspired method where short code sequences can endorse a control flow transition. Our solution enables quick application launching because it does not require control flow graph construction at the offline stage. We only demand a lightweight analysis on read-only data and a small amount of code of the application. According to the experiments, our approach incurs a negligible 0.11% runtime performance overhead with a minor processor extension, whereas it achieves an order of magnitude speedup in pre-preprocessing compared to a baseline approach. Without control flow analysis or recompilation, BBB-CFI still effectively reduces 90% of the attack surface in terms of gadget numbers. Besides this, we show that the Turing-completeness in the libc is unsustainable. Our approach also demonstrates high applicability to many programs, and it is capable of protecting striped binaries.

A consistency-guaranteed approach for Internet of Things software refactoring

The software architecture of Internet of Things defines the component model and interconnection topology of Internet of Things systems. Refactoring is a systematic practice of improving a software structure without altering its external behaviors. When the Internet of Things software is refactored, it is necessary to detect the correctness of Internet of Things software to ensure its security. To this end, this article proposes a novel refactoring correction detection approach to ensure software security. Control flow analysis and data flow analysis are used to detect code changes before and after refactoring, and synchronization dependency analysis is used to detect changes in synchronization dependency. Three detection algorithms are designed to detect refactoring correctness. Four real-world benchmark applications are used to evaluate our approach. The experimental results show that our proposed approach can ensure correctness of Internet of Things software refactoring.

OS-Aware Interaction Model for the Verification of Multitasking Embedded Software

As the behavior of multitasking embedded software is dependent on the underlying operating system(s), rigorous and efficient verification in this domain requires models of operating systems (OS) that enable OS-aware verification of application programs at reduced cost. However, the heterogeneity of the languages used for OS models and of the program source code makes it difficult to compose these seemingly independent components and thus requires translation of one language into another, causing various issues in verification. To alleviate this problem, we propose a hybrid approach that composes formal OS models with application programs in an interaction model. Based on typical OS-application interaction behavior, our interaction model is a composition framework that connects an OS model to application programs as long as they share the same Application Program Interface (API). It provides seamless composition of two heterogeneous software artifacts by formulating source code annotations based on control-flow analysis and by synchronizing state transitions over API function calls to regulate the context switching of multitasking programs. A prototype implementation of the interaction model was applied to eight benchmark programs of the Erika OS and a control program with real-scale complexity from the automotive domain. It was shown that the framework supports systematic and effective verification of multitasking embedded software, which has not been possible using code-level model checking.

The Design of Exploratory Application and Preprocessing of Event Log Data in LMS Moodle-Based Online Learning Activities for Process Mining

Process Mining is one of the sub-studies of Data Mining that focuses on the events of a system. An area that benefits from process mining is education, especially online learning. This study used Moodle as a platform to provide online event activity log data in online learning. Moodle-based process mining requires several stages that are not easily understood directly by teachers. As a solution, some efforts are needed to integrate Moodle with process mining. This study built an application that could contribute to the Preprocessing and Exploratory Data Analysis (EDA) stages of Moodle event log data – as an important part of the process mining stage. Preprocessing was implemented by using the simple heuristic filtering method, while EDA was employed through visualization using flow control and dotted charts. Eventually, the application built in this study successfully performed preprocessing in Moodle event log data and could display the results visually, as a tool of control flow analysis and dotted chart analysis.