Control Flow Analysis Research Articles

Flow-sensitive type recovery in linear-log time

The flexibility of dynamically typed languages such as JavaScript, Python, Ruby, and Scheme comes at the cost of run-time type checks. Some of these checks can be eliminated via control-flow analysis. However, traditional control-flow analysis (CFA) is not ideal for this task as it ignores flow-sensitive information that can be gained from dynamic type predicates, such as JavaScript's 'instanceof' and Scheme's 'pair?', and from type-restricted operators, such as Scheme's 'car'. Yet, adding flow-sensitivity to a traditional CFA worsens the already significant compile-time cost of traditional CFA. This makes it unsuitable for use in just-in-time compilers. In response, we have developed a fast, flow-sensitive type-recovery algorithm based on the linear-time, flow-insensitive sub-0CFA. The algorithm has been implemented as an experimental optimization for the commercial Chez Scheme compiler, where it has proven to be effective, justifying the elimination of about 60% of run-time type checks in a large set of benchmarks. The algorithm processes on average over 100,000 lines of code per second and scales well asymptotically, running in only O(n log n) time. We achieve this compile-time performance and scalability through a novel combination of data structures and algorithms.

Predicting global usages of resources endowed with local policies

The effective usages of computational resources are a primary concern of up-to-date distributed applications. In this paper, we present a methodology to reason about resource usages (acquisition, release, revision, ...), and therefore the proposed approach enables to predict bad usages of resources. Keeping in mind the interplay between local and global information occurring in the application-resource interactions, we model resources as entities with local policies and global properties governing the overall interactions. Formally, our model takes the shape of an extension of pi-calculus with primitives to manage resources. We develop a Control Flow Analysis computing a static approximation of process behaviour and therefore of the resource usages.

Logical approximation for program analysis

The abstract interpretation of programs relates the exact semantics of a programming language to a finite approximation of those semantics. In this article, we describe an approach to abstract interpretation that is based in logic and logic programming.Our approach consists of faithfully representing a transition system within logic and then manipulating this initial specification to create a logical approximation of the original specification. The objective is to derive a logical approximation that can be interpreted as a terminating forward-chaining logic program; this ensures that the approximation is finite and that, furthermore, an appropriate logic programming interpreter can implement the derived approximation.We are particularly interested in the specification of the operational semantics of programming languages in ordered logic, a technique we call substructural operational semantics (SSOS). We show that manifestly sound control flow and alias analyses can be derived as logical approximations of the substructural operational semantics of relevant languages.

Analysis on demand: Instantaneous soundness checking of industrial business process models

We report on a case study on control-flow analysis of business process models. We checked 735 industrial business process models from financial services, telecommunications, and other domains. We investigated these models for soundness (absence of deadlock and lack of synchronization) using three different approaches: the business process verification tool Woflan, the Petri net model checker LoLA, and a recently developed technique based on SESE decomposition. We evaluate the various techniques used by these approaches in terms of their ability of accelerating the check. Our results show that industrial business process models can be checked in a few milliseconds, which enables tight integration of modeling with control-flow analysis. We also briefly compare the diagnostic information delivered by the different approaches and report some first insights from industrial applications.

EigenCFA

We describe, implement and benchmark EigenCFA, an algorithm for accelerating higher-order control-flow analysis (specifically, 0CFA) with a GPU. Ultimately, our program transformations, reductions and optimizations achieve a factor of 72 speedup over an optimized CPU implementation. We began our investigation with the view that GPUs accelerate high-arithmetic, data-parallel computations with a poor tolerance for branching. Taking that perspective to its limit, we reduced Shivers's abstract-interpretive 0CFA to an algorithm synthesized from linear-algebra operations. Central to this reduction were "abstract" Church encodings, and encodings of the syntax tree and abstract domains as vectors and matrices. A straightforward (dense-matrix) implementation of EigenCFA performed slower than a fast CPU implementation. Ultimately, sparse-matrix data structures and operations turned out to be the critical accelerants. Because control-flow graphs are sparse in practice (up to 96% empty), our control-flow matrices are also sparse, giving the sparse matrix operations an overwhelming space and speed advantage. We also achieved speedups by carefully permitting data races. The monotonicity of 0CFA makes it sound to perform analysis operations in parallel, possibly using stale or even partially-updated data.

철도시스템 소프트웨어 테스트 커버리지 자동화 도구 및 기준 분석

최근 컴퓨터시스템으로 전환되고 있는 철도시스템에서 소프트웨어에의 의존성이 급격히 증가함에 따라 임베디드화된 철도시스템 소프트웨어 신뢰성과 안전성의 검증이 중요한 문제로 대두되기 시작했다. 이에 따라 철도 소프트웨어 관련 국제표준에서도 각종 소프트웨어 테스트 및 검증활동을 요구하고 있으며, 이에 대응하여 본 논문에서는 철도시스템 소프트웨어 테스트 커버리지 자동화 도구 및 기준 분석과 개발 결과에 대해 제시하고 있다. 본 논문에서는 철도시스템 소프트웨어 안전성 검증을 위한 정량적인 항목으로 매우 중요한 테스트 커버리지를 자동으로 측정할 수 있는 제어흐름 분석도구를 개발하였으며, 본 도구의 결과를 실제 철도 산업 현장에서 활용하기 위해 타분야 제시기준 등을 분석하여 철도 소프트웨어 안전무결성레벨(SWSIL)에 따른 판단 기준을 제시하였다. 개발한 도구는 기존 해외 도구에 비해서 여러 테스트 커버리지를 효과적으로 측정할 수 있는 강점이 있으며, 실제 철도 현장에서 활용성이 높아 철도 소프트웨어의 개발 및 테스트 기술 발전을 기대할 수 있다. 【Recent advances in computer technology have brought more dependence on software to railway systems and changed to computer systems. Hence, the reliability and safety assurance of the vital software running on the embedded railway system is going to tend toward very critical task. Accordingly, various software test and validation activities are highly recommended in the international standards related railway software. In this paper, we presented an automated analysis tool and standard for software testing coverage in railway system, and presented its result of implementation. We developed the control flow analysis tool estimating test coverage as an important quantitative item for software safety verification in railway software. Also, we proposed judgement standards due to railway S/W Safety Integrity Level(SWSIL) based on analysis of standards in any other field for utilizing developed tool widely at real railway industrial sites. This tool has more advantage of effective measuring various test coverages than other countries, so we can expect railway S/W development and testing technology of real railway industrial sites in Korea.】

Detection Of Control Flow Errors In Parallel Programs At Compile Time

This paper describes a general technique to identify control flow errors in parallel programs, which can be automated into a compiler. The compiler builds a system of linear equations that describes the global control flow of the whole program. Solving these equations using standard techniques of linear algebra can locate a wide range of control flow bugs at compile time. This paper also describes an implementation of this control flow analysis technique in a prototype compiler for a well-known parallel programming language. In contrast to previous research in automated parallel program analysis, our technique is efficient for large programs, and does not limit the range of language features.

Non-repudiation analysis using L yS a with annotations

This work introduces a formal analysis of the non-repudiation property for security protocols. Protocols are modelled in the process calculus L yS a, using an extended syntax with annotations. Non-repudiation is verified using a Control Flow Analysis, following the same approach of Buchholtz and Gao for authentication and freshness analyses. The result is an analysis that can statically check the protocols to predict if they are secure during their execution and which can be fully automated.

Detecting and preventing type flaws at static time*

A type flaw attack on a security protocol is an attack where an honest principal is cheated on interpreting a field in a message as the one with a type other than the intended one. In this paper, we shall present an extension of the LYSA calculus to cope with types, by using tags to represent the i ntended types of terms. We develop a Control Flow Analysis for this calculus which soundly over-approximates all the possible behaviour of a protocol and, in particular, is able to capture any type confusion that may occur during the protocol execution. The analysis acts in a descriptive way: it describes which violations may occur. In the same setting, our approach also offers a prescriptive usage: we can impose a type discipline, by forcing some data to be of the expected types. At this point, the analysis may statically check that type violations are not possible any longer. In other words, we instrument the code with the only checks necessary to enforce type security. Finally, we apply our framework to a multi-protocol setting, where the risk of having type flaw attacks is higher. Our analysis has been implemented and successfully applied to a number of security protocols, showing it is able to capture type flaw attacks. The implementation complexity of the analysis is low polynomial.

Hybrid logical analyses of the ambient calculus

In this paper, hybrid logic is used to formulate three control flow analyses for Mobile Ambients, a process calculus designed for modelling mobility. We show that hybrid logic is very well-suited to express the semantic structure of the ambient calculus and how features of hybrid logic can be exploited to reduce the “administrative overhead” of the analysis specification and thus simplify it. Finally, we use HyLoTab, a fully automated theorem prover for hybrid logic, both as a convenient platform for a prototype implementation as well as to formally prove the correctness of the analysis.

Control-flow analysis of function calls and returns by abstract interpretation

We derive a control-flow analysis that approximates the interprocedural control-flow of both function calls and returns in the presence of first-class functions and tail-call optimization. In addition to an abstract environment, our analysis computes for each expression an abstract control stack, effectively approximating where function calls return across optimized tail calls. The analysis is systematically calculated by abstract interpretation of the stack-based CaEK abstract machine of Flanagan et al. using a series of Galois connections. Abstract interpretation provides a unifying setting in which we 1) prove the analysis equivalent to the composition of a continuation-passing style (CPS) transformation followed by an abstract interpretation of a stack-less CPS machine, and 2) extract an equivalent constraint-based formulation, thereby providing a rational reconstruction of a constraint-based control-flow analysis from abstract interpretation principles.

Control Flow Analysis for Brane Calculi

We introduce a Control Flow Analysis for Brane Calculi. This verification technique allows properties regarding the behaviour of biological systems to be checked. This is an approximate technique that focusses on the static specification of a system, rather than on its dynamics, striving for effectiveness. Examples illustrate the approach.

A Control Flow Analysis for Beta-binders with and without static compartments

We introduce a Control Flow Analysis, that statically approximates the dynamic behaviour of processes, expressed in the Beta-binders calculus and in an extended version of the calculus modelling static compartments. Our analysis of a system is able to describe the essential behaviour of each box, tracking all the possible bindings of variables, all the possible intra- and inter-boxes communications, and, finally, all the possible movements across compartments. The analysis offers a basis for establishing static checks of biological dynamic properties. We apply our analysis to an abstract specification of the interaction between a virus and cells of the immune system and to a model of the c A M P -signaling Pathway in Olfactory Sensory Neurons.

Deciding k CFA is complete for EXPTIME

We give an exact characterization of the computational complexity of the k CFA hierarchy. For any k > 0, we prove that the control flow decision problem is complete for deterministic exponential time. This theorem validates empirical observations that such control flow analysis is intractable. It also provides more general insight into the complexity of abstract interpretation.

CTOC에서 루프 트리 구성하기

최근 많이 사용되고 있는 자바 바이트코드의 분석과 최적화를 효율적으로 수행하기 위해 CTOC 프레임워크가 구현되었다. CTOC에서는 바이트코드에 대해 분석과 최적화를 수행하기 위해 가장 먼저 eCFG를 생성하였다. 분석하기 어렵다는 바이트코드의 특성 때문에 기존의 바이트 코드를 제어 흐름 분석에 적합하게 확장하여 제어 흐름 그래프를 작성하였다. 이를 확장된 제어 흐름 그래프인 eCFG라 부른다. 또한 정적으로 분석하기 위해 eCFG를 SSA Form으로 변환 하였다. 변환 시 많은 프로그램에서 루프가 발견되었다. 이전 CTOC에서는 루프에 대한 처리를 수행하지 않은 상태에서 직접 SSA Form으로 변환을 수행하였다. 하지만 SSA Form으로 변환하기 이전에 루프에 대한 부분을 처리하면 더욱 효율적인 SSA Form을 생성할 수 있게 된다. 본 논문은 루프에 대한 처리를 효율적으로 하기 위해 eCFG를 SSA Form으로 변환하는 과정 이전에 루프를 발견하고 이와 관련된 루프 트리를 생성하는 과정을 보인다. The CTOC framework was implemented to efficiently perform analysis and optimization of the Java bytecode that is often being used lately. In order to analyze and optimize the bytecode from the CTOC, the eCFG was first generated. Due to the bytecode characteristics of difficult analysis, the existing bytecode was expanded to be suitable for control flow analysis, and the control flow graph was drawn. We called eCFG(extended Control Flow Graph). Furthermore, the eCFG was converted into the SSA Form for a static analysis. Many loops were found in the conversion program. The previous CTOC performed conversion directly into the SSA Form without processing the loops. However, processing the loops prior to the SSA Form conversion allows more efficient generation of the SSA Form. This paper examines the process of finding the loops prior to converting the eCFG into the SSA Form in order to efficiently process the loops, and exhibits the procedures for generating the loop tree.

Using sequencing to trigger a better analysis

We improve the static analysis of control flow in programs running on embedded microcontrollers. Our new techniques, called sequencing and triggering analysis, can sometimes determine that the scheduler always runs a collection of tasks in a certain order or that some interrupt handlers are dead or at least cannot fire at certain times. Triggering identifies root causes of indirect control flow through system idioms and programmer annotations. Sequencing propagates the results of triggers through system execution in order to refine our estimate of the program control flow graph. We show that triggering and sequencing improve the effectiveness of static analyses of sensor network applications. Improved static analyses result in better optimizations, increased verification power, and more accurate worst-case-execution time estimations.

A Static Analysis for Beta-Binders

We introduce a Control Flow Analysis, that statically approximates the dynamic behaviour of processes, expressed in the Beta-Binders calculus. Our analysis of a system is able to describe the essential behaviour of each box, tracking all the possible bindings of variables and all the possible intra- e inter-boxes communications. The analysis offers a basis for establishing static checks of biological dynamic properties. We finally apply our analysis to an example, based on an abstract specification of the interaction between a virus and cells of the immune system.

Control-Flow Analysis of Functional Programs

We present a survey of control-flow analysis of functional programs, which has been the subject of extensive investigation throughout the past 25 years. Analyses of the control flow of functional programs have been formulated in multiple settings and have led to many different approximations, starting with the seminal works of Jones, Shivers, and Sestoft. In this paper we survey control-flow analysis of functional programs by structuring the multitude of formulations and approximations and comparing them.

Information flow security in Boundary Ambients

A variant of the Mobile Ambient calculus, called Boundary Ambients, is introduced, supporting the modelling of multi-level security policies. Ambients that may guarantee to properly protect their content are explicitly identified as boundaries: a boundary can be seen as a resource access manager for confidential data. In this setting, absence of direct information leakage is granted as soon as the initial process satisfies some syntactic conditions. We then give a new notion of non-interference for Boundary Ambients aiming at capturing indirect flows, too. We design a Control Flow Analysis that computes an over-approximation of all ambients that may be affected at run-time by high-level data and we show that this static analysis can be used to enforce non-interference, i.e., to statically detect that no (direct or indirect) information leakage is ever possible at run-time.

Detecting and Preventing Type flaws: a Control Flow Analysis with Tags

A type flaw attack on a security protocol is an attack where an honest principal is cheated on interpreting a field in a message as the one with a type other than the intended one. In this paper, we shall present an extension of the LySa calculus with tags attached to each field, indicating the intended types. We developed a control flow analysis for analysing the extended LySa, which over-approximates all the possible behaviour of a protocol and hence is able to capture any type confusion that may happen during the protocol execution. The control flow analysis has been applied to a number of security protocols, either subject to type flaw attacks or not. The results show that it is able to capture type flaw attacks on those security protocols.