Program Dependence Analysis Research Articles

Causal program dependence analysis

Discovering how program components affect one another plays a fundamental role in aiding engineers comprehend and maintain a software system. Despite the fact that the degree to which one program component depends upon another can vary in strength, traditional dependence analysis typically ignores such nuance. To account for this nuance in dependence-based analysis, we propose Causal Program Dependence Analysis (CPDA), a framework based on causal inference that captures the degree (or strength) of the dependence between program elements. For a given program, CPDA intervenes in the program execution to observe changes in value at selected points in the source code. It observes the association between program elements by constructing and executing modified versions of a program (requiring only light-weight parsing rather than sophisticated static analysis). CPDA applies causal inference to the observed changes to identify and estimate the strength of the dependence relations between program elements. We explore the advantages of CPDA's quantified dependence by presenting results for several applications. Our further qualitative evaluation demonstrates 1) that observing different levels of dependence facilitates grouping various functional aspects found in a program and 2) how focusing on the relative strength of the dependences for a particular program element provides a detailed context for that element. Furthermore, a case study that applies CPDA to debugging illustrates how it can improve engineer productivity.

IoT-based Cloud Service for Secured Android Markets using PDG-based Deep Learning Classification

Software piracy is an act of illegal stealing and distributing commercial software either for revenue or identify theft. Pirated applications on Android app stores are harming developers and their users by clone scammers. The scammers usually generate pirated versions of the same applications and publish them in different open-source app stores. There is no centralized system between these app stores to prevent scammers from publishing pirated applications. As most of the app stores are hosted on cloud storage, therefore a cloud-based interaction system can prevent scammers from publishing pirated applications. In this paper, we proposed IoT-based cloud architecture for clone detection using program dependency analysis. First, the newly submitted APK and possible original files are selected from app stores. The APK Extractor and JDEX decompiler extract APK and DEX files for Java source code analysis. The dependency graphs of Java files are generated to extract a set of weighted features. The Stacked-Long Short-Term Memory (S-LSTM) deep learning model is designed to predict possible clones. Experimental results have shown that the proposed approach can achieve an average accuracy of 95.48% among clones from different application stores.

BDA: practical dependence analysis for binary executables by unbiased whole-program path sampling and per-path abstract interpretation

Binary program dependence analysis determines dependence between instructions and hence is important for many applications that have to deal with executables without any symbol information. A key challenge is to identify if multiple memory read/write instructions access the same memory location. The state-of-the-art solution is the value set analysis (VSA) that uses abstract interpretation to determine the set of addresses that are possibly accessed by memory instructions. However, VSA is conservative and hence leads to a large number of bogus dependences and then substantial false positives in downstream analyses such as malware behavior analysis. Furthermore, existing public VSA implementations have difficulty scaling to complex binaries. In this paper, we propose a new binary dependence analysis called BDA enabled by a randomized abstract interpretation technique. It features a novel whole program path sampling algorithm that is not biased by path length, and a per-path abstract interpretation avoiding precision loss caused by merging paths in traditional analyses. It also provides probabilistic guarantees. Our evaluation on SPECINT2000 programs shows that it can handle complex binaries such as gcc whereas VSA implementations from the-state-of-art platforms have difficulty producing results for many SPEC binaries. In addition, the dependences reported by BDA are 75 and 6 times smaller than Alto, a scalable binary dependence analysis tool, and VSA, respectively, with only 0.19% of true dependences observed during dynamic execution missed (by BDA). Applying BDA to call graph generation and malware analysis shows that BDA substantially supersedes the commercial tool IDA in recovering indirect call targets and outperforms a state-of-the-art malware analysis tool Cuckoo by disclosing 3 times more hidden payloads.

Scalable Mutation Testing Using Predictive Analysis of Deep Learning Model

Software testing plays a crucial role in ensuring the quality of software systems. Mutation testing is designed to measure the adequacy of test suites by detecting artificially induced software faults. Despite their potential, the expensive cost and the scalability of mutation testing with large programs is a big obstacle in its practical use. The selective mutation has been widely investigated and considered to be an effective approach to reduce the cost of mutation testing. In the case of large programs where source code has hundreds of classes and more than 10 KLOC lines of code, the selective mutation can still generate thousands of mutants. Executing each mutant against the test suite is cost-intensive in terms of robustness, resource usage, and computational cost. In this paper, we introduce a new approach to extract features from mutant programs based on mutant killing conditions, i.e. reachability, necessity and sufficiency along with mutant significance and test suite metrics to extract features from mutant programs. A deep learning Keras model is proposed to predict killed and alive mutants from each program. First, the features are extracted using the Eclipse JDT library and program dependency analysis. Second, preprocessing techniques such as Principal Component Analysis and Synthetic Minority Oversampling are used to reduce the high dimensionality of data and to overcome the imbalanced class problem respectively. Lastly, the deep learning model is optimized using fine-tune parameters such as dropout and dense layers, activation function, error and loss rate respectively. The proposed work is analyzed on five opensource programs from GitHub repository consisting of thousands of classes and LOC. The experimental results are appreciable in terms of effectiveness and scalable mutation testing with a slight loss of accuracy.

A New Definition-Use Net Generator for Ada 2012 Programs

Definition-Use Net (DUN) is a graph-theoretical concurrent program representation that is very useful in software development activities such as program dependence analysis, testing, debugging, and complexity measuring. It is an arc-classified digraph having vertices representing information about definitions and/or uses of the values of variables, and inter-process synchronization and communication, and arcs representing deterministic or nondeterministic control ows between vertices. For capturing Definition-Use Nets for Ada 2012 programs, we developed an Asis-based DUN generator for Ada 2012 programs. This article presents an informal explanation for DUNs of Ada 2012 programs and shows some example DUNs of Ada 2012 programs generated by our DUN generator

크로스커팅 개념을 이용한 시스템 최적화 기법

시스템 최적화는 소스코드의 변경 없이 중복된 모듈을 추출하고, 추출된 모듈의 재사용을 위하여 프로그램의 구조를 변경하는 기법이다. 구조지향 개발과 객체지향 개발은 크로스커팅 영역의 모듈화에는 효율적이나 크로스커팅 개념을 모듈화 할 수 없다. 기존 시스템에서 크로스커팅 개념을 적용하기 위해, 각 시스템 내에 분산되어 있는 시스템 최적화 대상 모듈을 크로스커팅 영역으로 추출하는 기술이 필요하다. 본 논문에서는 개발이 완료된 시스템에서 중복 모듈을 추출하기 위한 방법을 제안한다. 제안하는 방법은 소스코드 분석을 통해 데이터 의존관계와 제어 의존관계를 분석하여 중복되는 요소를 추출한다. 추출된 중복된 요소는 시스템 최적화를 위하여 프로그램 의존 관계 분석에 사용될 수 있다. 중복된 의존관계 분석 결과는 제어 흐름 그래프로 변환되며, 이를 활용하여 최소 크로스커팅 모듈을 생성할 수 있다. 의존 관계 분석을 통해 추출된 요소는 크로스커팅 영역 모듈로 설정함으로써 시스템 내 중복된 코드를 최소화 할 수 있는 시스템 최적화 방법을 제시한다. The system optimization is a technique that changes the structure of the program in order to extract the duplicated modules without changing the source code, reuse of the extracted module. Structure-oriented development and object-oriented development are efficient at crosscutting concern modular, however can't be modular of crosscutting concept. To apply the crosscutting concept in an existing system, there is a need to a extracting technique for distributed system optimization module within the system. This paper proposes a method for extracting the redundant modules in the completed system. The proposed method extracts elements that overlap over a source code analysis to analyze the data dependency and control dependency. The extracted redundant element is used to program dependency analysis for the system optimization. Duplicated dependency analysis result is converted into a control flow graph, it is possible to produce a minimum crosscutting module. The element extracted by dependency analysis proposes a system optimization method which minimizes the duplicated code within system by setting the crosscutting concern module.

Method-level program dependence abstraction and its application to impact analysis

We develop a new program abstraction that directly models dependencies among methods.We assess the accuracy of the new abstraction model for forward dependence analysis.The proposed approach achieves much greater cost-effectiveness than peer options.The new dependence abstraction improves both static and dynamic impact analysis.The new abstraction is much more cost-effective than traditional model at method level. The traditional software dependence (TSD) model based on the system dependence graph enables precise fine-grained program dependence analysis that supports a range of software analysis and testing tasks. However, this model often faces scalability challenges that hinder its applications as it can be unnecessarily expensive, especially for client analyses where coarser results suffice.This paper revisits the static-execute-after (SEA), the most recent TSD abstraction approach, for its accuracy in approximating method-level forward dependencies relative to the TSD model. It also presents an alternative approach called the method dependence graph (MDG), compares its accuracy against the SEA, and explores applications of the dependence abstraction in the context of dependence-based impact analysis.Unlike the SEA approach which roughly approximates dependencies via method-level control flows only, the MDG incorporates more fine-grained analyses of control and data dependencies to avoid being overly conservative. Meanwhile, the MDG avoids being overly expensive by ignoring context sensitivity in transitive interprocedural dependence computation and flow sensitivity in computing data dependencies induced by heap objects.Our empirical studies revealed that (1) the MDG can approximate the TSD model safely, for method-level forward dependence at least, at much lower cost yet with low loss of precision, (2) for the same purpose, while both are safe and more efficient than the TSD model, the MDG can achieve higher precision than the SEA with better efficiency, both significantly, and (3) as example applications, the MDG can greatly enhance the cost-effectiveness of both static and dynamic impact analysis techniques that are based on program dependence analysis.More generally, as a program dependence representation, the MDG provides a viable solution to many challenges that can be reduced to balancing cost and effectiveness faced by dependence-based tasks other than impact analysis.

Analysis of Object-Oriented Programs with Exception-Handling Constructs

In the dependence analysis of object-oriented programs, if the influence of exception propagation on the dependency is not considered, the information will be inaccurate. At present, the existing methods with exception propagation mostly aimed at intra-class analysis, which cannot meet the needs of actual software development. This paper proposes an approach to analyzing inter-class control dependence of programs with exception-handling constructs. The approach takes account of constructors and destructors, which makes the analysis more accurate. The approach is carried on by constructing inter-class control flow graph. According to the relationships of different classes, such as inheritance, aggregation and association, we incrementally construct an inter-class control flow graph. Finally, we apply the analysis method to C++ program slicing. The experiment results show that our approach is more accurate and can bring about the improvement of the slice accuracy through analyzing the influence of exception-handling constructs.

Automatic test data generation using genetic algorithm and program dependence graphs

The complexity of software systems has been increasing dramatically in the past decade, and software testing as a labor-intensive component is becoming more and more expensive. Testing costs often account for up to 50% of the total expense of software development; hence any techniques leading to the automatic generation of test data will have great potential to considerably reduce costs. Existing approaches of automatic test data generation have achieved some success by using evolutionary computation algorithms, but they are unable to deal with Boolean variables or enumerated types and they need to be improved in many other aspects. This paper presents a new approach utilizing program dependence analysis techniques and genetic algorithms (GAs) to generate test data. A set of experiments using the new approach is reported to show its effectiveness and efficiency based upon established criterion.

Precise interprocedural dependence analysis of parallel programs

It is known that interprocedural detection of copy constants and elimination of faint code in parallel programs are undecidable problems, if base statements are assumed to execute atomically. We show that these problems become decidable, if this assumption is abandoned. So, the (unrealistic) idealization from program verification “atomic execution of base statements” introduced in order to simplify matters, actually increases the difficulty of these problems from the point of view of program analysis: amazingly these problems become more tractable if we adopt a less idealized, more realistic model of execution. We introduce an effective abstract domain of antichains of dependence traces that allows us to perform a precise interprocedural dependence analysis in (non-atomically executing) parallel programs. The main idea is to trace sequences of dependences exhibited successively by program executions. We define operations on antichains of dependence traces and show that they precisely abstract the corresponding operations on sets of non-atomic program executions. Using these operations, we can analyze dependences by means of an abstract interpretation of constraint systems that characterize sets of program executions of interest. The result of the dependence analysis can in turn be used to detect all copy constants and to eliminate faint code. While the run-time of the algorithms is exponential in the number of program variables, it is polynomial in the program size. Hence, they are polynomial-time algorithms if the number of program variables is bounded. In order to justify their overall exponential run-time, we show that both detection of copy constants and elimination of faint code are intractable (NP-hard) even when the atomic execution idealization is abandoned. This holds already for parallel programs without loops or procedures.

An overview of methods for dependence analysis of concurrent programs

Program dependence analysis is an analysis technique to identify and determine various program dependencies in source codes, which has been widely used in program understanding, debugging, testing, reverse engineering, and maintenance. However, there are still many difficulties to be solved when carrying out dependence analysis for concurrent programs because the execution of statements is unpredictable. This survey describes methods and research directions for dependence analysis of concurrent programs, especially about how to obtain the dependencies between concurrently executed statements, the factors leading to intransitivity among dependencies, and how to deal with the intransitivity problem. By careful comparisons, users can select a proper algorithm for their requirements.

Generating test data for distributed software using the chaining approach

Software testing is very labour-intensive and expensive, and accounts for a significant proportion of software system development cost. If the testing process could be automated, the cost of developing software could be significantly reduced. Currently, most of the existing test data generators are for sequential programs. One of the major problems in dynamic testing of distributed software is reproducible program execution. Distributed programs often make non-deterministic selections of communications events, e.g. the select statement in Ada. Thus, a test case for the distributed program is defined as a set of input data plus a sequence of events that is used to resolve any non-deterministic choices that are possible during program execution. In this paper, we present a chaining approach for automated software test data generation for distributed software. This approach builds on current theory of existing execution-oriented test data generation. The goal is to find program input and a rendezvous sequence on which the selected statement is executed. The chaining approach uses program dependency analysis to identify statements that affect the execution of the selected statement. These statements are then used to guide the test data generation process. The experiments have shown that the chaining approach may significantly improve the chances of generating test data as compared to the existing methods.

Integer programming for array subscript analysis

We present a new method to determine whether a convex region contains any integer points. The method is designed for array subscript analysis in parallel programs. The general problem is whether a system of linear equalities and inequalities has an integer solution. A set of known techniques is used to transform the problem to that of finding whether a convex region contains any integer points. The main result of the paper is a set of new search procedures that identify an integer solution in a convex region, or prove that no integer solutions exist. They are based on the geometrical properties of convex regions that are not empty, but also do not contain any integer points. The results contribute to exact and efficient dependence and synchronization analysis of parallel programs. >

Developing and integrating ProDAG in the Arcadia environment

ProDAG is an analysis toolset that provides an application programmatic interface for program dependence analysis. Program dependences are syntactic relationships between program statements. The ProDAG interface provides a uniform set of operations for creating and accessing several pre-defined dependence relations, which are represented as graphs, as well as a standard mechanism for developing new dependence graphs. ProDAG is one analysis toolset in Arcadia, ProDAG was developed in the Arcadia environment and has been integrated with the language processing, oject management, and process definition components of the Arcadia architecture, and further integration with the user interface development system and the measurement and evaluation components are underway. This paper describes the design, implementation and integration of proDAG within Arcadia.

Detection of and-parallelism in logic programs

In this paper, we present a detection technique of and-parallelism in logic programs. The detection consists of three phases: analysis of entry modes, derivation of exit modes and determination of execution graph expressions. Compared with other techniques[2, 4, 5], our approach, with the compile- time program- level data- dependence analysis of logic programs, can efficiently exploit and- parallelism in logic programs. Two precompilers, based on our technique and DeGroot’s approach[3] respectively, have been implemented in SES- PIM system[12]. Through compiling and running some typical benchmarks in SES- PIM, we conclude that our technique can, in most cases, exploit as much and- parallelism as the dynamic approach[13] does under “producer- consumer” scheme, and needs less dynamic overhead while exploiting more and-parallelism than DeGroot’s approach does.

The interprocedural analysis and automatic parallelization of Scheme programs

Lisp and its descendants are among the most important and widely used of programming languages. At the same time, parallelism in the architecture of computer systems is becoming commonplace. There is a pressing need to extend the technology of automatic parallelization that has become available to Fortran programmers of parallel machines, to the realm of Lisp programs and symbolic computing. In this thesis we present a comprehensive approach to the compilation of Scheme programs for shared-memory multiprocessors. Our strategy has two principal components: interprocedural analysis and program restructuring. We introduce procedure strings and stack configurations as a framework in which to reason about interprocedural side-effects and object lifetimes, and develop a system of interprocedural analysis, using abstract interpretation, that is used in the dependence analysis and memory management of Scheme programs. We introduce the transformations of exit-loop translation and recursion splitting to treat the control structures of iteration and recursion that arise commonly in Scheme programs. We propose an alternative representation for s-expressions that facilitates the parallel creation and access of lists. We have implemented these ideas in a parallelizing Scheme compiler and run-time system, and we complement the theory of our work with "snapshots" of programs during the restructuring process, and some preliminary performance results of the execution of object codes produced by the compiler.