Dynamic Program Analysis Research Articles

The α-generalized implicit method associated with Potra–Pták iteration for solving non-linear dynamic problems

Generally, direct time integration procedures are used for solving the equations of motion in transient analysis of structures with large displacements. In this context, we propose an algorithm that combines the α-Generalized implicit integration method with the Potra–Pták two-step iterative scheme. The free Scilab program develops a computer code for the non-linear dynamic analysis of plane frames with large displacements and rotations. The FEM corotational formulation discretizes the structures considering the Euler-Bernoulli beam theory. The null-length connection element described by the axial, translational and rotational stiffnesses simulate the behavior of the beam-column connection. Jacobi’s method and the Scilab’s spec function determine the natural frequencies. The developed program is used for modal and transient dynamic analyses of frame problems available in the literature. The numerical results show that the Potra-Pták scheme obtains approximate solutions with fewer cumulative iterations until convergence and shorter processing time compared to the standard Newton-Raphson scheme. Further-more, the results show that the type of beam-column connection affects the vibratory behavior of the structure as well as the values of its natural frequencies.

Безопасный конвейер доставки программного обеспечения

The presence of vulnerabilities in software is a pressing problem. Vulnerabilities can serve as a basis for breach of confidentiality and information leakage. The purpose of this study is to increase the level of software security at all stages of the life cycle from development and implementation to operation. Achieving this goal is possible through automated analysis of program code and increasing the types of vulnerabilities detected. The work proposes a secure software delivery pipeline that allows for static and dynamic analysis of program code, analysis of the search for vulnerabilities in third-party components and Docker images. The article reviewed popular software tools, their distinctive features, and provided justification for the choice of software solutions that form the basis of the developed secure delivery pipeline. The novelty of the work is the ability of the pipeline to automatically detect vulnerabilities at all stages of the software life cycle, from planning and design to testing, deployment and monitoring in a production environment, which allows you to eliminate vulnerabilities at an early stage, thereby increasing the level of software security. Conducted testing and approbation of a secure software delivery pipeline. Based on the assessment results, the developed secure software delivery pipeline showed that on average 98% of vulnerabilities were identified using the Semgrep tool, 90% of vulnerabilities using the OWASP ZAP tool, 96% of vulnerabilities using the Dependency-Track tool, and 88% using the Trivy tool. The results of the study and experimental data showed that on average, as a result of testing, the accuracy of detecting vulnerabilities is 93%. The practical value of the work lies in the fact that the developed secure software delivery pipeline can be used as a tool for detecting program code vulnerabilities by software development specialists, as well as information security specialists of IT companies. The results obtained can be used in the field of secure software development, formalization and interpretation of vulnerabilities in program code, which will make it possible to create new rules for their identification and development of countermeasures to neutralize them.

Blasting profile evaluation of sand-mud interbedded surrounding rock during the large-span tunnel construction

The sand-mud interbedded surrounding rock contains discontinuities, such as horizontal bedding, joints, weak planes and weak interlayers. Drilling and blasting construction in this kind of surrounding rock is very likely to cause very serious over-/under-excavation phenomenon and excessive damage to surrounding rock, and the contour flatness after smooth blasting of the tunnel is also difficult to be guaranteed, which increases subsequent construction procedures and reduces production efficiency. In order to effectively evaluate the smooth blasting effect of the sand-mud interbedded surrounding rock tunnel, taking a tunnel project in southwest China as the research background, the blasting numerical simulation of the sand-mud interbedded surrounding rock tunnel was carried out using the dynamic analysis program, and the corresponding blasting optimization scheme was obtained. Subsequently, based on fuzzy mathematical theory, the evaluation system of blasting effect of sand-mud interbedded tunnel was established by combining the evaluation criteria of tunnel smooth blasting quality. Immediately afterwards, the weights of each influencing factor index were determined, and the blasting shaping effect of the original blasting scheme and the optimized blasting scheme was evaluated. Finally, the results have shown that the optimized tunnel blasting profile effect was better than the original blasting scheme. The corresponding research results have certain guiding significance for similar tunnel blasting effect evaluation and blasting parameter design.

Code search engines for the next generation

Given the abundance of software in open source repositories, code search engines are increasingly turning to “big data” technologies such as natural language processing and machine learning, to deliver more useful search results. However, like the syntax-based approaches traditionally used to analyze and compare code in the first generation of code search engines, big data technologies are essentially static analysis processes. When dynamic properties of software, such as run-time behavior (i.e., semantics) and performance, are among the search criteria, the exclusive use of static algorithms has a significant negative impact on the precision and recall of the search results as well as other key usability factors such as ranking quality. Therefore, to address these weaknesses and provide a more reliable and usable service, the next generation of code search engines needs to complement static code analysis techniques with equally large-scale, dynamic analysis techniques based on its execution and observation. In this paper we describe a new software platform specifically developed to achieve this by simplifying and largely automating the dynamic analysis (i.e., observation) of code at a large scale. We show how this platform can combine dynamically observed properties of code modules with static properties to improve the quality and usability of code search results.

Fuzzy-based adaptive control method for automatic mooring systems

An automatic mooring system is not only safer and more economical than a traditional mooring system with ropes but also significantly reduces the mooring time. In this paper, we propose an automatic mooring system designed to securely berth vessels entering a port, along with an efficient control method aimed at constraining vessel movement within a specific range. To assess the operational range and control performance of the proposed system in a marine environment, a dynamic analysis program was employed to create a simulator. The simulator incorporated a parallel structured Stewart platform to replicate the 6-DOF motion of a marine vessel. The proposed automatic mooring system controller regulates the position using a time-delay controller (TDC). TDC has proven to be excellent for effectively predicting system uncertainty and handling changes in system dynamics. However, given the unpredictable nature of extreme disturbances in marine environments, it is essential to adaptively modify the control parameters to ensure optimal performance. The method presented in this paper employs a fuzzy logic controller (FLC) to dynamically adjust the control parameters of the TDC, enabling effective adaptation to rapidly changing marine conditions, including waves and wind.

Development and benchmarking of space-time kinetics solver in REDAC

A space–time kinetics solver based on finite volume approach has been developed for REactor Dynamics Analysis Code (REDAC). It solves 3D multi-group neutron diffusion equation, coupled with the heat transport equations. Code offers flexibility in terms of reactor geometry, boundary conditions and discretization. Efficient numerical methods have been employed for solving the governing equations. The performance of the code has been demonstrated by solving diverse benchmark problems. It is shown that REDAC is able to predict important static and dynamic core parameters with good accuracy. The framework of REDAC easily lends itself for sensitivity studies with respect to spatial discretization and temporal integration schemes. From these studies, it is observed that spatial resolution could have significant influence on accuracy and the semi-implicit method performs better than the implicit method. Improved quasi-static method requires less computational time compared to the direct method, however, its accuracy depends on the time step size.

Convergence Analysis of Value Iteration Adaptive Dynamic Programming for Continuous-Time Nonlinear Systems.

This article is concerned with the convergence property and error bounds analysis of value iteration (VI) adaptive dynamic programming for continuous-time (CT) nonlinear systems. The size relationship between the total value function and the single integral step cost is described by assuming a contraction assumption. Then, the convergence property of VI is proved while the initial condition is an arbitrary positive semidefinite function. Moreover, the accumulated effects of approximation errors generated in each iteration are taken into consideration while using approximators to implement the algorithm. Based on the contraction assumption, the error bounds condition is proposed, which ensures the approximated iterative results converge to a neighborhood of the optimum, and the relation between the optimal solution and approximated iterative results is also derived. To make the contraction assumption more concrete, an estimation way is proposed to derive a conservative value of the assumption. Finally, three simulation cases are given to validate the theoretical results.

Methodology for Reverse Engineering of Machine Code. Part 3. Dynamic Investigation and Documentation

The results of creating a unified methodology for reverse engineering the machine code of devices are presented. This, the third and final part of the series of articles, is devoted to the dynamic examination of code in order to restore metainformation about it and additionally search for vulnerabilities, as well as the final documentation of the results. A review of scientific publications on the topic of existing methods and tools for dynamic analysis of machine code is carried out. A detailed description and formalization of the steps of the stage is given, as well as examples of their application in practice. A complete diagram of the proposed methodology is presented in graphical form, indicating the main and intermediate results obtained. All steps are summarized in a summary table, which also contains some of their characteristics. The shortcomings of the methodology and ways to eliminate them are discussed.

Detecting Malicious Websites from the Perspective of System Provenance Analysis

Malicious websites are considered one of the top threats to the modern Internet. Thus, it is critical to effectively detect malicious websites for the security of the Internet. Conventional technologies typically rely on URL blacklists, or static and dynamic code analysis, which are known to have limitations. In order to effectively detect malicious websites, in this paper, we study malicious websites from the perspective of system provenance analysis for the first time. We first conduct a systematic feature engineering study on thousands of benign and malicious websites from the perspective of system provenance data. In our study, we discover eight useful features for malicious website detection. Based on these eight features, we propose ProvWeb, a novel non-intrusive system provenance-based tool, for malicious website detection. In our evaluation, ProvWeb can achieve an F1 score of 93.7% ∼ 99.7% for the four combinations of browsers and OSes (Windows Chrome, Windows Firefox, Linux Chrome, Linux Firefox). This result confirms that the features discovered in provenance graphs are effective in detecting malicious websites.

Dynamics simulation model for the analysis of aircraft movement characteristics on an aircraft carrier deck

Aircraft on an aircraft carrier deck are taxied or towed using a tractor. As these vehicles move within a limited area and are affected by the aircraft carrier motion, the possibility of aircraft movement in the entire space must be confirmed. The potential aircraft movements can be determined using simulations, wherein the movement characteristics of the aircraft must be analyzed by considering the movement of the carrier. Therefore, an aircraft dynamics simulation model considering the six-degrees-of-freedom movement of the platform is presented in this study to analyze the aircraft movement characteristics on the deck. The proposed model was verified using various reference data and models, and the simulation results of the multi-body dynamics analysis program DAFUL were employed to estimate the tire stiffness coefficient according to the slope. The proposed model facilitated the analysis of the movement characteristics of the aircraft by implementing driving simulations for various platform movements.

Analysis of ChatGPT's capabilities for solving problems of reverse-engineering of software

The article presents the results of the analysis and evaluation of the capabilities of the open version of the chatbot with artificial intelligence ChatGPT 3.5 for solving typical problems of software reverse engineering. Three classes of reverse engineering tasks were selected for analysis: source code analysis, binary code analysis, and data models analysis. In each class of tasks, the most typical tasks were selected taking into account the limitations of ChatGPT regarding the processing of graphical models and the amount of input and output data, and sets of test tasks were developed for each task. As an approach to assessment, an approach similar to the assessment of competencies of higher education applicants after studying the relevant discipline was chosen. The following were considered as criteria for evaluating answers to test tasks: correctness (rightness, coincidence with expectations); completeness (obtaining the final result); accuracy (solving the task without additional questions); reasonableness (availability of explanations and answers to questions). The following scale was used and described for evaluations: excellent, very good, good, satisfactory, sufficient, unsatisfactory. During the testing for each test task, tasks statement and all necessary data were entered through the ChatGPT interface. As a result of the analysis, it was determined that ChatGPT better solves the problems of source code analysis (excellent and very good grades were obtained for semantic and structural analysis, restoration of mathematical support, quality assessment, security audit and refactoring, as well as for conversion to another programming language), tasks of decompilation of IDA pseudocode into complete C source code, tasks of reverse engineering of relational databases, and tasks of generating YARA rules for recognizing file formats. Unsatisfactory grades were obtained for dynamic analysis of assembly code and determination of binary file structures of non-standard formats. ChatGPT solves the rest of the problems well and satisfactorily, but requires checking the results, clarifying queries and prompts, as well as manual error correction in some cases. ChatGPT errors were observed when analyzing binary data represented by hexadecimal symbols, as well as errors in generated scripts for programming in IDA. On the basis of the set grades, conclusions were made regarding the expediency, possibility, or impracticality of using ChatGPT to solve each type of software reverse engineering problems, and appropriate recommendations were also provided. Prospects for further research include testing new versions of ChatGPT and other similar artificial intelligence systems regarding the capabilities of analyzing and synthesizing graphical models of software.

MicroProf : Code-level Attribution of Unnecessary Data Transfer in Microservice Applications

The microservice architecture style has gained popularity due to its ability to fault isolation, ease of scaling applications, and developer’s agility. However, writing applications in the microservice design style has its challenges. Due to the loosely coupled nature, services communicate with others through standard communication APIs. This incurs significant overhead in the application due to communication protocol and data transformation. An inefficient service communication at the microservice application logic can further overwhelm the application. We perform a grey literature review showing that unnecessary data transfer is a real challenge in the industry. To the best of our knowledge, no effective tool is currently available to accurately identify the origins of unnecessary microservice communications that lead to significant performance overhead and provide guidance for optimization. To bridge the knowledge gap, we propose MicroProf , a dynamic program analysis tool to detect unnecessary data transfer in Java-based microservice applications. At the implementation level, MicroProf proposes novel techniques such as remote object sampling and hardware debug registers to monitor remote object usage. MicroProf reports the unnecessary data transfer at the application source code level. Furthermore, MicroProf pinpoints the opportunities for communication API optimization. MicroProf is evaluated on four well-known applications involving two real-world applications and two benchmarks, identifying five inefficient remote invocations. Guided by MicroProf , API optimization achieves an 87.5% reduction in the number of fields within REST API responses. The empirical evaluation further reveals that the optimized services experience a speedup of up to 4.59×.

Validation of the fast reactor plant dynamics analysis code Super-COPD using FFTF loss of flow without scram test #13

The Japan Atomic Energy Agency (JAEA) has been developing a plant dynamics analysis code named Super-COPD for design studies and safety analyses of sodium-cooled fast reactors. Since there are a few validation studies of a thermal–hydraulic model in a plant, including a point kinetics model considering reactivity feedback for anticipated transient without scram (ATWS) events classified into the beyond design basis events (BDBEs), further validation studies under BDBE conditions are needed to improve the prediction accuracy of the model. Therefore, JAEA has participated in the international benchmark analysis of loss of flow without scram (LOFWOS) test #13 performed at the Fast Flux Test Facility (FFTF) as one of passive safety demonstration tests hosted by the International Atomic Energy Agency. In the first step, the transient calculation with major reactivity feedback mechanisms and imposing measured power history was conducted with Super-COPD. The results were compared with the measured data. Several challenges were identified about the thermal–hydraulic model in the core and heat transport systems and the reactivity model in the point kinetics model. Consequently, the transient calculation was performed with modified models considering the radial heat transfer, flow redistribution, and interwrapper flow in the core. The time-dependent change and the second peak of the outlet temperature in the specified assembly were predicted accurately because the core thermal–hydraulics was reproduced well. Furthermore, the assembly bowing reactivity model was developed to improve the net reactivity, thereby resulting in a good agreement with the measured data on the reactor power, temperature, and flow rate in the primary loop. Thus, this paper proves the validation of Super-COPD for the LOFWOS event in the BDBE.

Food bank operations: review of operation research methods and challenges during COVID-19

Food banks have played a crucial role in mitigating food insecurity in affluent countries for over four decades. Throughout the years, academics have researched food banks for a variety of operational problems, resulting in several research papers on the topic. However, despite significant academic interest, the operational challenges and optimization of food bank operations remain under-researched. This study aims to conduct a systematic literature review on food bank operations and provide evidence-based recommendations for addressing prevalent challenges, and provide decision-makers with practical recommendations. In addition, this investigation seeks to investigate the impact of the COVID-19 pandemic on food bank operations. We conducted a comprehensive analysis of academic publications on food bank operations using the Preferred Reporting Items for Systematic Reviews and Meta-Analyses (PRISMA) in order to get a deeper comprehension of the problems confronting food bank operations. Using a keyword search strategy with the logical operators “AND” and “OR,” two search methods were utilized to identify relevant articles on food bank operations management, supply chain, distribution, and production in our first search. In our second search, we discovered articles in the “Operations Research & Management Science” (OR &MS) category of Web of Science containing food bank-related keywords such as food charity, food donation, and food aid. The database searches yielded 246 hits, and the article content was scanned to eliminate irrelevant articles by removing non-English articles and duplicated studies, leaving 55 articles for further examination. Our extensive examination of Operations Research (OR) methodologies reveals that Mixed-Integer Linear Programming (MILP) models are the most commonly used methodology, followed by Linear Program (LP), Dynamic Program (DP), and Data Envelopment Analysis (DEA) techniques. The key findings of this study emphasize the operational challenges food banks encountered during and after the COVID-19 pandemic, including supply chain disruptions, increased demand, and volunteer shortages. To address these issues, effective solutions, including the management of food donations and volunteer scheduling, were proposed. Our findings have practical implications for decision-makers in food bank management, highlighting the importance of adopting evidence-based solutions. Finally, Limitations and prospective research directions in food bank management are discussed, with an emphasis on the need for ongoing research in this crucial area.

Large‐scale characterization of Java streams

AbstractJava streams are receiving the attention of developers targeting the Java virtual machine (JVM) as they ease the development of data‐processing logic, while also favoring code extensibility and maintainability through a concise and declarative style based on functional programming. Recent studies aim to shedding light on how Java developers use streams. However, they consider only small sets of applications and mainly apply manual code inspection and static analysis techniques. As a result, the large‐scale dynamic analysis of stream processing remains an open research question. In this article, we present the first large‐scale empirical study on the use of streams in Java code exercised via unit tests. We present stream‐analyzer, a novel dynamic program analysis (DPA) that collects runtime information and key metrics, which enable a fine‐grained characterization of sequential and parallel stream processing. We use a fully automatic approach to massively apply our DPA for the analysis of open‐source software projects hosted on GitHub. Our findings advance the understanding of the use of Java streams. Both the scale of our analysis and the profiling of dynamic information enable us to confirm with more confidence the outcome highlighted at a smaller scale by related work. Moreover, our study reports the popularity of many features of the Stream API and highlights multiple findings about runtime characteristics unique to streams, while also revealing inefficient stream processing and stream misuses. Finally, we present implications of our findings for developers of the Stream API, tool builders and researchers, and educators.

ANALYSIS OF THE EFFECT OF VSM ON THE MEMORY ACQUISITION PROCESS USING THE DYNAMIC ANALYSIS METHOD

At first, forensics was restricted to studying data that was stored on a system's hard disk. However, as storage capacity and data encryption increased, applying conventional digital forensic procedures became more challenging. As a result, memory forensics techniques are developed, or are frequently referred to as live forensics, because the process is quicker and more sophisticated. Volatile memory forensics, often known as live forensics, are necessary for this condition. Live forensics has flaws, specifically that some programs can fail when the computer is in active VSM (virtual secure mode). This results in the retrievable evidence being lost. Therefore, determining the cause is essential. The software-based memory acquisition tools Autopsy, Isobuster, DumpIt, and Magnet RAM Capturer are just a few examples. According to the findings of the experiments, the tools that have crashed include DumpIt v1.3.2.20110401. A dynamic code analysis using WindBg as a tool was utilized to study the impact of VSM on the memory acquisition tool. This study's goal is to identify the instances of crashes in various forensic instruments, which will be highly useful for forensic experts performing investigations.

Numerical analysis of suspension bridges with box girders subjected to detonations

This paper focuses on the dynamic behavior of a typical three-span suspension bridge subjected to blast loads. Three-dimensional finite element models were established to simulate the blasting excavation of these structures using the explicit dynamic analysis code LS-DYNA. The explosive charge model was developed using the *LOAD_BLAST_ENHANCED tool in the LS-DYNA software. The accuracy of finite element models was validated against existing experimental and numerical results. The failure patterns and damage process of the bridge under explosive loading on the deck were analyzed, while the effects of mass and location of explosive charge were further explored. Dynamic responses such as displacement, stress, and strain were discussed and compared. Based on the computed results, the most critical location of the explosives was assessed. The results indicated the superior performance of the bridge against near-tower detonation over mid-span detonation. The deck exhibited disproportionate collapse due to very high charges of 5000 kg and 8000 kg TNT detonation at mid-span. The blast outcome generated on the bridge's components due to high charges from 1000 kg TNT to 2500 kg TNT at a standoff distance of 2 m was identified as partial collapse. Moderate charges of 250 kg TNT and 500 kg TNT at standoff distances of 2 m and 3 m led to plastic deformation without fracture of the bridge's component. Very high TNT charges at near-tower detonation caused only partial collapse. The severity of cable relaxation and detachment from the deck due to mid-span detonation exceeded the near-tower one.

Studying the Cable Loss Effect on the Seismic Behavior of Cable-Stayed Bridge

As the demand and construction of cable-stayed bridges have increased, research on the safety of cable-stayed bridges in the event of natural disasters such as fires and explosions is actively being conducted. If a cable-stayed bridge is damaged by an unexpected natural disaster or accident, it can cause serious traffic congestion and huge economic losses. This study evaluates the usability of the cable-stayed bridge in the event of cable damage. Additionally, seismic performance and the impact of the damage are evaluated by numerical analysis. To achieve this goal, the cable-stayed bridge is modeled using 3D BEAM elements and two-node cable elements. Then, the impact of the damage was evaluated by gradually damaging the cable. The deflection, axial force of the girder, and cable stress changes under far-field ground motion (El-Centro earthquake) were reviewed. A representative dynamic analysis program LS-DYNA was utilized for the numerical analyses. The results show that the loss of a small number of cables does not affect the usability of the bridge. However, if five or more cables are continuously lost, or if an earthquake occurs when cables are already lost, excessive deflections and changes in the girders’ axial forces can cause usability problems.

국공립 어린이집 그린리모델링 사업의 리트로핏 대안별 에너지 성능 및 경제성 비교 분석 : 단일 사례의 시뮬레이션 기반 분석 중심으로

Purpose: The purpose of this study was to present an optimized green remodeling retrofit plan through energy performance and economic analysis of the public daycare center for which green remodeling has been completed. Method: By collecting data on public building green remodeling project management in 2020 from the Korea Authority of Land & Infrastructure Safety, target daycare centers that are single-use and can collect monthly building energy consumption data through a public data open system were extracted. The building outline and operating conditions were investigated, and energy performance was analyzed using Design Builder, a dynamic building energy analysis program. After calibration, an alternative model analysis for each technical element was performed, including the basic base model. Then, economic analysis was performed using the net present value method. Result: The results of this study were as follows. After comprehensively analyzing energy performance and economic feasibility, ALT-4(heat recovery ventilation system), ALT-9 (heat recovery ventilation system+high-efficiency air conditioning+LED lighting replacement), ALT-6(LED lighting replacement) models were determined by the final priority. ALT-4(heat recovery ventilation system) as a single element model and ALT-9(heat recovery ventilation system+high-efficiency air conditioner+LED lighting replacement) as a combined element model were the best alternative when comprehensively considering energy performance and economic feasibility in green remodeling.

Methods and means of static and dynamic code analysis

The purpose of the article is to explore the methods and tools used to analyze software code in order to identify errors and potential problems. Static and dynamic code analysis are key processes in software development, as they allow you to detect errors in the early stages of development, reduce the risk of problems later and ensure high quality of the software product. The article discusses various methods and means of static and dynamic code analysis. For each method and tool, examples of their use and advantages and disadvantages are described.
 The article will be useful for software developers who want to improve the quality of their products and reduce the risk of problems. It will provide readers with an in-depth understanding of code analysis techniques and tools and help them choose the most appropriate tool for their needs.