Execution Paths Research Articles

PRRT: An Intelligent Planning Algorithm with Memory

This paper proposes a practically executable path planning method, namely, Pheromones-RRT(PRRT), for robots with a large joint range in a complex environment. To inter-activate with the real world, the point cloud is utilized as the scene information, while for sampling, the pheromones approach is designed to describe the pheromone content carried by each sampling point. During the sampling process, random sampling nodes are performed with a probability of ε, or those nodes with the highest pheromone content in the current sampling tree are selected with a probability of 1-ε and sampled in their neighborhood. To avoid the local minimum problem, the concept of pheromone volatile factor (PVF) is proposed, while in the expansion, double trees are also generated by PRRT in both cartesian and configuration spaces to improve the speed of the algorithm. The pheromone accumulation enables PRRT to certain learning abilities, reducing the randomness of the sampling process. Simulation results show that the proposed method can effectively plan an optimal obstacle avoidance path with satisfactory performances as compared with the RRT-Connect.

Delay-on-Squash: Stopping Microarchitectural Replay Attacks in Their Tracks

MicroScope and other similar microarchitectural replay attacks take advantage of the characteristics of speculative execution to trap the execution of the victim application in a loop, enabling the attacker to amplify a side-channel attack by executing it indefinitely. Due to the nature of the replay, it can be used to effectively attack software that are shielded against replay, even under conditions where a side-channel attack would not be possible (e.g., in secure enclaves). At the same time, unlike speculative side-channel attacks, microarchitectural replay attacks can be used to amplify the correct path of execution, rendering many existing speculative side-channel defenses ineffective. In this work, we generalize microarchitectural replay attacks beyond MicroScope and present an efficient defense against them. We make the observation that such attacks rely on repeated squashes of so-called “replay handles” and that the instructions causing the side-channel must reside in the same reorder buffer window as the handles. We propose Delay-on-Squash, a hardware-only technique for tracking squashed instructions and preventing them from being replayed by speculative replay handles. Our evaluation shows that it is possible to achieve full security against microarchitectural replay attacks with very modest hardware requirements while still maintaining 97% of the insecure baseline performance.

Bio‐inspired optimization to support the test data generation of concurrent software

SummaryConcurrent programming is increasingly present in modern applications. Although it provides higher performance and better use of available resources, the mechanisms of interaction between processes/threads result in a greater challenge for software testing activity. The nondeterminism present in those applications is one of the main issues during the test activity since the same test input can produce different possible execution paths, which may or not contain defects. The test data automatic generation can alleviate this problem, ensuring higher speed and reliability in software testing activity. This paper explores the automatic test data generation for concurrent programs through Genetic Algorithm, a bioinspired optimization technique, and proposes a test data generation approach for concurrent programs, called BioConcST, and a new operator for the selection of test subjects, called FuzzyST, which uses fuzzy logic. The approaches were evaluated in an experimental study towards their validation. The results showed that BioConcST is more promising than the other approaches at all analyzed levels. FuzzyST, together with Elitism and Tournament operators, provided the best results; however, it proved more suitable for concurrent programs of higher complexity.

SwitchFuzz: Switch Short-Term Goals in Directed Grey-Box Fuzzing

In recent years, fuzzing has become a powerful tool for security researchers to uncover security vulnerabilities. It is used to discover software vulnerabilities by continuously generating malformed inputs to trigger bugs. Directed grey-box fuzzing has also been widely used in the verification of patch testing and in vulnerability reproduction. For directed grey-box fuzzing, the core problem is to make test cases reach the target and trigger vulnerabilities faster. Selecting seeds that are closer to the target site to be mutated first is an effective method. For this purpose, the DGF calculates the distance between the execution path and the target site by a specific algorithm. However, as time elapses in the execution process, the seeds covering a larger amount of basic blocks may be overlooked due to their long distances. At the same time, directed fuzzing often ignores the impact of coverage on test efficiency, resulting in a local optimum problem without accumulating enough valuable test cases. In this paper, we analyze and discuss these problems and propose SwitchFuzz, a fuzzer that can switch short-term goals during execution. SwitchFuzz keeps shortening the distance of test cases to reach the target point when it performs well and prioritizes reaching the target point. When positive feedback is not achieved over a period of time, SwitchFuzz tries to explore more possibilities. We compared the efficiency of SwitchFuzz with that of AFLGO in setting single target and multiple targets for crash recurrence in our experiments, respectively. The results show that SwitchFuzz produces a significant improvement over AFLGO in both the speed and the probability of triggering a specified crash. SwitchFuzz can discover more edges than AFLGO in the same amount of time and can generate seeds with smaller distances.

Pluto: Exposing Vulnerabilities in Inter-Contract Scenarios

Attacks on smart contracts have caused considerable losses to digital assets. Many techniques based on symbolic execution, fuzzing, and static analysis are used to detect contract vulnerabilities. Most of the current analyzers only consider vulnerability detection intra-contract scenarios. However, Ethereum contracts usually interact with others by calling their functions. A bug hidden in a path that depends on information from external contract calls is defined as an inter-contract vulnerability. Failure to deal with this kind of bug can result in potential false negatives and false positives. In this work, we propose Pluto, which supports vulnerability detection in inter-contract scenarios. It first builds an Inter-contract Control Flow Graph (ICFG) to extract semantic information among contract calls. Afterward, it symbolically explores the ICFG and deduces Inter-Contract Path Constraints (ICPC) to check the reachability of execution paths more accurately. Finally, Pluto detects whether there is a vulnerability based on some predefined rules. For evaluation, we compare Pluto with five state-of-the-art tools, including Oyente, Mythril, Securify, ILF, and Clairvoyance on a labeled benchmark and 39,443 real-world Ethereum smart contracts. The result shows that other tools can only detect 10% of the inter-contract vulnerabilities, while Pluto can detect 80% of them on the labeled dataset. Beyond that, Pluto has detected 451 confirmed vulnerabilities on real-world contracts, including 36 vulnerabilities in inter-contract scenarios. Two bugs have been assigned with unique CVE identifiers by the US National Vulnerability Database (NVD). On average, Pluto costs 16.9 seconds to analyze a contract, which is as fast as the state-of-the-art tools.

SiaLog: detecting anomalies in software execution logs using the siamese network

Detecting anomalies in software logs has become a notable concern for software engineers and maintainers as they represent anomalies in software execution paths and states. This paper propose a novel anomaly detection approach based on the Siamese network on top of Recurrent Neural Networks(RNN). Accordingly, we introduce a novel training pair generation algorithm to train the Siamese network which reduces generated training significantly while maintaining the F_1 score. Additionally, we propose a hybrid model by combining the Siamese network with a traditional feedforward neural network to make end-to-end training possible, reducing engineering effort in setting up a deep-learning-based log anomaly detector. Furthermore, we provides validations of the approach on the Hadoop Distributed File System (HDFS), Blue Gene/L (BGL), and Hadoop map-reduce task log datasets. To the best of our knowledge, the proposed approach outperforms other methods on the same dataset at the F_1 scores of respectively 0.99, 0.99, and 0.94 on HDFS, BGL, and Hadoop datasets, resulting in a new state-of-the-art performance.To further evaluate the proposed method, we examine our method’s robustness to log evolutions by evaluating the model on synthetically evolved log sequences; we got the F_1 score of 0.95 on the HDFS dataset at the noise ratio of 20%. Finally, we dive deep into some of the side benefits of the Siamese network. Accordingly, we introduce an unsupervised log evolution monitoring method alongside a visualization technique that facilitates model interpretability.

Generation of the weakest preconditions of programs with dynamic memory in symbolic execution

Symbolic execution is a widely used method for the systematic study of program execution paths; it allows solving a number of important problems related to verification of correctness: searching for errors and vulnerabilities, automatic test generation, etc. The main idea of symbolic execution is generation and use of symbolic expressions in the program analysis in direct order, i.e., from the entry point to the points of interest. At the same time, since the time of E.W. Dijkstra, the method of backward symbolic execution has been popular when the conditions for hitting the point of interest are extended to the entry point of the program due to the iterative calculation of the weakest preconditions. This method is usually much more difficult to implement than direct symbolic execution, so even the artifacts of the latter cannot be used in the implementation. In this paper, the relationship between direct and backward symbolic execution based on the calculation of the weakest preconditions is investigated. In particular, it is shown that the latter can be implemented using the former. A formal presentation of symbolic execution with lazy initialization for programs with dynamic memory is given. An algorithm for calculating the weakest preconditions for arbitrary symbolic executed program branches is proposed. The lazy initialization mechanism and the algorithm for calculating the weakest preconditions are implemented in KLEE, a symbolic virtual machine for the well-known LLVM platform. The proposed method allows performing backward symbolic analysis using direct symbolic execution. This is important for the implementation of bidirectional program execution which can be used both for program verification and for automatic test generation.

Colosseum: Regression Test Prioritization by Delta Displacement in Test Coverage

The problem of test-case prioritization has been pursued for over three decades now and continues to be one of the active topics in software testing research. In this paper, we focus on a code-coverage based regression test-prioritization solution ( <inline-formula><tex-math notation="LaTeX">${{\sf Colosseum}}$</tex-math></inline-formula> ) that takes into account the position of changed (delta) code elements (basic-blocks) along the loop-free straight-line execution path of the regression test-cases. We propose a heuristic that logically associates each of these paths with three parameters: (i) the offset (displacement <i>a</i> ) of the first delta from the starting basic-block, (ii) the offset (displacement <i>c</i> ) of the last delta from the terminating basic block, and (iii) the average scattering (displacement <i>b</i> ) within all the intermediate basic-blocks. We hypothesize that a regression test-case path with a shorter overall displacement has a good chance of propagating the affects of the code-changes to the observable outputs in the program. <inline-formula><tex-math notation="LaTeX">${{\sf Colosseum}}$</tex-math></inline-formula> prioritizes test-cases with smaller overall displacements and executes them early in the regression test-execution cycle. The underlying intuition is that the probability of a test-case revealing a regression fault depends on the probability of the corresponding change propagation. The change in this context can potentially lead to an error. Extending this logic, delta displacement provides an approximation to failed error propagation. Evaluation on 20 open-source C projects from the Software-artifact Infrastructure Repository and GitHub (totaling: 694,512 SLOC, 280 versions, and 69,305 test-cases) against four state-of-the-art prioritizations reveals that: <inline-formula><tex-math notation="LaTeX">${{\sf Colosseum}}$</tex-math></inline-formula> outperforms the competitors with an overall 84.61% success in terms of 13 prioritization effectiveness metrics, majority of which prefer to execute top- <inline-formula><tex-math notation="LaTeX">$k\%$</tex-math></inline-formula> prioritized test-cases.

Safety-Aware Time-Optimal Motion Planning With Uncertain Human State Estimation

Human awareness in robot motion planning is crucial for seamless interaction with humans. Many existing techniques slow down, stop, or change the robot's trajectory locally to avoid collisions with humans. Although using the information on the human's state in the path planning phase could reduce future interference with the human's movements and make safety stops less frequent, such an approach is less widespread. This paper proposes a novel approach to embedding a human model in the robot's path planner. The method explicitly addresses the problem of minimizing the path execution time, including slowdowns and stops owed to the proximity of humans. For this purpose, it converts safety speed limits into configuration-space cost functions that drive the path's optimization. The costmap can be updated based on the observed or predicted state of the human. The method can handle deterministic and probabilistic representations of the human state and is independent of the prediction algorithm. Numerical and experimental results on an industrial collaborative cell demonstrate that the proposed approach consistently reduces the robot's execution time and avoids unnecessary safety speed reductions.

Parametric Interval Temporal Logic over Infinite Words

Model checking for Halpern and Shoham's interval temporal logic HS has been recently investigated in a systematic way, and it is known to be decidable under three distinct semantics. Here, we focus on the trace-based semantics, where the infinite execution paths (traces) of the given (finite) Kripke structure are the main semantic entities. In this setting, each finite infix of a trace is interpreted as an interval, and a proposition holds over an interval if and only if it holds over each component state (homogeneity assumption). In this paper, we introduce a quantitative extension of HS over traces, called parametric HS (PHS). The novel logic allows to express parametric timing constraints on the duration (length) of the intervals. We show that checking the existence of a parameter valuation for which a Kripke structure satisfies a PHS formula (model checking), or a PHS formula admits a trace as a model under the homogeneity assumption (satisfiability) is decidable. Moreover, we identify a fragment of PHS which subsumes parametric LTL and for which model checking and satisfiability are shown to be EXPSPACE-complete.

Enhancing Dynamic Symbolic Execution by Automatically Learning Search Heuristics

We present a technique to automatically generate search heuristics for dynamic symbolic execution. A key challenge in dynamic symbolic execution is how to effectively explore the program's execution paths to achieve high code coverage in a limited time budget. Dynamic symbolic execution employs a search heuristic to address this challenge, which favors exploring particular types of paths that are most likely to maximize the final coverage. However, manually designing a good search heuristic is nontrivial and typically ends up with suboptimal and unstable outcomes. The goal of this paper is to overcome this shortcoming of dynamic symbolic execution by automatically learning search heuristics. We define a class of search heuristics, namely a parametric search heuristic, and present an algorithm that efficiently finds an optimal heuristic for each subject program. Experimental results with industrial-strength symbolic execution tools (e.g., KLEE) show that our technique can successfully generate search heuristics that significantly outperform existing manually-crafted heuristics in terms of branch coverage and bug-finding.

LogAssist: Assisting Log Analysis Through Log Summarization

Logs contain valuable information about the runtime behaviors of software systems. Thus, practitioners rely on logs for various tasks such as debugging, system comprehension, and anomaly detection. However, logs are difficult to analyze due to their unstructured nature and large size. In this paper, we propose a novel approach called <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">LogAssist</i> that assists practitioners with log analysis. <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">LogAssist</i> provides an organized and concise view of logs by first grouping logs into event sequences (i.e., workflows), which better illustrate the system runtime execution paths. Then, <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">LogAssist</i> compresses the log events in workflows by hiding consecutive events and applying n-gram modeling to identify common event sequences. We evaluated <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">LogAssist</i> on logs generated by one enterprise and two open source systems. We find that <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">LogAssist</i> can reduce the number of log events that practitioners need to investigate by up to 99 percent. Through a user study with 19 participants, we find that <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">LogAssist</i> can assist practitioners by reducing the time required for log analysis tasks by an average of 40 percent. The participants also rated <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">LogAssist</i> an average of 4.53 out of 5 for improving their experiences of performing log analysis. Finally, we document our experiences and lessons learned from developing and adopting <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">LogAssist</i> in practice. We believe that <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">LogAssist</i> and our reported experiences may lay the basis for future analysis and interactive exploration on logs.

CFRV: A Decentralized Control-Flow Attestation Schema Using Mutual Secret Sharing.

Control-flow attestation (CFA) is a mechanism that securely logs software execution paths running on remote devices. It can detect whether a device is being control-flow hijacked by launching a challenge–response process. In the growing landscape of the Internet of Things, more and more peer devices need to communicate to share sensed data and conduct inter-operations without the involvement of a trusted center. Toward the scalability of CFA mechanisms and mitigating the single-point failure, it is important to design a decentralized CFA schema. This paper proposed a decentralized schema (CFRV) to verify the control flow on remote devices. Moreover, it introduces a token (asymmetric secret slices) into peer devices to make the attestation process mutual. In this case, CFRV can mitigate a particular kind of man-in-the-middle attack called response defraud. We built our prototype toolbox on Raspberry-Pi to formulate our proof of concept. In our evaluation, CFRV protects the verification process from malicious verifiers and the man-in-the-middle attack. The proposed mechanism can also limit the PKI (Public Key Infrastructure) usage to a single stage to save the peer devices’ computational cost. Compared to related decentralized schemes, the cryptographic operation’s duration is reduced by 40%.

An In-Office Hysteroscopy VR/Haptic Simulation Platform for Training in Spatial Navigation and Passage of the Cervical Canal

Hysteroscopy is a type of gynecological procedure that enables diagnosis and treatment of intrauterine pathologies using a minimally-invasive approach. Recent advancements, especially in optics, made it possible to perform this procedure in an ambulatory, outpatient setting without anaesthesia. Yet, such approach introduces additional challenges to gynecologists, as the surgical instruments have to pass through the cervix, a narrow curved canal. This process can be traumatic and even cause tissue damage or rupture. Current training curricula mainly focus on general minimally-invasive surgical skills or on inpatient hysteroscopy. This paper describes the first virtual reality training system designed purposely for in-office hysteroscopy training featuring both passive and active haptic feedback. Design requirements were defined through a literature review and a survey of clinical experts. A dedicated platform was developed and tested with clinicians and medical students. The results of the conducted experiments verified the skill acquisition capabilities of the platform showing a.o. shorter execution time and path length, lower integral forces in most of non-expert participants. The results also demonstrated the capability of the system to differentiate between experts and non-expert groups. Reported findings suggest that the platform has the potential to evolve into an effective solution for in-office hysteroscopy training.

A Framework for Memory Efficient Context-Sensitive Program Analysis

Static program analysis is in general more precise if it is sensitive to execution contexts (execution paths). But then it is also more expensive in terms of memory consumption. For languages with conditions and iterations, the number of contexts grows exponentially with the program size. This problem is not just a theoretical issue. Several papers evaluating inter-procedural context-sensitive data-flow analysis report severe memory problems, and the path-explosion problem is a major issue in program verification and model checking. In this paper we propose χ-terms as a means to capture and manipulate context-sensitive program information in a data-flow analysis. χ-terms are implemented as directed acyclic graphs without any redundant subgraphs. We introduce the k-approximation and the l-loop-approximation that limit the size of the context-sensitive information at the cost of analysis precision. We prove that every context-insensitive data-flow analysis has a corresponding k,l-approximated context-sensitive analysis, and that these analyses are sound and guaranteed to reach a fixed point. We also present detailed algorithms outlining a compact, redundancy-free, and DAG-based implementation of χ-terms.

Composition of construction services with hierarchical planning on digital platform

The digital platform business model offers opportunities for the construction industry to address the problem of extensive development by elaborately orchestrating a range of construction services to meet complex construction requirements. The presence of isomeric and coupling relationships between two construction services leads to alternative execution paths in the service network. However, the problem of generating a service network with alternative branches has been scarcely investigated. This study proposes a hierarchical task network (HTN) approach to address the service composition problem. Specifically, the approach performs a depth-first traversal search to address the isomeric and coupling relationships. A branch merging mechanism is integrated to eliminate repeated planning caused by equivalent planning nodes. The experimental studies demonstrate that the approach can generate valid and correct branches in the construction service network and that the devised branch merging mechanism can significantly improve the efficiency of the approach.

Equivalent Mutants Detection Based on Weighted Software Behavior Graph

The equivalent mutants problem is one of the crucial problems in mutation testing. In consequence of its existence, the effectiveness of mutation testing is underestimated. In addition, it will produce a certain amount of useless overhead. Equivalent mutants cannot be detected by any test input. The existing works mostly focus on static analysis to detect, or avoid generating, the equivalent mutants. The essence of these methods is to use prior knowledge to establish some rules of program equivalence. However, (1) it needs a lot of professional labor to sort out the equivalence rules, and (2) only a small part of the rules can be determined in advance, because of the diversity of mutation operators and mutation targets. Consequently, the best result reported so far is 50% of the equivalent mutants can be detected. Since it is generally believed that manual judgment of program equivalence is the most reliable, this paper proposes a novel method to automatically detect equivalent mutants by tracing program behavior like the professionals. The weighted software behavior graph is utilized in the detection of equivalent mutants for the first time. This method can not only figure out different execution paths, but also be sensitive to execution frequency. By comparing the weighted software behavior graphs of an alive mutant and its original program, we are able to examine more precisely whether the alive mutant is the same as the original program, in terms of the state of infection and/or the propagation. Evaluation results on an open dataset of manually evaluated equivalent mutants show that our approach can detect 77.5% of all the equivalent mutants, which is much higher than the existing static methods.

Technical Perspective

There is a tension between an imperative style for control flow that has been shown to be easier to use, especially for novices, and a functional style for control flow that better exposes optimization opportunities, thereby making the optimizers more capable. The authors of "Efficient Control Flow in Dataflow Systems: When Ease-of-Use Meets High Performance" propose Mitos, a program rewriting framework that achieves the best of both worlds by borrowing program analysis concepts from compilers and lifting them to the distributed dataflow regime. Dataflow systems require significant data movement during processing, which can be highly redundant and wasteful in the context of iteration: naive execution plans can reprocess the same massive dataset on each iteration, and iteration i+1 must wait until iteration i is finished. The authors design a mechanism for labeling each intermediate result with its execution path, allowing the system to simultaneously manage complex branching situations while also implementing efficient processing via loop pipelining, all by reasoning about and comparing execution paths.

Decision Support Algorithm for Discipline Construction of Comparative Pedagogy Based on Evolutionary Graph Data Mining

The traditional pedagogy discipline construction decision support algorithm has the problems of poor discipline construction decision satisfaction, high decision time, and low decision recall rate. Therefore, a decision support algorithm for discipline construction of comparative pedagogy based on evolutionary graph data mining is designed. First, the programme call graph is created based on the programme execution path, and then the graph reduction method is used to decrease the call graph set and create the weighted behavior graph set. The original graph set is then reduced using the subtree reduction procedure. The interference of weights in the graph must be eliminated while mining closed subgraphs using a close graph method. The most frequent subgraph of comparative pedagogy discipline construction is then mined, and an SVM classifier is created to accomplish information mining of comparative pedagogy discipline construction in evolutionary graph data mining. Then, using the complete weighing approach, the attribute classification of comparative pedagogy discipline construction is accomplished, and the decision weight of comparative pedagogy discipline construction is established. Finally, the weight distribution scheme of comparative pedagogy discipline construction is obtained by using European distance, so as to realize the decision support of comparative pedagogy discipline construction. The experimental results show that the decision-making satisfaction of comparative pedagogy discipline construction of this method is 97.32%, the decision-making time is only 0.9 min, and the decision-making recall rate is as high as 98.66%, indicating that the decision-making effect of comparative pedagogy discipline construction of this method is good.

Virtual training and commissioning of industrial bin picking systems using synthetic sensor data and simulation

ABSTRACT Defined handling of unsorted parts, known as bin picking, is a challenge in robotic automation. Available solution concepts for this problem are usually either costly or require considerable setup and tuning efforts. In this contribution, a setup for virtual commissioning of such automation systems is introduced. Using a physics-based simulation environment, a virtual stereo-camera simulation and robot controller integration, a full simulation of the bin picking cycle is possible. The setup is also used to generate realistic synthetic training data for learning-based computer vision routines. The functionality of the system is demonstrated for generating training data capable of enabling a real-life deployment of the pipeline. A simulation of both model-based and learning-based bin picking systems is also conducted. This simulation also involves the path planning and execution as well as the grasp itself, allowing for a full simulation of the bin picking cycle.