Program Slicing Research Articles

Fault localization by abstract interpretation and its applications

Fault localization aims to automatically identify the cause of an error in a program by localizing the error to a relatively small part of the program. In this paper, we present a novel technique for automated fault localization via error invariants inferred by abstract interpretation. An error invariant for a location in an error program over-approximates the reachable states at the given location that may produce the error, if the execution of the program is continued from that location. Error invariants can be used for statement-wise semantic slicing of error programs and for obtaining concise error explanations. We use an iterative refinement sequence of backward–forward static analyses by abstract interpretation to compute error invariants, which are designed to explain why an error program violates a particular assertion.Furthermore, we present a practical application of the fault localization technique for automatic repair of programs. Given an erroneous program, we first use the fault localization to automatically identify statements relevant for the error, and then repeatedly mutate the expressions in those relevant statements until a correct program that satisfies all assertions is found. All other statements classified by the fault localization as irrelevant for the error are not mutated in the program repair process. This way, we significantly reduce the search space of mutated programs without losing any potentially correct program, and so locate a repaired program much faster than a program repair without fault localization.We have developed a prototype tool for automatic fault localization and repair of C programs. We demonstrate the effectiveness of our approach to localize errors in realistic C programs, and to subsequently repair them. Moreover, we show that our approach based on combining fault localization and code mutations is significantly faster that the previous program repair approach without fault localization.

Dynamic Slicing and Reconstruction Algorithm for Precise Canopy Volume Estimation in 3D Citrus Tree Point Clouds

Dynamic Slicing and Reconstruction Algorithm for Precise Canopy Volume Estimation in 3D Citrus Tree Point Clouds

A framework for monitored dynamic slicing of reaction systems

Reaction systems (RSs) are a computational framework inspired by biochemical mechanisms. A RS defines a finite set of reactions over a finite set of entities. Typically each reaction has a local scope, because it is concerned with a small set of entities, but complex models can involve a large number of reactions and entities, and their computation can manifest unforeseen emerging behaviours. When a deviation is detected, like the unexpected production of some entities, it is often difficult to establish its causes, e.g., which entities were directly responsible or if some reaction was misconceived. Slicing is a well-known technique for debugging, which can point out the program lines containing the faulty code. In this paper, we define the first dynamic slicer for RSs and show that it can help to detect the causes of erroneous behaviour and highlight the involved reactions for a closer inspection. To fully automate the debugging process, we propose to distil monitors for starting the slicing whenever a violation from a safety specification is detected. We have integrated our slicer in BioResolve, written in Prolog which provides many useful features for the formal analysis of RSs. We define the slicing algorithm for basic RSs and then enhance it for dealing with quantitative extensions of RSs, where timed processes and linear processes can be represented. Our framework is shown at work on suitable biologically inspired RS models.

A Learning-Based Approach to Static Program Slicing

Traditional program slicing techniques are crucial for early bug detection and manual/automated debugging of online code snippets. Nevertheless, their inability to handle incomplete code hinders their real-world applicability in such scenarios. To overcome these challenges, we present NS-Slicer, a novel learning-based approach that predicts static program slices for both complete and partial code Our tool leverages a pre-trained language model to exploit its understanding of fine-grained variable-statement dependencies within source code. With this knowledge, given a variable at a specific location and a statement in a code snippet, NS-Slicer determines whether the statement belongs to the backward slice or forward slice, respectively. We conducted a series of experiments to evaluate NS-Slicer's performance. On complete code, it predicts the backward and forward slices with an F1-score of 97.41% and 95.82%, respectively, while achieving an overall F1-score of 96.77%. Notably, in 85.20% of the cases, the static program slices predicted by NS-Slicer exactly match entire slices from the oracle. For partial programs, it achieved an F1-score of 96.77%–97.49% for backward slicing, 92.14%–95.40% for forward slicing, and an overall F1-score of 94.66%–96.62%. Furthermore, we demonstrate NS-Slicer's utility in vulnerability detection (VD), integrating its predicted slices into an automated VD tool. In this setup, the tool detected vulnerabilities in Java code with a high F1-score of 73.38%. We also include the analyses studying NS-Slicer’s promising performance and limitations, providing insights into its understanding of intrinsic code properties such as variable aliasing, leading to better slicing.

Enhancing security in e-business processes: Utilizing dynamic slicing of Colored Petri Nets for logical vulnerability detection

The field of e-business covers multiple aspects and has undergone rapid development, profoundly changing our transaction methods and shopping experiences. However, with the increasing complexity of its business processes, logical vulnerabilities have become an inevitable issue. These logical vulnerabilities can lead to a range of security problems, seriously threatening business stability and consumer trust. To address the challenge of logical vulnerabilities in e-business, we developed a model based on Colored Petri Nets (CPN), the Interactive Business Process Fusion (IBPF) net, which is adept at identifying such vulnerabilities during the design phase. However, the analysis methods for IBPF net still urgently need innovation. In addressing this issue, we use dynamic slicing techniques to analyze IBPF net, serving as a method for revealing logical vulnerabilities. We obtain backward slice, partial forward slice, and bidirectional slice through the slicing algorithms. Eventually, these three types of slices are merged to form the final dynamic slice. This technique, which involves a more targeted analysis than examining the entire IBPF net, simplifies analysis process and prevents state space explosion, thereby providing a distinct advantage. The results of this research are of great value in enhancing system reliability, reducing maintenance costs, and providing analysis techniques in the field of e-business security.

Modeling and Analyzing Reaction Systems in Maude

Reaction Systems (RSs) are a successful computational framework for modeling systems inspired by biochemistry. An RS defines a set of rules (reactions) over a finite set of entities (e.g., molecules, proteins, genes, etc.). A computation in this system is performed by rewriting a finite set of entities (a computation state) using all the enabled reactions in the RS, thereby producing a new set of entities (a new computation state). The number of entities in the reactions and in the computation states can be large, making the analysis of RS behavior difficult without a proper automated support. In this paper, we use the Maude language—a programming language based on rewriting logic—to define a formal executable semantics for RSs, which can be used to precisely simulate the system behavior as well as to perform reachability analysis over the system computation space. Then, by enriching the proposed semantics, we formalize a forward slicer algorithm for RSs that allows us to observe the evolution of the system on both the initial input and a fragment of it (the slicing criterion), thus facilitating the detection of forward causality and influence relations due to the absence/presence of some entities in the slicing criterion. The pursued approach is illustrated by a biological reaction system that models a gene regulation network for controlling the process of differentiation of T helper lymphocytes.

How About Bug-Triggering Paths? - Understanding and Characterizing Learning-Based Vulnerability Detectors

Machine learning and its promising branch deep learning have proven to be effective in a wide range of application domains. Recently, several efforts have shown success in applying deep learning techniques for automatic vulnerability discovery, as alternatives to traditional static bug detection. In principle, these learning-based approaches are built on top of classification models using supervised learning. Depending on the different granularities to detect vulnerabilities, these approaches rely on learning models which are typically trained with well-labeled source code to predict whether a program method, a program slice, or a particular code line contains a vulnerability or not. The effectiveness of these models is normally evaluated against conventional metrics including precision, recall and F1 score. In this paper, we show that despite yielding promising numbers, the above evaluation strategy can be insufficient and even misleading when evaluating the effectiveness of current learning-based approaches. This is because the underlying learning models only produce the classification results or report individual/isolated program statements, but are unable to pinpoint bug-triggering paths, which is an effective way for bug fixing and the main aim of static bug detection. Our key insight is that a program method or statement can only be stated as vulnerable in the context of a bug-triggering path. In this work, we systematically study the gap between recent learning-based approaches and conventional static bug detectors in terms of fine-grained metrics called BTP metrics using bug-triggering paths. We then characterize and compare the quality of the prediction results of existing learning-based detectors under different granularities. Finally, our comprehensive empirical study reveals several key issues and challenges in developing classification models to pinpoint bug-triggering paths and calls for more advanced learning-based bug detection techniques.

Context-Based e2e Autonomous Operation in B5G Networks.

The research and innovation related to fifth-generation (5G) networks that has been carried out in recent years has decided on the fundamentals of the smart slice in radio access networks (RANs), as well as the autonomous fixed network operation. One of the most challenging objectives of beyond 5G (B5G) and sixth-generation (6G) networks is the deployment of mechanisms that enable smart end-to-end (e2e) network operation, which is required for the achievement of the stringent service requirements of the envisioned use cases to be supported in the short term. Therefore, smart actions, such as dynamic capacity allocation, flexible functional split, and dynamic slice management need to be performed in tight coordination with the autonomous capacity management of the fixed transport network infrastructure. Otherwise, the benefits of smart slice operation (i.e., cost and energy savings while ensuring per-slice service requirements) might be cancelled due to uncoordinated autonomous fixed network operation. Notably, the transport network in charge of supporting slices from the user equipment (UE) to the core expands across access and metro fixed networks. The required coordination needs to be performed while keeping the privacy of the radio and fixed network domains, which is important in multi-tenant scenarios where both network segments are managed by different operators. In this paper, we propose a novel approach that explores the concept of context-aware network operation, where the slice control anticipates the aggregated and anonymized information of the expected slice operation that is sent to the fixed network orchestrator in an asynchronous way. The context is then used as the input for the artificial intelligence (AI)-based models used by the fixed network control for the predictive capacity management of optical connections in support of RAN slices. This context-aware network operation aims at enabling accurate and reliable autonomous fixed network operation under extremely dynamic traffic originated by smart RAN operation. The exhaustive numerical results show that slice context availability improves the benchmarking fixed network predictive methods (90% reduction in prediction maximum error) remarkably in the foreseen B5G scenarios, for both access and metro segments and in heterogeneous service demand scenarios. Moreover, context-aware network operation enables robust and efficient operation of optical networks in support of dense RAN cells (>32 base stations per cell), while the benchmarking methods fail to guarantee different operational objectives.

Scheduling of Industrial Control Traffic for Dynamic RAN Slicing with Distributed Massive MIMO

Industry 4.0, with its focus on flexibility and customizability, is pushing in the direction of wireless communication in future smart factories, in particular, massive multiple-input-multiple-output (MIMO) and its future evolution of large intelligent surfaces (LIS), which provide more reliable channel quality than previous technologies. At the same time, network slicing in 5G and beyond systems provides easier management of different categories of users and traffic, and a better basis for providing quality of service, especially for demanding use cases such as industrial control. In previous works, we have presented solutions for scheduling industrial control traffic in LIS and massive MIMO systems. We now consider the case of dynamic slicing in the radio access network, where we need to not only meet the stringent latency and reliability requirements of industrial control traffic, but also minimize the radio resources occupied by the network slice serving the control traffic, ensuring resources are available for lower-priority traffic slices. In this paper, we provide mixed-integer programming optimization formulations for radio resource usage minimization for dynamic network slicing. We tested our formulations in numerical experiments with varying traffic profiles and numbers of nodes, up to a maximum of 32 nodes. For all problem instances tested, we were able to calculate an optimal schedule within 1 s, making our approach feasible for use in real deployment scenarios.

Dynamic slicing of multidimensional resources in DCI-EON with penalty-aware deep reinforcement learning

With the increasing demand for dynamic cloud computing services, data center interconnections based on elastic optical networks (DCI-EON) require efficient allocation methods for spectrum, access IP bandwidth, and compute resources. Dynamic slicing of multidimensional resources in DCI-EON has emerged as a promising solution. However, improper reallocation of resources can diminish the benefits of slice reconfiguration, and different resource reconfiguration techniques can lead to varying degrees of service degradation for existing services. In this paper, we propose a prediction-based dynamic slicing approach (DS-DRL-RW) that leverages penalty-aware deep reinforcement learning (DRL) to optimize resource allocation while considering the trade-off between the benefits and penalties of slice reconfiguration. DS-DRL-RW employs statistical prediction to obtain a coarse-grained solution for dynamic slicing that does not differentiate among multidimensional resources. Subsequently, through focused DRL training based on the coarse-grained solution, the accurate result for multidimensional resource slicing is achieved. Moreover, DS-DRL-RW comprehensively considers the benefits and penalties associated with different reconfiguration techniques after slice reconfiguration, enabling the determination of a suitable reconfiguration strategy. Simulation results demonstrate that DS-DRL-RW improves training efficiency and reduces the blocking rate of dynamic services by integrating slice traffic prediction and DRL. It effectively addresses both direct penalties from reconfiguration and indirect penalties from resource waste, thereby enhancing multidimensional resource utilization. DS-DRL-RW effectively handles the diverse penalties associated with various reconfiguration techniques and selects the appropriate reconfiguration strategy. Furthermore, DS-DRL-RW prioritizes the different quality requirements of services in slices, such as completion time, to avoid service degradation.

An Improved Dynamic Slicing Algorithm to Prioritize a Concurrent Multi-threading in Operating System

One of the issues with multi-threading in operating systems is the concurrency of operations or threads. In a multithreaded process on a single processor, the processor can switch execution resources between threads, enabling concurrent execution. Concurrency indicates that more than one thread is making progress, but the threads are not actually running simultaneously. The switching between threads occurs rapidly enough that the threads might appear to run simultaneously. In this paper, three related strategies for prioritizing multi-threading are presented: ACE-thread, Semaphore coprocessor, and the Concurrent Priority Threads Algorithm. The aim of this work is to enhance an existing prioritization algorithm, specifically the Concurrent Priority Threads Algorithm, by extending a dynamic slicing algorithm to prioritize multi-threading concurrently. The algorithm is designed to compute correct slices in multi-threading prioritization scenarios. Threads with the same highest priority can perform in a synchronized manner without encountering deadlocks. The C++ programming language is used to implement the extended algorithms. The improved algorithm achieved results that were 3% more accurate than the existing one. The outcomes of this work would facilitate the simultaneous execution of threads with the same priority, ultimately reducing waiting and processing times.

A Short Review on the Dynamic Slice Management in Software-Defined Network Virtualization

Software-Defined Network (SDN) is a contemporary networking technology that offers enhanced network flexibility and streamlines network management processes. Virtual Software-Defined Networking (vSDN) enables the dynamic allocation and sharing of physical networking resources among several slices, each representing distinct service providers or services. Each tenant is granted autonomous control over their respective services or applications within the Virtual Network (VN). Network virtualization allows providers to deliver novel, advanced services while enhancing efficiency and dependability. Utilizing numerous virtual networks on a specific infrastructure presents difficulties in implementing effective resource allocation mechanisms to prevent congestion and resource scarcity while maintaining the Service Level Agreements (SLAs) in the vSDN. A limited body of research has focused on dynamic slice allocation in the vSDN domain. This article will briefly review dynamic resource management, focusing on slice resource dynamic allocation through SDN hypervisors. The survey outlined that very few studies have tackled the impact of dynamicity slice management in vSDN, and there are research gaps in implementing proactive and intelligent frameworks for slice management in vSDN.

Localizing faults using verification technique

In model-based fault diagnosis, it is assumed that a correct model of each program being diagnosed is available. In general, these techniques require test cases and user-specified assertions to localize the fault. This paper aims to localize faults in a faulty program without user-specified assertions and without executing the programs, and therefore, without using test cases. Given the faulty and the correct versions of a program, a product code is automatically constructed and assertions are automatically generated. The proposed method is a full y automatic, model-based static approach to fault localization. The proposed method reduces the fault search space by removing equivalent regions from the product code using verification techniques. To identify these components, the bounded model checker CBMC is used. The invoked functions from the correct and the faulty programs are considered uninterpreted functions and MiniSat is used as a backend solver. The proposed method can also be applied on static slices of the correct and faulty programs. Also, the identified fault search space can be analyzed along with the generated counterexample trace to pinpoint the fault. The experimental data is presented that supports the applicability of our approach. We demonstrate the effectiveness of the proposed method using the Siemens TCAS and NTS benchmark suite. It is observed that the method can also successfully localize the wrong safety check bug produced by the LLVM compiler.

DRIVE: Dynamic Resource Introspection and VNF Embedding for 5G Using Machine Learning

Network Slicing (NS) technique is comprehensively reshaping the next-generation communication networks (e.g. 5G, 6G). Software-Defined Networking (SDN) and Network Functions Virtualization (NFV) predominantly control the flow of service functions on NS to incorporate versatile applications as per user demands. In the virtualized-Software Defined Networking vSDN environment, a chain of well-defined virtual network functions (VNFs) are installed on Service Function Chains (SFCs) by multiple Internet Service Providers (ISPs) concurrently. Generation, allocation, re-allocation, release and destroying associative VNFs on SFC is an extremely difficult task while keeping high selection accuracy. Towards solving this fundamental issue, in this work, we have proposed a multi-layered SFC formation for adaptive VNF allocation on dynamic slices. We have formulated an ILP to address the VNF-EAP (VNF-Embedding and Allocation Problem) over real network topology (AT&T Topology). Leveraging machine learning techniques we have shown an intelligent VNF selection mechanism to optimize resource utilization. The performance evaluation shows remarkable efficiency on ML-driven dynamic VNF selections over static allocations on SFCs by halving resource usage. Further, we have also studied a VNF typecasting technique for service backup on outage slices in the field of disaster management activities.

Maximal and Minimal Dynamic Petri Net Slicing

Context: Petri net slicing is a technique to reduce the size of a Petri net to ease the analysis or understanding of the original Petri net. Objective: Presenting two new Petri net slicing algorithms to isolate those places and transitions of a Petri net (the slice) that may contribute tokens to one or more places given (the slicing criterion). Method: The two algorithms proposed are formalized. The maximality of the first algorithm and the minimality of the second algorithm are formally proven. Both algorithms together with three other state-of-the-art algorithms have been implemented and integrated into a single tool so that we have been able to carry out a fair empirical evaluation. Results: Besides the two new Petri net slicing algorithms, a public, free, and open-source implementation of five algorithms is reported. The results of an empirical evaluation of the new algorithms and the slices they produce are also presented. Conclusions: The first algorithm collects all places and transitions that may contribute tokens (in any computation) to the slicing criterion, while the second algorithm collects the places and transitions needed to fire the shortest transition sequence that contributes tokens to some place in the slicing criterion. Therefore, the net computed by the first algorithm can reproduce any computation that contributes tokens to any place of interest. In contrast, the second algorithm loses this possibility, but it often produces a much more reduced subnet (which still can reproduce some computations that contribute tokens to some places of interest). The first algorithm is proven maximal, and the second one is proven minimal.

Vulnerability detection through cross-modal feature enhancement and fusion

Software vulnerability detection is critical to computer security. Most existing vulnerability detection methods use single modal-based vulnerability detection models, which cannot effectively extract cross-modal features. To solve this problem, we propose a new multimodal deep learning based vulnerability detection method through a cross-modal feature enhancement and fusion. Firstly, we utilize a special compilation and debugging method to obtain the alignment relationship between source code statements and assembly instructions, as well as between source code variables and assembly code registers. Based on this alignment relationship and program slicing technology, we propose a cross-slicing method to generate bimodal program slices. Then, we propose a cross-modal feature enhanced code representation learning model to capture the fine-grained semantic correlation between source code and assembly code by using the co-attention mechanisms. Finally, vulnerability detection is achieved by feature level fusion of semantic features captured in fine-grained aligned source code and assembly code. Extensive experiments show that our method improves the performance of vulnerability detection compared with state-of-the-art methods. Specifically, our method achieves an accuracy of 97.4% and an F1-measure of 93.4% on the SARD dataset. An average accuracy of 95.4% and an F1-measure of 89.1% on two real-world software projects (i.e., FFmpeg and OpenSSL) is also achieved by our method, improving over SOTA method 4.5% and 2.9%.

Intelligent Detection of Cryptographic Misuse in Android Applications Based on Program Slicing andTransformer-Based Classifier

The utilization of cryptography in applications has assumed paramount importance with the escalating security standards for Android applications. The adept utilization of cryptographic APIs can significantly enhance application security; however, in practice, software developers frequently misuse these APIs due to their inadequate grasp of cryptography. A study reveals that a staggering 88% of Android applications exhibit some form of cryptographic misuse. Although certain tools have been proposed to detect such misuse, most of them rely on manually devised rules which are susceptible to errors and require researchers possessing an exhaustive comprehension of cryptography. In this study, we propose a research methodology founded on a neural network model to pinpoint code related to cryptography by employing program slices as a dataset. We subsequently employ active learning, rooted in clustering, to select the portion of the data harboring security issues for annotation in accordance with the Android cryptography usage guidelines. Ultimately, we feed the dataset into a transformer and multilayer perceptron (MLP) to derive the classification outcome. Comparative experiments are also conducted to assess the model’s efficacy in comparison to other existing approaches. Furthermore, planned combination tests utilizing supplementary techniques aim to validate the model’s generalizability.

Smart contract vulnerability detection based on a semantic code structure and a self-designed neural network

Smart contracts are riddled with vulnerabilities due to flaws in programming languages and the inexperience of developers, causing damage. Nonetheless, the current research on smart contract vulnerability detection is insufficient. In this study, we propose a novel approach, namely, Blass, based on a semantic code structure and a self-designed neural network. Blass constructs program slices with complete semantic structure information (CPSs) and uses an abstract syntax tree and a depth-first traversal algorithm to convert CPSs into code chains during the process of CPS vectorization, which increases its ability to express vulnerability features. Blass also uses a self-designed neural network, Bi-LSTM-Att, as the classification model, which introduces an attention mechanism to capture the key features of vulnerabilities and effectively achieve improved smart contract vulnerability detection performance. The CPSs and the Bi-LSTM-Att can improve the vulnerability detection effectiveness of Blass, and Blass can be applied to malicious contract detection with satisfactory precision, recall, and F1 values.

Automated Debugging : Still a Dream ?

Software debugging is the process of finding and fixing incorrect statements in programs. The process of debugging takes a lot of time and is challenging. Therefore, the field of automated debugging, which is focused on automating the discovery and correction of a failure's underlying cause, has made huge progress in the past. By applying automated approaches to identify and correct any erroneous statements in a program, the cost of producing software may be significantly decreased while also improving the quality of the final product. The purpose of this paper is to shed light on the application of automated debugging in the current market scenario. Techniques like Delta Debugging, Path-based Weakest Preconditions, Fault Localization, and Program Slicing have been demonstrated to be quite effective in dealing with the identification and resolution of inconsistencies. This paper also aims to examine the question, "Is Automated Debugging still a dream? ". Key Words: Automated Debugging, Delta Debugging, Program Slicing.

An empirical evaluation of quasi-static executable slices

Program slicing aims to reduce a program to a minimal form that produces the same output for a given slicing criterion. Program slicing approaches divide into static and dynamic approaches: whereas static approaches generate an over-approximation of the slice that is valid for all possible program inputs, dynamic approaches rely on executing the program and thus generate an under-approximation of the slice that is valid for only a subset of the inputs. An important limitation of static approaches is that they often do not generate an executable program, but rather identify only those program components upon which the slicing criterion depends (referred to as a closure slice). In order to overcome this limitation, we propose a novel approach that combines static and dynamic slicing. We rely on observation-based slicing, a dynamic approach, but protect all statements that have been identified as part of the static slice by the static slicer CodeSurfer. As a result, we obtain slices that cover at least the behavior of the static slice, and that can be compiled and executed. We evaluated this new approach on a set of 62 C programs and report our findings.