Control Flow Graph Of Program Research Articles

Application of multithreading for protection programs

A method for identifying a program copy by means of digital watermark is presented in this article. Previously known analogues for constructing a watermark used modification of program's control flow graph, and reading was made via complex analysis of the program's trace. It is known that applying a protector or packer can neutralize such a watermark. In this paper, it is proposed to use a multi-threaded application that generates numbers with a normal distribution law. The embedding of the digital watermark is carried out by changing the dispersion of distributions. Such random variable can be found via a signature in the process memory and is used both within the program itself and by a third-party when reading the watermark. An experimental selection of the optimal parameters of the algorithm has been carried out. Overhead expenses associated with the creation of a large number of threads are estimated.

NPC: N euron P ath C overage via Characterizing Decision Logic of Deep Neural Networks

Deep learning has recently been widely applied to many applications across different domains, e.g., image classification and audio recognition. However, the quality of Deep Neural Networks (DNNs) still raises concerns in the practical operational environment, which calls for systematic testing, especially in safety-critical scenarios. Inspired by software testing, a number of structural coverage criteria are designed and proposed to measure the test adequacy of DNNs. However, due to the blackbox nature of DNN, the existing structural coverage criteria are difficult to interpret, making it hard to understand the underlying principles of these criteria. The relationship between the structural coverage and the decision logic of DNNs is unknown. Moreover, recent studies have further revealed the non-existence of correlation between the structural coverage and DNN defect detection, which further posts concerns on what a suitable DNN testing criterion should be. In this article, we propose the interpretable coverage criteria through constructing the decision structure of a DNN. Mirroring the control flow graph of the traditional program, we first extract a decision graph from a DNN based on its interpretation, where a path of the decision graph represents a decision logic of the DNN. Based on the control flow and data flow of the decision graph, we propose two variants of path coverage to measure the adequacy of the test cases in exercising the decision logic. The higher the path coverage, the more diverse decision logic the DNN is expected to be explored. Our large-scale evaluation results demonstrate that: The path in the decision graph is effective in characterizing the decision of the DNN, and the proposed coverage criteria are also sensitive with errors, including natural errors and adversarial examples, and strongly correlate with the output impartiality.

An error-propagation aware method to reduce the software mutation cost using genetic algorithm

PurposeThe purpose of this study is to reduce the number of mutations and, consequently, reduce the cost of mutation test. The results of related studies indicate that about 40% of injected faults (mutants) in the source code are effect-less (equivalent). Equivalent mutants are one of the major costs of mutation testing and the identification of equivalent and effect-less mutants has been known as an undecidable problem.Design/methodology/approachIn a program with n branch instructions (if instruction) there are 2n execution paths (test paths) that the data and codes into each of these paths can be considered as a target of mutation. Given the role and impact of data in a program, some of data and codes propagates the injected mutants more likely to the output of the program. In this study, firstly the error-propagation rate of the program data is quantified using static analysis of the program control-flow graph. Then, the most error-propagating test paths are identified by the proposed heuristic algorithm (Genetic Algorithm [GA]). Data and codes with higher error-propagation rate are only considered as the strategic locations for the mutation testing.FindingsIn order to evaluate the proposed method, an extensive series of mutation testing experiments have been conducted on a set of traditional benchmark programs using MuJava tool set. The results depict that the proposed method reduces the number of mutants about 24%. Also, in the corresponding experiments, the mutation score is increased about 5.6%. The success rate of the GA in finding the most error-propagating paths of the input programs is 99%. On average, only 7.46% of generated mutants by the proposed method are equivalent. Indeed, 92.54% of generated mutants are non-equivalent.Originality/valueThe main contribution of this study is as follows: Proposing a set of equations to measure the error-propagation rate of each data, basic-block and execution path of a program. Proposing a genetic algorithm to identify a most error-propagating path of program as locations of mutations. Developing an efficient mutation-testing framework that mutates only the strategic locations of a program identified by the proposed genetic algorithms. Reducing the time and cost of mutation testing by reducing the equivalent mutants.

Constructing PLC Binary Program Model for Detection Purposes

Programmable Logic Controller (PLC) programs are vulnerable to tampering attacks with addition of malware, which can substantially cause severe physical destructions. In order to solve the problems, We propose a static analysis method of Binary PLC programs for the detection of PLC malwares. Firstly, disassemble the binary program into STL program. Secondly, constructed the control flow graph of STL program according to the characteristics of STL language. Thirdly, generate the program execution paths according to traverse the control flow graph and analysis loop paths. Finally the PLC program output and input mapping relations are obtained based on the program execution paths. The experiment shows that the proposed method has achieved the analysis of PLC programs and get each path predicate and the mapping relation between output and input.

РАЗРАБОТКА АЛГОРИТМА РАЗБИЕНИЯ ЗАДАЧ НА ПОДЗАДАЧИ В СИСТЕМАХ РАСПРЕДЕЛЕННОЙ ОБРАБОТКИ ДАННЫХ

In terms of the problem of insufficient computational resources for a number of tasks, realization of computational cluster of neurocomputers is being considered as a variant. To implement the basic principle of distributed computing, there has been presented an algorithm for splitting the tasks entering the computational cluster of neurocomputers into sub-tasks. For this purpose, the program introduced into the cluster is suggested to present for execution in the modified postfix Polish record and to store it in the program command stack. To modify the program Polish notation should include different, non-arithmetic, operators and constructions. The next step is to get an abstract syntax tree of the program, following the rules for translating the modified postfix Polish record from the command stack into an abstract syntax tree. Then, the data should be sent to the abstract syntax tree of the program taking into account their bit depth, and to obtain the contiguity matrix of the program control flow graph that will display the set of all ways of program execution. The authors come to the conclusion that all operations recorded in the modified reverse Polish record presented in the form of an abstract syntax tree when data of a certain bit depth are transmitted to them, at the moment of transition to the program control flow graph executed in a single clock cycle are indivisible operations and can be represented as subprograms of the source program, which was submitted for processing to the computer cluster of neurocomputers.

Tapir

This paper explores how fork-join parallelism, as supported by concurrency platforms such as Cilk and OpenMP, can be embedded into a compiler's intermediate representation (IR). Mainstream compilers typically treat parallel linguistic constructs as syntactic sugar for function calls into a parallel runtime. These calls prevent the compiler from performing optimizations across parallel control constructs. Remedying this situation is generally thought to require an extensive reworking of compiler analyses and code transformations to handle parallel semantics. Tapir is a compiler IR that represents logically parallel tasks asymmetrically in the program's control flow graph. Tapir allows the compiler to optimize across parallel control constructs with only minor changes to its existing analyses and code transformations. To prototype Tapir in the LLVM compiler, for example, we added or modified about 6000 lines of LLVM's 4-million-line codebase. Tapir enables LLVM's existing compiler optimizations for serial code -- including loop-invariant-code motion, common-subexpression elimination, and tail-recursion elimination -- to work with parallel control constructs such as spawning and parallel loops. Tapir also supports parallel optimizations such as loop scheduling.

A Comparative Study on Test Case Generation of Concurrent Programs

This paper deals with a comparative study on testing of concurrent programs based on different techniques. The various challenges in testing concurrent programming are: defining test coverage criteria based on control flow, generating control flow graph of nondeterministic programs, investigating the applicability of sequential testing criteria to parallel program testing etc. For solving these issues, some existing techniques are discussed in this study. Various researchers use an intermediate graph called Event Inter Actions Graph (EIAG) to solve the problem of generating the control flow graph of nondeterministic programs. Some researches propose an intermediate graph called Interaction Sequence Testing Criteria (ISTC) approach based on sequence of interactions to solve the problem of test coverage criteria based on control and data flow. Another method to solve the problem of generating test coverage based on control flow graph of nondeterministic programs is constraint based approach. It needs constrained elements to generate test case which includes structural element and constraint. The selection of good test cases has been addressed by test data generation technique. The technique of concurrent path analysis approach is used to solve the problem of applicability of sequential testing criteria to parallel program testing. It reduces the number of combined concurrent test paths. The sequential test paths are combined to form concurrent test path. The Integration and System Test Automation (ISTA) approach is used to solve the problem of applicability of sequential testing criteria to parallel program testing. It is used for automated test case generation and execution by using high-level Petri net is a finite state test model.

Natural Computing for Automatic Test Data Generation Approach Using Spanning Tree Concepts

The weight is assigned to all edges of graph according to a uniform policy and focus is on the leaves nodes of the Spanning Tree of Control Flow Graph of Program. If all leaves nodes of Spanning tree are covered by the test cases, then number of test cases required or testing the program can be reduced to great extent. Further the spanning tree is based on the concept of maximum spanning tree of CFG which helps in finding the critical paths of CFG. The chances of finding errors in critical are more as compare to the normal path. Covering of all the leaves nodes of Spanning Tree give guarantee for the coverage of Critical path also. Further the paper also shows that number of test cases required in case of Spanning tree is less as compare to the Dominance tree concept. For the generation of fast, unique and reliable test cases a optimization technique which is based on natural computing concept is used which is called as on Swine Influenza Models Based Optimization (SIMBO). The relation between nodes has been used as fitness function in this paper. Finally, the results in the paper show the effectiveness of SIMBO techniques as compare to Particle Swarm Optimization (PSO) and Genetic Algorithm (GA).

Вычисление входных данных для достижения определенной функции в программе методом итеративного динамического анализа

Dynamic symbolic execution is a well-known technique used for different tasks of program analysis: input generation for increasing test coverage for program, inputs of death generation, exploit generation and etc. But huge time costs of program analysis during dynamic symbolic execution for any real-life program is a well-known problem caused by path explosion and necessity of path constraint solving for every path with different SAT/SMT techniques which is a NP-complete task in general case. Brute force analysis of every path in program has limited practical sense for time limited analysis; instead different techniques and heuristics are used to improve analysis performance and reduce space of analysis for specific needs of analyst or while solving specific problem under analysis. We present our approach which combines static analysis of program binary code based on binutils library with dynamic symbolic execution tool based on Avalanche - an iterative dynamic analysis tool to perform targeted input data generation for reaching specific function in the program. As the first step of our algorithm we extract reduced program call graph which contains only calls to functions which ends with the function of interest, then we amplify this call graph with control flow graph inside of functions included into reduced call graph. Using the reduced control-flow graph of program which contain only calls and conditional jumps directions which lead to the function of interest we built the metric of best next analysis direction. This approach allows us to significantly (up to twelve times for some real world programs) reduce the time of reaching function of interest comparatively to brute force program paths analysis with inversion of every conditional jump at the execution path dependent on tainted data.

PERFORMANCE ANALYSIS OF TEST DATA GENERATION FOR PATH COVERAGE BASED TESTING USING THREE METAHEURISTIC ALGORITHMS

This paper discusses an approach to generate test data for path coverage based testing using Genetic Algorithms, Differential Evolution and Artificial Bee Colony optimization algorithms. Control flow graph and cyclomatic complexity of the example program has been used to find out the number of feasible paths present in the program and it is compared with the actual no of paths covered by the evolved test cases using those meta-heuristic algorithms. Genetic Algorithms, Artificial Bee Colony optimization and Differential Evolution are acting here as meta-heuristic search paradisms for path coverage based test data generation. Finally the performance of the test data generation using three meta-heuristic optimization algorithms are empirically evaluated and compared.

An analytical approach for fast and accurate design space exploration of instruction caches

Application-specific system-on-chip platforms create the opportunity to customize the cache configuration for optimal performance with minimal chip area. Simulation, in particular trace-driven simulation, is widely used to estimate cache hit rates. However, simulation is too slow to be deployed in design space exploration, especially when there are hundreds of design points and the traces are huge. In this article, we propose a novel analytical approach for design space exploration of instruction caches. Given the program control flow graph (CFG) annotated only with basic block and control flow edge execution counts, we first model the cache states at each point of the CFG in a probabilistic manner. Then, we exploit the structural similarities among related cache configurations to estimate the cache hit rates for multiple cache configurations in one pass. Experimental results indicate that our analysis is 28--2,500 times faster compared to the fastest known cache simulator while maintaining high accuracy (0.2% average error) in estimating cache hit rates for a large set of popular benchmarks. Moreover, compared to a state-of-the-art cache design space exploration technique, our approach achieves 304--8,086 times speedup and saves up to 62% (average 7%) energy for the evaluated benchmarks.

Graph-tree-based software control flow checking for COTS processors on pico-satellites

This paper proposes a generic high-performance and low-time-overhead software control flow checking solution, graph-tree-based control flow checking (GTCFC) for space-borne commercial-off-the-shelf (COTS) processors. A graph tree data structure with a topology similar to common trees is introduced to transform the control flow graphs of target programs. This together with design of IDs and signatures of its vertices and edges allows for an easy check of legality of actual branching during target program execution. As a result, the algorithm not only is capable of detecting all single and multiple branching errors with low latency and time overheads along with a linear-complexity space overhead, but also remains generic among arbitrary instruction sets and independent of any specific hardware. Tests of the algorithm using a COTS-processor-based on-board computer (OBC) of in-service ZDPS-1A pico-satellite products show that GTCFC can detect over 90% of the randomly injected and all-pattern-covering branching errors for different types of target programs, with performance and overheads consistent with the theoretical analysis; and beats well-established preeminent control flow checking algorithms in these dimensions. Furthermore, it is validated that GTCGC not only can be accommodated in pico-satellites conveniently with still sufficient system margins left, but also has the ability to minimize the risk of control flow errors being undetected in their space missions. Therefore, due to its effectiveness, efficiency, and compatibility, the GTCFC solution is ready for applications on COTS processors on pico-satellites in their real space missions.

Reducing behavioural to structural properties of programs with procedures

There is an intimate link between program structure and behaviour. Exploiting this link to phrase program correctness problems in terms of the structural properties of a program graph rather than in terms of its unfoldings is a useful strategy for making analyses more tractable. The present paper presents a characterisation of behavioural program properties through sets of structural properties by means of a translation. The characterisation is given in the context of a program model based on control flow graphs of sequential programs with procedures, abstracting away completely from program data, and properties expressed in a fragment of the modal μ-calculus with boxes and greatest fixed-points only. The property translation is based on a tableau construction that conceptually amounts to symbolic execution of the behavioural formula, collecting structural constraints along the way. By keeping track of the subformulae that have been examined, recursion in the structural constraints can be identified and captured by fixed-point formulae. The tableau construction terminates, and the characterisation is exact, i.e., the translation is sound and complete. A prototype implementation has been developed. In addition, we show how the translation can be extended beyond the basic flow graph model and safety logic to richer behavioural models (such as open programs) and richer program models (including Boolean programs), and discuss possible extensions for more complex logics. We present several applications of the characterisation, in particular sound and complete compositional verification for behavioural properties based on maximal models.

Simulation Investigation of Mixed Absorption Refrigeration Air-Conditioning System

The mixed absorption refrigeration cycle which was suitable for the solar air-conditioning was presented. On the base of characters of working process, the models of each component were established in the paper. The universal module of thermo-physical properties of LiBr solution and water was written, control flow graph of program was given and simulation program of the mixed absorption refrigeration system was developed. The simulation results showed that the relations between LiBr solution concentrations and performance of mixed absorption system. The simulation program provided theoretical rules of optimization designs for commercial solar absorption air-conditioning.

Assertion-based slicing and slice graphs

Abstract This paper revisits the idea of slicing programs based on their axiomatic semantics, rather than using criteria based on control/data dependencies. We show how the forward propagation of preconditions and the backward propagation of postconditions can be combined in a new slicing algorithm that is more precise than the existing specification-based algorithms. The algorithm is based on (a) a precise test for removable statements, and (b) the construction of a slice graph , a program control flow graph extended with semantic labels and additional edges that “short-circuit” removable commands. It improves on previous approaches in two aspects: it does not fail to identify removable commands; and it produces the smallest possible slice that can be obtained (in a sense that will be made precise). Iteration is handled through the use of loop invariants and variants to ensure termination. The paper also discusses in detail applications of these forms of slicing, including the elimination of (conditionally) unreachable and dead code, and compares them to other related notions.

A multiple-population genetic algorithm for branch coverage test data generation

The software testing phase in the software development process is considered a time-consuming process. In order to reduce the overall development cost, automatic test data generation techniques based on genetic algorithms have been widely applied. This research explores a new approach for using genetic algorithms as test data generators to execute all the branches in a program. In the literature, existing approaches for test data generation using genetic algorithms are mainly focused on maintaining a single-population of candidate tests, where the computation of the fitness function for a particular target branch is based on the closeness of the input execution path to the control dependency condition of that branch. The new approach utilizes acyclic predicate paths of the program's control flow graph containing the target branch as goals of separate search processes using distinct island populations. The advantages of the suggested approach is its ability to explore a greater variety of execution paths, and in certain conditions, increasing the search effectiveness. When applied to a collection of programs with a moderate number of branches, it has been shown experimentally that the proposed multiple-population algorithm outperforms the single-population algorithm significantly in terms of the number of executions, execution time, time improvement, and search effectiveness.

Over-Approximated Control Flow Graph Construction on Pure Esterel

Esterel is an imperative synchronous language for control-dominant reactive systems. Regardless of imperative features of Esterel, combination of parallel execution and preemption makes it difficult to build control flow graphs (CFGs) of Esterel programs. Simple and convenient CFGs can help to analyze Esterel programs. However, previous researches are not suitable for flow analyses of imperative languages. In this work, we present a method to construct over-approximated CFGs for Pure Esterel. Generated CFGs expose invisible interferences among threads and show program structures explicitly so that they are useful for program analyses based on graph theory or control-/data- flows.

Resource control graphs

Resource Control Graphs are an abstract representation of programs. Each state of the program is abstracted by its size, and each instruction is abstracted by the effects it has on the state size whenever it is executed. The abstractions of instruction effects are then used as weights on the arcs of a program's Control Flow Graph. Termination is proved by finding decreases in a well-founded order on state-size, in line with other termination analyses, resulting in proofs similar in spirit to those produced by Size Change Termination analysis. However, the size of states may also be used to measure the amount of space consumed by the program at each point of execution. This leads to an alternative characterisation of the Non Size Increasing programs, that is, of programs that can compute without allocating new memory. This new tool is able to encompass several existing analyses and similarities with other studies, suggesting that even more analyses might be expressable in this framework, thus giving hopes for a generic tool for studying programs.

New aspect-oriented constructs for security hardening concerns

In this paper, we present new pointcuts and primitives to Aspect-Oriented Programming (AOP) languages that are needed for systematic hardening of security concerns. The two proposed pointcuts allow to identify particular join points in a program's control-flow graph (CFG). The first one is the GAFlow, Closest Guaranteed Ancestor, which returns the closest ancestor join point to the pointcuts of interest that is on all their runtime paths. The second one is the GDFlow, Closest Guaranteed Descendant, which returns the closest child join point that can be reached by all paths starting from the pointcut of interest. The two proposed primitives are called ExportParameter and ImportParameter and are used to pass parameters between two pointcuts. They allow to analyze a program's call graph in order to determine how to change function signatures for passing the parameters associated with a given security hardening. We find these pointcuts and primitives to be necessary because they are needed to perform many security hardening practices and, to the best of our knowledge, none of the existing ones can provide their functionalities. Moreover, we show the viability and correctness of the proposed pointcuts and primitives by elaborating and implementing their algorithms and presenting the result of explanatory case studies.

Size-change termination with difference constraints

This article considers an algorithmic problem related to the termination analysis of programs. More specifically, we are given bounds on differences in sizes of data values before and after every transition in the program's control-flow graph. Our goal is to infer program termination via the following reasoning (“the size-change principle”): if in any infinite (hypothetic) execution of the program, some size must descend unboundedly, the program must always terminate, since infinite descent of a natural number is impossible. The problem of inferring termination from such abstract information is not the halting problem for programs and may well be decidable. If this is the case, the decision algorithm forms a “back end” of a termination verifier, and it is interesting to find out the computational complexity of the problem. A restriction of the problem described above, which only uses monotonicity information (but not difference bounds), is already known to be decidable. We prove that the unrestricted problem is undecidable, which gives a theoretical argument for studying restricted cases. We consider a case where the termination proof is allowed to make use of at most one bound per target variable in each transition. For this special case, which we claim is practically significant, we give (for the first time) an algorithm and show that the problem is in PSPACE, in fact that it is PSPACE-complete. The algorithm is based on combinatorial arguments and results from the theory of integer programming not previously used for similar problems. The algorithm has interesting connections to other work in termination, in particular to methods for generating linear ranking functions or invariants.