Symbolic Analysis Techniques Research Articles

Fine-Grained Modeling of ROP Vulnerability Exploitation Process under Stack Overflow Based on Petri Nets

Software vulnerability discovery is currently a hot topic, and buffer overflow remains a prevalent security vulnerability. One of the key issues in vulnerability discovery and analysis is how to quickly analyze buffer overflow vulnerabilities and select critical exploitation paths. Existing modeling methods for vulnerability exploitation cannot accurately reflect the fine-grained execution process of stack overflow exploitation paths. This paper, based on the discussion of buffer overflow exploitation techniques, proposes a fine-grained modeling and analysis method based on Petri nets for the selection and execution of exploitation processes, specifically focusing on the return-oriented programming in stack overflow. Through qualitative analysis, we compared the simulated time of the software with the execution time of existing exploitation tools, achieving timeout-based simulation experiments. We validated the model’s effectiveness using symbolic execution and dynamic analysis techniques. The results indicate that this model performs well for vulnerable programs with Position Independent Executable (PIE) protection enabled and has an advantage in selecting exploitation paths, enabling timeout-based simulation. This method provides a reference for rapidly constructing exploitation implementations.

Analog Integrated Circuit Topology Synthesis With Deep Reinforcement Learning

This article presents a novel deep-reinforcement-learning-based method for topology synthesis of analog-integrated circuits, especially operational amplifiers (OpAmps). It behaves like a human designer, who learns from trials, derives design knowledge and experience, and evolves gradually to finally figure out optimal manners to construct proper circuit topologies that meet design specifications. Essential design rules are defined and applied to set up the specialized environment for reinforcement learning in order to reasonably construct circuit topologies with building blocks as the basic components. Our proposed method can not only handle large-size circuit designs but also generate creative circuit topologies. The produced circuit topologies are verified by the simulation-in-loop sizing. In order to improve the evaluation efficiency, hash table and symbolic analysis techniques are utilized to significantly reduce the number of the produced topologies to be sized during the synthesis process. Compared with the state-of-the-art approaches, our proposed method significantly improves the synthesis efficiency by consuming only several hours on average to produce a trustworthy solution. Our experimental results demonstrate its sound efficiency, strong reliability, and wide applicability.

Testability Evaluation in Time-Variant Circuits: A New Graphical Method

DC–DC converter fault diagnosis, executed via neural networks built by exploiting the information deriving from testability analysis, is the subject of this paper. The networks under consideration are complex valued neural networks (CVNNs), whose fundamental feature is the proper treatment of the phase and the information contained in it. In particular, a multilayer neural network based on multi-valued neurons (MLMVN) is considered. In order to effectively design the network, testability analysis is exploited. Two possible ways for executing this analysis on DC–DC converters are proposed, taking into account the single-fault hypothesis. The theoretical foundations and some applicative examples are presented. Computer programs, based on symbolic analysis techniques, are used for both the testability analysis and the neural network training phase. The obtained results are very satisfactory and demonstrate the optimal performances of the method.

Computer says no: Verdict explainability for runtime monitors using a local proof system

Monitors in Runtime Verification are often constructed as black boxes: they provide verdicts on whether a property is satisfied or violated by the executing system under scrutiny, without much explanation as to why this is the case. In the best of cases, monitors might also return the trace observed, still leaving it up to the user to figure out the logic employed to reach the declared verdict from this trace. In this paper, we propose a local proof system for Linear Temporal Logic—a popular logic used in Runtime Verification—formalising the symbolic deductions within the constraints of Runtime Verification. We prove novel soundness and partial completeness results for this proof system with respect to the original semantics of the logic. Crucially, we show how such a deductive system can be used as a realistic basis for constructing online runtime monitors that provide explanations for their verdicts; we also show the resulting monitor algorithms to satisfy pleasing correctness criteria identified by other works, such as the decidability and incrementality of the analysis and the irrevocability of verdicts. Finally, we relate the expressiveness of the Linear Temporal Logic proof system to existing symbolic analysis techniques used in Runtime Verification.

A sequential symbolic active network analysis technique using nullor elements

A sequential method of analysis of nullor-based active network is presented. The symbolic circuit analysis can be performed easily with the knowledge of properties of circuit elements including nullor elements. The practical circuit examples are given to demonstrate the feasibility of the proposed approach.

A Laplace transform approach to the simulation of DC‐DC converters

AbstractAn approach to the simulation of pulse width modulation (PWM) direct current–direct current (DC‐DC) converters operated under continuous current mode (CCM) and discontinuous current mode (DCM) is presented. It is based on the use of the Laplace transform and of dedicated models for controlled switches and diodes. Time‐domain waveforms are obtained from network functions representing the circuit under analysis without assuming small‐signal approximation. A program implementing the proposed approach has been also developed by exploiting symbolic analysis techniques. Because of its symbolic nature, it can profitably support numerical simulators in design optimization phase. Its characteristics and potentialities are shown through examples and experimental tests.

Symbolic analysis of electric networks with higher order summative cofactors and parameter decision diagrams

SummaryThe paper introduces the concept of higher order summative cofactors (HOSCs) to the circuit analysis. Although the concept is not new, it is not well known. In the paper, some mathematical background of HOSCs is presented. The further development of the concept of HOSC will yield computer implementation arithmetic of HOSC. A cancellation‐free symbolic analysis technique, which is based on HOSC arithmetic, is presented. This technique allows results to be created directly from a netlist in the form of a binary decision diagram, which is called a parameter decision diagram. Additionally, HOSC arithmetic allows the calculation to be started in many places (sometimes distant) simultaneously. The techniques of rolling up the already analyzed parts of a circuit, which is built into HOSC arithmetic, result in a novel multilevel hierarchical analysis method that is called hierarchical parameter decision diagram (HPDD). Unlike in most hierarchical methods, the results that are obtained based on the subcircuit representation in HPDD always maintain a cancellation‐free form. The HPDD always represents the sum of the product form, which is heavily compressed due to the self‐similarities of the actual circuit. The time that is required for any recalculation of the transfer functions is greatly reduced. Analysis of models that are based on pathological components is also a natural consequence of using HOSC arithmetic.

Debugging Multithreaded Programs as if They Were Sequential

Debugging multithread programs is extremely difficult because the basic assumption that underlies sequential program debugging, that is, the program behavior is deterministic under a fixed input, is no longer valid due to the nondeterminism attributed to thread scheduling. It is because the programs behavior is non-deterministic due to the nondeterminism of parallel execution, which makes debugging or testing multithreaded programs extremely difficult. In this paper, we propose a proactive debugging method to restore this basic assumption so that programmers can debug multithreaded programs as if they were sequential. Our approach is based on the synergistic integration of symbolic analysis and dynamic analysis techniques. In particular, symbolic analysis investigates the program behavior under the same input to search whether there is a thread schedule would trigger a bug or a not-yet-explored path. Dynamic analysis is to execute these new paths with the guide of the generated thread schedules, thereby further guiding the symbolic analysis. The net effect of applying this feedback loop is a systematic and complete coverage of the program behavior under a fixed test input. We implement the proposed approach in a prototype tool called proactive-debugger. Our experiments show that proactive-debugger outperforms both ESBMC and Maple, which are two powerful and well-known testing tools for failure detection in multithreaded programs.

Proof assisted bounded and unbounded symbolic model checking of software and system models

We have implemented various symbolic model checking algorithms, such as BMC, k-Induction and IC3 for B, Event-B and other modeling languages. The high-level nature of software models accounts for complicated constraints arising in these symbolic analysis techniques. In this article we suggest using static information stemming from proof obligations to simplify occurring constraints. We show how to include proof information in the aforementioned algorithms. Using different benchmarks we compare explicit state to symbolic model checking as well as techniques with and without proof assistance. In particular for models with large branching factor, e.g., due to complicated data values being manipulated, the symbolic techniques fare much better than explicit state model checking. The inclusion of proof information results in further performance improvements. • We implemented bounded model checking, k-Induction and IC3 for B and Event-B. • We show how to use static information from proof attempts to improve performance. • We benchmark against ProB's explicit state model checker. • We discuss applicability to other formalisms such as TLA + and Z.

PCB Defect Detection using Computer Vision based Symbolic Pattern Analysis Technique

PCB Defect Detection using Computer Vision based Symbolic Pattern Analysis Technique

Symbolic Time-Series Analysis of Gas Turbine Gas Path Electrostatic Monitoring Data

The aero-engine gas-path electrostatic monitoring system is capable of providing early warning of impending gas-path component faults. In the presented work, a method is proposed to acquire signal sample under a specific operating condition for on-line fault detection. The symbolic time-series analysis (STSA) method is adopted for the analysis of signal sample. Advantages of the proposed method include its efficiency in numerical computations and being less sensitive to measurement noise, which is suitable for in situ engine health monitoring application. A case study is carried out on a data set acquired during a turbojet engine reliability test program. It is found that the proposed symbolic analysis techniques can be used to characterize the statistical patterns presented in the gas path electrostatic monitoring data (GPEMD) for different health conditions. The proposed anomaly measure, i.e., the relative entropy derived from the statistical patterns, is confirmed to be able to indicate the gas path components faults. Finally, the further research task and direction are discussed.

Classification of heart rate signals of healthy and pathological subjects using threshold based symbolic entropy.

The dynamical fluctuations of biological signals provide a unique window to construe the underlying mechanism of the biological systems in health and disease. Recent research evidences suggest that a wide class of diseases appear to degrade the biological complexity and adaptive capacity of the system. Heart rate signals are one of the most important biological signals that have widely been investigated during the last two and half decades. Recent studies suggested that heart rate signals fluctuate in a complex manner. Various entropy based complexity analysis measures have been developed for quantifying the valuable information that may be helpful for clinical monitoring and for early intervention. This study is focused on determining HRV dynamics to distinguish healthy subjects from patients with certain cardiac problems using symbolic time series analysis technique. For that purpose, we have employed recently developed threshold based symbolic entropy to cardiac inter-beat interval time series of healthy, congestive heart failure and atrial fibrillation subjects. Normalized Corrected Shannon Entropy (NCSE) was used to quantify the dynamics of heart rate signals by continuously varying threshold values. A rule based classifier was implemented for classification of different groups by selecting threshold values for the optimal separation. The findings indicated that there is reduction in the complexity of pathological subjects as compared to healthy ones at wide range of threshold values. The results also demonstrated that complexity decreased with disease severity.

Chimera

Chimera uses a new hybrid program analysis to provide deterministic replay for commodity multiprocessor systems. Chimera leverages the insight that it is easy to provide deterministic multiprocessor replay for data-race-free programs (one can just record non-deterministic inputs and the order of synchronization operations), so if we can somehow transform an arbitrary program to be data-race-free, then we can provide deterministic replay cheaply for that program. To perform this transformation, Chimera uses a sound static data-race detector to find all potential data-races. It then instruments pairs of potentially racing instructions with a weak-lock, which provides sufficient guarantees to allow deterministic replay but does not guarantee mutual exclusion. Unsurprisingly, a large fraction of data-races found by the static tool are false data-races, and instrumenting them each of them with a weak-lock results in prohibitively high overhead. Chimera drastically reduces this cost from 53x to 1.39x by increasing the granularity of weak-locks without significantly compromising on parallelism. This is achieved by employing a combination of profiling and symbolic analysis techniques that target the sources of imprecision in the static data-race detector. We find that performance overhead for deterministic recording is 2.4% on average for Apache and desktop applications and about 86% for scientific applications.

RELATIONAL STRING VERIFICATION USING MULTI-TRACK AUTOMATA

Verification of string manipulation operations is a crucial problem in computer security. In this paper, we present a new relational string verification technique based on multi-track automata. Our approach is capable of verifying properties that depend on relations among string variables. This enables us to prove that vulnerabilities that result from improper string manipulation do not exist in a given program. Our main contributions in this paper can be summarized as follows: (1) We formally characterize the string verification problem as the reachability analysis of string systems and show decidability/undecidability results for several string analysis problems. (2) We develop a sound symbolic analysis technique for string verification that over-approximates the reachable states of a given string system using multi-track automata and summarization. (3) We evaluate the presented techniques with respect to several string analysis benchmarks extracted from real web applications.

Principal component analysis with interval imputed missing values

In this paper some statistical properties of Interval Imputation are derived in the context of Principal Component Analysis. Interval Imputation is a recent proposal for the treatment of missing values, consisting of replacing blanks with intervals and then analyzing the resulting data matrix using Symbolic Data Analysis techniques. The most noticeable virtue of this method is that it does not require a single-valued imputation, so it allows us to take into account that incomplete observations are affected by a degree of uncertainty. Illustrative examples and simulation studies are carried out in order to illustrate the functioning of the technique.

Symbolic missing data imputation in principal component analysis

AbstractThe concept of symbolic data has been developed with the aim of representing variables whose measurement is affected by some internal variation. This idea has been mainly concerned with the need of aggregating individuals in order to summarize large datasets into smaller matrices of manageable size, retaining as much of the original knowledge as possible. Nevertheless it is often applied also with variables structured from their outset as symbolic variables, although measured on single individuals. This paper deals with the latter framework, and aims at showing that symbolic data analysis techniques can be applied to the field of missing values treatment. The algorithm for a symbolic imputation technique in principal component analysis is presented as a generalization of the basic strategy called interval imputation. An illustrative example and a real data case study show how the proposed technique works. © 2011 Wiley Periodicals, Inc. Statistical Analysis and Data Mining 4: 171–183, 2011

Multivariable Approach to Dynamic ECG Classification

AbstractThe first step towards a heart attack is a condition called Ventricular Arrhythmia. This paper proposes a system that uses the advanced digital signal processing techniques to analyse electrocardiogram (ECG) signals and recognise the Arrhythmia condition. In addition, proposed method can differentiate the more dangerous condition, Ventricular Arrhythmia from a simple Arrhythmia. The proposed technique combines the classical ECG signal parameters (e.g. Heart Rate Variability) with the standard statistical signal parameters, nonlinear parameters used in the fields of Chaos Theory and parameters obtained using Symbolic Analysis techniques. Linear Discriminant Analysis (LDA) is employed in order to reduce the size of ECG parameter set and is followed by a clustering algorithm.

Web-Based Trainer for Electrical Circuit Analysis

A Web-based system for training electric circuit analysis is presented in this paper. It is centered on symbolic analysis techniques and it not only verifies the student's final answer, but it also tracks and coaches him/her through all steps of his/her reasoning path. The system mimics homework assignments, enhanced by immediate personalized feedback. Evaluation data based upon a first trial indicate that this tool is a useful complement to the traditional training approach.

SYMBOLIC EXPRESSION ANALYSIS FOR COMPILED COMMUNICATION

Compiled communication can benefit the parallel application design and performance in several ways such as analyzing the communication pattern to optimize a configurable network for performance improvement or to visualize the communication requirements to study and improve the application design. In this article we present symbolic expression analysis techniques in a MPI parallel compiler. Symbolic expression analysis allows the identification and representation of the communication pattern and also assists in the determination of communication phases in MPI parallel applications at compile-time. We demonstrate that using compiler analysis based on symbolic expression analysis to determine the communication pattern can provide an accurate visualization of the communication requirements. Using information from the compiler to program a circuit switching interconnect in multiprocessor systems has the potential to achieve more efficient communication with lower cost compared to packet/wormhole switching. For example, we demonstrate that our compiler approach provides an average of 2.6 times improvement in message delay over a threshold-based runtime system for our benchmarks with a maximum improvement of 9.7 times.

A method for acceptability region representation in analogue linear networks

AbstractA new simple approach to acceptability region representation in analogue linear circuit design is presented. The proposed method is also able to characterize non‐convex and disjoint acceptability regions with low computational effort. In fact, the developed procedure is based on the use of symbolic analysis techniques, which permit one to perform only one simulation of the circuit under consideration, thus reducing the computational efforts. The theoretical basis and the algorithm implementing the technique are presented. A circuital example is also included. Copyright © 2008 John Wiley & Sons, Ltd.