SHF: Small: Collaborative Research: Towards Automated Model Synthesis of Library and System Functions for Program-Environment Co-Analysis

SHF：小型：协作研究：面向程序-环境协同分析的库和系统功能的自动模型综合

• 批准号: 1320326
• 负责人: Xiangyu Zhang
• 金额: $ 15万
• 依托单位: Purdue University
• 依托单位国家: 美国
• 项目类别: Standard Grant
• 财政年份: 2013
• 资助国家: 美国
• 起止时间: 2013-09-01 至 2016-08-31
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=1320326&HistoricalAwards=false
• 关键词: SHF; Small; Collaborative; Research; Towards

The rapid advance of program analysis greatly benefits many applications, including security vulnerability detection, software fault localization, performance optimization, to name a few. However, handling library functions and system calls (also referred to as environmental functions) presents a pervasive and critical challenge in program analysis. Even though these environmental functions are not written by developers, they are an intrinsic part of program semantics and consequently it would be ideal for a program analysis to co-analyze the program and its execution environment. Despite its importance, achieving program-environment co-analysis in practice is challenging. First, the difficulty to acquire the source code of some environmental functions precludes source code based analysis. Moreover, even if source code is available, the code base is often prohibitively large and complex, making analysis difficult.In this project, the goal is to develop a highly automated technique that can construct models for environmental functions from their binary implementations and a set of initial inputs. The models are essentially programs that provide the same functionality of the functions being modeled, yet substantially simplified. Such programs can be included as part of the application, enabling program-environment co-analysis. The proposed technique will lead to a highly automated solution that will largely offload the onus of manually crafting models from program analysis developers' shoulders. Moreover, it will make program environment co-analysis feasible and more precise, enabling detection of security vulnerability and software defects that are otherwise undetectable. Additionally, the PIs expect the proposed research to foster learnings in both program analysis and operating systems, as well as providing many opportunities to incorporate findings to relevant courses in computer science.

程序分析的快速发展使许多应用受益匪浅，包括安全漏洞检测、软件故障定位、性能优化等。然而，处理库函数和系统调用（也称为环境函数）在程序分析中提出了普遍且关键的挑战。尽管这些环境函数不是由开发人员编写的，但它们是程序语义的固有部分，因此对于程序分析来说，共同分析程序及其执行环境是理想的。尽管它很重要，但在实践中实现程序-环境协同分析仍然具有挑战性。首先，某些环境函数的源代码获取困难，阻碍了基于源代码的分析。此外，即使源代码可用，代码库通常又大又复杂，使得分析变得困难。在这个项目中，目标是开发一种高度自动化的技术，可以从环境函数的二进制实现和集合中构建环境函数的模型。初始输入。这些模型本质上是提供与正在建模的功能相同的功能的程序，但大大简化了。此类程序可以作为应用程序的一部分包含在内，从而实现程序-环境协同分析。所提出的技术将带来一种高度自动化的解决方案，该解决方案将在很大程度上减轻程序分析开发人员手动构建模型的负担。此外，它将使程序环境协同分析变得可行且更加精确，从而能够检测到原本无法检测到的安全漏洞和软件缺陷。此外，PI 期望拟议的研究能够促进程序分析和操作系统方面的学习，并提供许多机会将研究结果纳入计算机科学的相关课程。