SHF: Small: Automatic Exploration and Analysis of Software Performance Responses

SHF：小型：软件性能响应的自动探索和分析

• 批准号: 1908870
• 负责人: Koushik Sen
• 金额: $ 50万
• 依托单位: University of California-Berkeley
• 依托单位国家: 美国
• 项目类别: Standard Grant
• 财政年份: 2019
• 资助国家: 美国
• 起止时间: 2019-10-01 至 2023-09-30
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=1908870&HistoricalAwards=false
• 关键词: SHF; Small; Automatic; Exploration; Analysis

Performance issues in software systems often result in negative user experience, highly publicized commercial failures, substantial monetary penalties, and even abandonment of multi-million dollar projects. Performance issues can cause a software system to run for an unexpectedly long time, or use an incredibly large amount of computer memory, potentially stalling the computer. Performance issues are often input-dependent, occurring only when the software is run with certain specific inputs. If malicious attackers find out the inputs on which programs have performance issues, they can force these inputs on the program and cause vital software systems to go down or become unavailable (i.e., a kind of denial-of-service attack). This project's goal is to build tools which can automatically identify the inputs on which a given software system has serious performance issues. These tools can then be used by programmers to identify performance issues in software before the software is vulnerable to attackers or deployed to the public. Successful completion of this project will help programmers identify and fix software performance issues early, thus increasing the efficiency, reliability, and security of software.A large body of research has focused on diagnosing performance problems by analyzing dynamically collected performance profiles. Almost all of these techniques assume the availability of test inputs for performance profiling. This project proposes to develop techniques to discover potential performance issues in real-world software systems automatically. Whole-system analysis, which is necessary for such input generation, does not scale for real-world software systems. The project addresses this scalability challenge in phases: a top-down approach to identify components that may have performance bottlenecks, a sophisticated exploration and generalization technique to learn worst-case behavior patterns, and a bottom-up approach for creating a performance-degrading input for the entire program. The technique will also create a performance regression test suite for a software system under test using a novel performance-coverage metric developed as part of the project.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.

软件系统中的性能问题通常会导致负面的用户体验、广为人知的商业失败、巨额罚款，甚至放弃数百万美元的项目。 性能问题可能会导致软件系统运行意外长时间，或使用大量计算机内存，从而可能导致计算机停止运行。 性能问题通常与输入相关，仅当软件使用某些特定输入运行时才会出现。 如果恶意攻击者发现程序存在性能问题的输入，他们可以在程序上强制这些输入，并导致重要的软件系统停机或变得不可用（即，一种拒绝服务攻击）。 该项目的目标是构建能够自动识别给定软件系统存在严重性能问题的输入的工具。 然后，程序员可以使用这些工具在软件容易受到攻击者攻击或部署到公众之前识别软件中的性能问题。 该项目的成功完成将帮助程序员及早识别和修复软件性能问题，从而提高软件的效率、可靠性和安全性。大量研究集中在通过分析动态收集的性能配置文件来诊断性能问题。 几乎所有这些技术都假设性能分析的测试输入可用。 该项目建议开发技术来自动发现现实软件系统中潜在的性能问题。 这种输入生成所必需的全系统分析无法适应现实世界的软件系统。 该项目分阶段解决了这一可扩展性挑战：采用自上而下的方法来识别可能存在性能瓶颈的组件，采用复杂的探索和泛化技术来学习最坏情况的行为模式，以及采用自下而上的方法来创建性能下降的输入对于整个程序。 该技术还将使用作为项目一部分开发的新颖的性能覆盖指标，为被测软件系统创建性能回归测试套件。该奖项反映了 NSF 的法定使命，并通过使用基金会的智力价值进行评估，被认为值得支持。以及更广泛的影响审查标准。

项目成果

Growing A Test Corpus with Bonsai Fuzzing

使用盆景模糊测试开发测试语料库

• DOI: 10.1109/icse43902.2021.00072
• 发表时间: 2021-05
• 期刊: 43rd IEEE/ACM International Conference on Software Engineering
• 作者: Vikram, Vasudev;Padhye, Rohan;Sen, Koushik
• 通讯作者: Sen, Koushik

ObliCheck: Efficient Verification of Oblivious Algorithms with Unobservable State

ObliCheck：具有不可观察状态的 Oblivious 算法的高效验证

• 发表时间: 2021-10
• 期刊: 30th USENIX Security Symposium
• 作者: Son, Jeongseok;Prechter, Griffin;Poddar, Rishabh;Popa, Raluca Ada;Sen, Koushik
• 通讯作者: Sen, Koushik

Saffron: Adaptive Grammar-based Fuzzing for Worst-Case Analysis

Saffron：基于自适应语法的最坏情况分析模糊测试

• DOI: 10.1145/3364452.3364455
• 发表时间: 2019-12-12
• 期刊: ACM SIGSOFT Software Engineering Notes
• 作者: X. Le;C. Păsăreanu;Rohan Padhye;David Lo;W. Visser;Koushik Sen
• 通讯作者: Koushik Sen

VizSmith: Automated Visualization Synthesis by Mining Data-Science Notebooks

VizSmith：通过挖掘数据科学笔记本进行自动可视化合成

• DOI: 10.1109/ase51524.2021.9678696
• 发表时间: 2021-11
• 期刊: 10.1109/ASE51524.2021
• 作者: Bavishi, Rohan;Laddad, Shadaj;Yoshida, Hiroaki;Prasad, Mukul R.;Sen, Koushik
• 通讯作者: Sen, Koushik

FuzzFactory: domain-specific fuzzing with waypoints

FuzzFactory：使用路径点进行特定领域的模糊测试

• DOI: 10.1145/3360600
• 发表时间: 2019-10
• 期刊: Proceedings of the ACM on Programming Languages
• 作者: Padhye, Rohan;Lemieux, Caroline;Sen, Koushik;Simon, Laurent;Vijayakumar, Hayawardh
• 通讯作者: Vijayakumar, Hayawardh