Collaborative Research: SHF: Medium: Precise Static Analysis of Event-based Systems

合作研究：SHF：中：基于事件的系统的精确静态分析

• 批准号: 2106710
• 负责人: Iulian Neamtiu
• 金额: $ 60万
• 依托单位: New Jersey Institute of Technology
• 依托单位国家: 美国
• 项目类别: Standard Grant
• 财政年份: 2021
• 资助国家: 美国
• 起止时间: 2021-10-01 至 2025-09-30
• 项目状态: 未结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=2106710&HistoricalAwards=false
• 关键词: Collaborative; Research; SHF; Medium; Precise

Event-based programming is used to construct software systems withbillions of users, including mobile apps, Web clients and servers, andInternet-of-Things devices. Despite their popularity, event-basedsystems are poorly understood and prone to errors because theunderlying platform, not the program, generates and invokesevents. These difficulties have wide-ranging consequences such aslosing users' work in mobile apps, silent errors or downtime in Webservices, and unexpected Internet-of-Things device behavior. Thisproject is (1) making event-based systems easier to analyze, (2)constructing an approach for extracting order between certain key eventsbefore the program runs, to prevent ordering errors, and (3) allowingrigorous reasoning about event-induced volatility, to prevent errorssuch as state loss and state inconsistency. The project isintroducing students to new approaches to event-based systemreliability, as well as providing researchers and software developerswith models and infrastructure for analyzing such systems. End-usersare expected to benefit from more reliable event-based systems, whether mobile,browser/server, or Internet-of-Things. The project is increasing theparticipation of underrepresented groups in computing via outreach,mentoring, and research involvement.Event-based systems continue to surge in popularity. The relativenovelty of this paradigm, coupled with essential programmingdifficulties (such as non-deterministic event processing, asynchronousstate manipulation, and state destruction) complicate the constructionof robust, reliable applications. Furthermore, there is a shortage ofprogram-analysis approaches and tools for this space. To address theseissues, this project is introducing program-analysis foundations andpractical tools such as event sensitivity, making eventcreation/initiation a first-class object of program analysis, andallowing precise analysis via path-based event ordering. The projectis intended to result in: static analyses that incorporate the aforementionedadvances, enabling analysis of event-based applications; as well asautomatically-constructed platform models (which addressdeficiencies in current, manual/ad-hoc platform models, and are intended to beusable in other contexts, e.g., to facilitate programunderstanding). The project is targeting the Android mobile platform,JavaScript client and server programs, as well as Internet-of-Thingsapplications. Using these tools, developers and researchers areable to gain effective insights into event-based applicationsfacilitating the construction of reliable applications as well asexposing incorrect behavior in existing programs; this, in turn isbenefiting event-based ecosystems' users.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.

基于事件的编程用于构建具有额外用户的软件系统，包括移动应用程序，Web客户端和服务器，以及THINSET-of-THINGS设备。尽管它们很受欢迎，但基于事件的系统还是很容易理解，并且容易出现错误，因为否则平台而不是程序生成和调用。这些困难带来了广泛的后果，例如在移动应用程序中的用户工作，无声错误或网站服务中的停机时间以及意外的设备行为。该项目是（1）使基于事件的系统更易于分析，（2）在程序运行之前构建一种在某些关键事件之间提取顺序的方法，以防止订购错误，（3）允许有关事件引起的波动性的理论推理，以防止错误作为州损失和州损失。 该项目将学生介绍了基于事件的系统可靠性的新方法，并为研究人员和软件开发人员提供了与模型和基础架构一起分析此类系统的方法。最终用户预计将受益于更可靠的基于事件的系统，无论是移动，浏览器/服务器还是图像互联网。 该项目正在增加通过外展，指导和研究参与计算中代表性不足的群体的参与。基于现实的系统继续受到欢迎。 这种范式的依据，再加上必不可少的编程缺陷（例如非确定性事件处理，异步性的操纵和国家破坏）使对可靠，可靠的应用的构建变得复杂。 此外，对于此空间，缺乏程序分析方法和工具。为了解决这些问题，该项目正在介绍程序分析基础和实践工具，例如事件敏感性，使事件创建/启动成为程序分析的一流对象，并通过基于路径的事件订购来享受精确的分析。该项目的目的是导致：静态分析，这些分析纳入了上述内容，从而可以对基于事件的应用程序进行分析；以及根据当前，手动/临时平台模型的构建平台模型（这些平台模型，它们都可以在其他情况下进行求助，例如，以促进programeStanding）。该项目针对的是Android移动平台，JavaScript客户端和服务器程序以及ThingSapplications。开发人员和研究人员使用这些工具，以有效地了解基于事件的应用程序，从而在现有程序中构建可靠的应用程序以及暴露不正确的行为；这反过来又是基于事件的生态系统的用户。该奖项反映了NSF的法定任务，并被认为是值得通过基金会的知识分子优点和更广泛的影响审查标准通过评估来支持的。

项目成果

Detecting Potential User-data Save & Export Losses due to Android App Termination

• DOI: 10.1109/ast58925.2023.00019
• 发表时间: 2023-05
• 期刊: 2023 IEEE/ACM International Conference on Automation of Software Test (AST)
• 作者: Sydur Rahaman;Umar Farooq;Iulian Neamtiu;Zhijia Zhao