Scalable and Precise Program Analysis for Modern Software Systems

现代软件系统的可扩展且精确的程序分析

• 批准号: RGPIN-2017-05070
• 负责人: Ali, Karim
• 金额: $ 3.64万
• 依托单位: University of Alberta
• 依托单位国家: 加拿大
• 项目类别: Discovery Grants Program - Individual
• 财政年份: 2022
• 资助国家: 加拿大
• 起止时间: 2022-01-01 至 2023-12-31
• 项目状态: 已结题
• 来源: https://www.nserc-crsng.gc.ca/ase-oro/Details-Detailles_eng.asp?id=750484
• 关键词: Scalable; Precise; Program; Analysis; Modern

Program-analysis tools can help detect, and possibly fix, many software bugs. However, empirical research has shown that, in practice, software developers refrain from using most program-analysis tools, because the tools do not scale to modern software systems, report many false positives, or disrupt the workflow of developers.Many of the complaints that software developers have made about program-analysis tools are due to the underlying impractical assumptions that these tools make. In particular, for ultra-large-scale software systems, it is not feasible to analyze the whole program. Additionally, modern software systems are built on top of many libraries that are hard to analyze precisely, because they exhibit complicated dependencies between the application code and the library code.The proposed research aims at discovering a comprehensive solution to scaling precise program analysis to modern software systems through two main research activities: (1) developing a pragmatic approach to construct abstractions of existing libraries and frameworks that make them more amenable to program analysis, and (2) devising a proactive approach to create library abstractions during the development process of the library.The findings of the proposed research will be useful for both researchers and software developers. The proposed partial-program analyses will enable researchers to explore analyses for ultra-large-scale frameworks and modern software systems. They will also enable wider deployment of program-analysis tools in real-world settings, which helps software developers detect software bugs and security vulnerabilities as early as possible in the development process. Early detection of software bugs will improve the overall productivity of software developers using these tools, and help software companies, such as BioWare, save billions of dollars that are lost due to software failures every year.

程序 - 分析工具可以帮助检测许多软件错误并可能修复。但是，经验研究表明，在实践中，软件开发人员避免使用大多数程序分析工具，因为这些工具没有扩展到现代软件系统，报告许多误报或破坏开发人员的工作流程。软件开发人员对程序 - 分析工具所做的投诉是由于这些工具所造成的，因此这些工具是由于这些工具所造成的。特别是，对于超大规模的软件系统，分析整个程序是不可行的。此外，现代软件系统建立在许多很难准确分析的图书馆之上，因为它们在申请代码和图书馆代码之间表现出复杂的依赖性。拟议的研究旨在通过两种主要研究活动来发现一个全面的解决方案，以将精确的程序分析缩放到现代软件系统中，以通过两种主要的研究方法来构建现有的A型和框架的摘要（1）将其构造出来的摘要（它们），这些方法是对现有框架进行摘要（它们）的摘要（构建框架），该方法的摘要（它们）是绘制的，这些方法是构建了摘要的（它们），并将其摘要（构造）摘要（它们），并将其绘制为摘要（构建框架），并且是AMEN的（AMEN），该方法（在图书馆的开发过程中创建图书馆摘要。拟议研究的发现将对研究人员和软件开发人员都有用。拟议的部分程序分析将使研究人员能够探索对超大规模框架和现代软件系统的分析。他们还将在实际设置中更广泛地部署程序分析工具，该工具可以帮助软件开发人员尽早在开发过程中检测到软件错误和安全漏洞。早期检测软件错误将使用这些工具提高软件开发人员的整体生产率，并帮助软件公司（例如Bioware）节省数十亿美元由于软件失败而损失的数十亿美元。