Skip to main content
SpringerLink
Log in

Model-Checking Software Library API Usage Rules

  • Conference paper
Integrated Formal Methods (IFM 2013)

Part of the book series: Lecture Notes in Computer Science ((LNPSE,volume 7940))

Included in the following conference series:

Abstract

Modern software increasingly relies on using libraries which are accessed via Application Programming Interfaces (APIs). Libraries usually impose constraints on how API functions can be used (API usage rules) and programmers have to obey these API usage rules. However, API usage rules often are not well-documented or documented informally. In this work, we show how to use the SCTPL logic to precisely specify API usage rules in libraries, where SCTPL can be seen as an extension of the branching-time temporal logic CTL with variables, quantifiers, and predicates over the stack. This allows library providers to formally describe API usage rules without knowing how their libraries will be used by programmers. We also propose an approach to automatically check whether programs using libraries violate or not the corresponding API usage rules. Our approach consists in modeling programs as pushdown systems (PDSs), and checking API usage rules on programs using SCTPL model checking for PDSs. To make the model-checking procedure more efficient, we propose an abstraction that reduces drastically the size of the program model. Moreover, we characterize a sub-logic rSCTPL of SCTPL preserved by the abstraction. rSCTPL is sufficient to precisely specify all the API usage rules we met. We implemented our techniques in a tool and applied it to check several API usage rules. Our tool detected several previously unknown errors in well-known programs, such as Nssl, Verbs, Acacia+, Walksat and Getafix. Our experimental results are encouraging.

Work partially funded by ANR grant ANR-08-SEGI-006.

This is a preview of subscription content, log in via an institution to check access.

Access this chapter

Log in via an institution
Chapter
USD 29.95
Price excludes VAT (USA)
  • Available as PDF
  • Read on any device
  • Instant download
  • Own it forever
eBook
USD 39.99
Price excludes VAT (USA)
  • Available as PDF
  • Read on any device
  • Instant download
  • Own it forever
Softcover Book
USD 54.99
Price excludes VAT (USA)
  • Compact, lightweight edition
  • Dispatched in 3 to 5 business days
  • Free shipping worldwide - see info

Tax calculation will be finalised at checkout

Purchases are for personal use only

Institutional subscriptions

Preview

Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.

References

  1. Acacia+, http://lit2.ulb.ac.be/acaciaplus/

  2. elastic, http://www.ulb.ac.be/di/ssd/madewulf/aasap/

  3. Getafix, http://www.cs.uiuc.edu/madhu/getafix/

  4. Mckit, http://www.fmi.uni-stuttgart.de/szs/tools/mckit/

  5. Minisat, C.: language version, http://minisat.se/MiniSat.html

  6. Mist2, http://software.imdea.org/pierreganty/software.html

  7. Moped, http://www.fmi.uni-stuttgart.de/szs/tools/moped/

  8. Tspass, http://www.csc.liv.ac.uk/michel/software/tspass/

  9. Ubcsat, http://ubcsat.dtompkins.com/

  10. Verbs, http://lcs.ios.ac.cn/zwh/verbs/index.html

  11. Walksat, version 35, http://www.cs.rochester.edu/kautz/walksat/

  12. SourceForge (2012), http://sourceforge.net

  13. Acharya, M., Xie, T.: Mining API error-handling specifications from source code. In: Chechik, M., Wirsing, M. (eds.) FASE 2009. LNCS, vol. 5503, pp. 370–384. Springer, Heidelberg (2009)

    Chapter  Google Scholar 

  14. Acharya, M., Xie, T., Pei, J., Xu, J.: Mining API patterns as partial orders from source code: From usage scenarios to specifications. In: ESEC/FSE 2007 (2007)

    Google Scholar 

  15. Ammons, G., Bodík, R., Larus, J.R.: Mining specifications. In: POPL (2002)

    Google Scholar 

  16. Besson, F., Jensen, T.P., Métayer, D.L.: Model checking security properties of control flow graphs. Journal of Computer Security (2001)

    Google Scholar 

  17. Beyer, D., Henzinger, T.A., Jhala, R., Majumdar, R.: The software model checker BLAST. In: STTT (2007)

    Google Scholar 

  18. Chaki, S., Clarke, E.M., Groce, A., Jha, S., Veith, H.: Modular verification of software components in C. IEEE Trans. Software Eng. 30(6) (2004)

    Google Scholar 

  19. Chen, F., Roşu, G.: Mining parametric state-based specifications from executions. Technical report (2008)

    Google Scholar 

  20. Chen, H., Dean, D., Wagner, D.: Model checking one million lines of C code. In: NDSS (2004)

    Google Scholar 

  21. Chen, H., Wagner, D.: Mops: an infrastructure for examining security properties of software. In: ACM Conference on Computer and Communications Security (2002)

    Google Scholar 

  22. Dallmeier, V., Lindig, C., Wasylkowski, A., Zeller, A.: Mining object behavior with ADABU. In: WODA (2006)

    Google Scholar 

  23. Esparza, J., Hansel, D., Rossmanith, P., Schwoon, S.: Efficient algorithm for model checking pushdown systems. In: Emerson, E.A., Sistla, A.P. (eds.) CAV 2000. LNCS, vol. 1855, Springer, Heidelberg (2000)

    Chapter  Google Scholar 

  24. Fähndrich, M., Logozzo, F.: Static contract checking with abstract interpretation. In: Beckert, B., Marché, C. (eds.) FoVeOOS 2010. LNCS, vol. 6528, pp. 10–30. Springer, Heidelberg (2011)

    Chapter  Google Scholar 

  25. Gabel, M., Su, Z.: Javert: fully automatic mining of general temporal properties from dynamic traces. In: FSE (2008)

    Google Scholar 

  26. Gabel, M., Su, Z.: Symbolic mining of temporal specifications. In: ICSE (2008)

    Google Scholar 

  27. Godefroid, P.: Software model checking: The Verisoft approach. Formal Methods in System Design 26 (2005)

    Google Scholar 

  28. Henzinger, T.A., Jhala, R., Majumdar, R.: Permissive interfaces. In: ESEC/SIGSOFT FSE (2005)

    Google Scholar 

  29. Kinder, J., Katzenbeisser, S., Schallhart, C., Veith, H.: Detecting malicious code by model checking. In: Julisch, K., Kruegel, C. (eds.) DIMVA 2005. LNCS, vol. 3548, pp. 174–187. Springer, Heidelberg (2005)

    Chapter  Google Scholar 

  30. Kremenek, T., Twohey, P., Back, G., Ng, A.Y., Engler, D.R.: From uncertainty to belief: Inferring the specification within. In: OSDI (2006)

    Google Scholar 

  31. Kroening, D.: CBMC (2012), http://www.cprover.org/cbmc

  32. Liu, C., Ye, E., Richardson, D.J.: Software library usage pattern extraction using a software model checker. In: ASE (2006)

    Google Scholar 

  33. Lo, D., Khoo, S.-C.: SMArTIC: towards building an accurate, robust and scalable specification miner. In: FSE 2006 (2006)

    Google Scholar 

  34. Lo, D., Ramalingam, G., Ranganath, V.P., Vaswani, K.: Mining quantified temporal rules: Formalism, algorithms, and evaluation. In: WCRE (2009)

    Google Scholar 

  35. Lorenzoli, D., Mariani, L., Pezzè, M.: Automatic generation of software behavioral models. In: ICSE 2008 (2008)

    Google Scholar 

  36. Ramanathan, M.K., Grama, A., Jagannathan, S.: Static specification inference using predicate mining. In: PLDI (2007)

    Google Scholar 

  37. Seshadri, P.: Generic Socket Programming tutorial (2008), http://www.prasannatech.net/2008/07/socket-programming-tutorial.html

  38. Shoham, S., Yahav, E., Fink, S.J., Pistoia, M.: Static specification mining using automata-based abstractions. IEEE Trans. Software Eng. (2008)

    Google Scholar 

  39. Song, F., Touili, T.: Efficient CTL model-checking for pushdown systems. In: Katoen, J.-P., König, B. (eds.) CONCUR 2011. LNCS, vol. 6901, pp. 434–449. Springer, Heidelberg (2011)

    Chapter  Google Scholar 

  40. Song, F., Touili, T.: Efficient malware detection using model-checking. In: Giannakopoulou, D., Méry, D. (eds.) FM 2012. LNCS, vol. 7436, pp. 418–433. Springer, Heidelberg (2012)

    Chapter  Google Scholar 

  41. Song, F., Touili, T.: Pushdown model checking for malware detection. In: Flanagan, C., König, B. (eds.) TACAS 2012. LNCS, vol. 7214, pp. 110–125. Springer, Heidelberg (2012)

    Chapter  Google Scholar 

  42. Visser, W., Havelund, K., Brat, G.P., Park, S., Lerda, F.: Model checking programs. Autom. Softw. Eng. (2003)

    Google Scholar 

  43. Visser, W., Mehlitz, P.C.: Model checking programs with java pathFinder. In: Godefroid, P. (ed.) SPIN 2005. LNCS, vol. 3639, pp. 27–27. Springer, Heidelberg (2005)

    Chapter  Google Scholar 

  44. Wasylkowski, A., Zeller, A.: Mining temporal specifications from object usage. Autom. Softw. Eng. (2011)

    Google Scholar 

  45. Wasylkowski, A., Zeller, A., Lindig, C.: Detecting object usage anomalies. In: ESEC/FSE (2007)

    Google Scholar 

  46. Witkowski, T., Blanc, N., Kroening, D., Weissenbacher, G.: Model checking concurrent linux device drivers. In: ASE (2007)

    Google Scholar 

  47. Yang, J., Evans, D., Bhardwaj, D., Bhat, T., Das, M.: Perracotta: mining temporal API rules from imperfect traces. In: ICSE (2006)

    Google Scholar 

Download references

Author information

Authors and Affiliations

  1. LIAFA, CNRS and Univ. Paris Diderot, France

    Fu Song & Tayssir Touili

Authors
  1. Fu Song
    View author publications

    You can also search for this author in PubMed Google Scholar

  2. Tayssir Touili
    View author publications

    You can also search for this author in PubMed Google Scholar

Editor information

Editors and Affiliations

  1. Department of Informatics, University of Oslo, P.O. Box 1080, 0316, Oslo, Norway

    Einar Broch Johnsen

  2. Department of Information Technologies, Åbo Akademi University, Joukahaisenkatu 3-5A, 20520, Turku, Finland

    Luigia Petre

Rights and permissions

Reprints and permissions

Copyright information

© 2013 Springer-Verlag Berlin Heidelberg

About this paper

Cite this paper

Song, F., Touili, T. (2013). Model-Checking Software Library API Usage Rules. In: Johnsen, E.B., Petre, L. (eds) Integrated Formal Methods. IFM 2013. Lecture Notes in Computer Science, vol 7940. Springer, Berlin, Heidelberg. https://doi.org/10.1007/978-3-642-38613-8_14

Download citation

  • DOI: https://doi.org/10.1007/978-3-642-38613-8_14

  • Publisher Name: Springer, Berlin, Heidelberg

  • Print ISBN: 978-3-642-38612-1

  • Online ISBN: 978-3-642-38613-8

  • eBook Packages: Computer ScienceComputer Science (R0)

Publish with us

Policies and ethics

Search

Navigation