research-article

Specification Inference Using Context-Free Language Reachability

Authors:

Osbert Bastani,

Alex AikenAuthors Info & Claims

POPL '15: Proceedings of the 42nd Annual ACM SIGPLAN-SIGACT Symposium on Principles of Programming Languages

Pages 553 - 566

https://doi.org/10.1145/2676726.2676977

Published: 14 January 2015 Publication History

Abstract

We present a framework for computing context-free language reachability properties when parts of the program are missing. Our framework infers candidate specifications for missing program pieces that are needed for verifying a property of interest, and presents these specifications to a human auditor for validation. We have implemented this framework for a taint analysis of Android apps that relies on specifications for Android library methods. In an extensive experimental study on 179 apps, our tool performs verification with only a small number of queries to a human auditor.

Supplementary Material

MPG File (p553-sidebyside.mpg)

Download
861.49 MB

References

[1]

A. Aiken, S. Bugrara, I. Dillig, T. Dillig, B. Hackett, P. Hawkins. An overview of the Saturn project. In PASTE, 43--48, 2007.

Digital Library

[2]

K. Ali, O. Lhoták. Averroes: whole-program analysis without the whole program. In ECOOP, 2013.

Digital Library

[3]

R. Alur, P. Černy, P. Madhusudan, W. Nam. Synthesis of interface specifications for Java classes. In POPL, 2005.

Digital Library

[4]

G. Ammons, R. Bodík, J. Larus. Mining specifications. In POPL, 2002.

Digital Library

[5]

S. Arzt, S. Rasthofer, C. Fritz, E. Bodden, A. Bartel, J. Klein, Y. L. Traon, D. Octeau, P. McDaniel. FlowDroid: precise context, flow, field, object-sensitive and lifecycle-aware taint analysis for Android apps. In PLDI, 2014.

Digital Library

[6]

T. Ball, S. Rajamani. The SLAM project: debugging system software via static analysis. In POPL, 2002.

Digital Library

[7]

N. Beckman, A. Nori. Probabilistic, modular and scalable inference of typestate specifications. In PLDI, 2011.

Digital Library

[8]

W. Enck, P. Gilbert, B. Chun, L. Cox, J. Jung, P. McDaniel, A. Sheth. TaintDroid: an information-flow tracking system for realtime privacy monitoring on smartphones. In OSDI, 2010.

Digital Library

[9]

A. P. Fuchs, A. Chaudhuri, J. S. Foster. SCanDroid: automated security certification of Android applications. In IEEE Symposium on Security and Privacy, 2010.

[10]

D. Greenfieldboyce, J. S. Foster. Type qualifier inference in Java. In OOPSLA, 2007.

Digital Library

[11]

J. Kodumal, A. Aiken. Banshee: a scalable constraint-based analysis toolkit. In SAS, 2005.

Digital Library

[12]

J. Kodumal, A. Aiken. Regularly annotated set constraints. In PLDI, 2007.

Digital Library

[13]

J. Kodumal, A. Aiken. The set constraint/CFL reachability connection in practice. In PLDI, 2004.

Digital Library

[14]

D. Knuth. A generalization of Dijkstra's algorithm. In Information Processing Letters, 6(1):1--5, 1977.

[15]

T. Kremenek, P. Twohey, G. Back, A. Ng, D. Engler. From uncertainty to belief: inferring the specification within. In OSDI, 2006.

Digital Library

[16]

B. Livshits, A. V. Nori, S. K. Rajamani, A. Banerjee. Merlin: specification inference for explicit information flow problems. In PLDI, 2009.

Digital Library

[17]

B. Livshits, M. S. Lam. Finding security vulnerabilities in Java applications with static analysis. In USENIX Security Symposium, 2005.

Digital Library

[18]

B. Livshits, M. S. Lam. Tracking pointers with path and context sensitivity for bug detection in C programs. In FSE, 2003.

Digital Library

[19]

D. Melski, T. Reps. Interconvertibility of a class of set constraints and context-free language reachability. In Theoretical Computer Science, 248(1):29--98, 2000.

Digital Library

[20]

M. Naik, A. Aiken, J. Whaley. Effective static race detection for Java. In PLDI, 2006.

Digital Library

[21]

J. W. Nimmer, M. D. Ernst. Automatic generation of program specifications. In ISSTA, 2002.

Digital Library

[22]

M. K. Ramanathan, A. Grama, S. Jagannathan. Static specification inference using predicate mining. In PLDI, 2007.

Digital Library

[23]

T. Reps. Program analysis via graph reachability. In ILPS, 1997.

Digital Library

[24]

T. Reps, S. Horwitz, M. Sagiv. Precise interprocedural data flow analysis via graph reachability. In POPL, 1995.

Digital Library

[25]

S. Shoham, E. Yahav, S. Fink, M. Pistoia. Static specification mining using automata-based abstractions. In ISSTA, 2007.

Digital Library

[26]

M. Sridharan, D. Gopan, L. Shan, R. Bodik. Demand-driven points-to analysis for Java. In OOPSLA, 2005.

Digital Library

[27]

M. Sridharan, S. Artzi, M. Pistoia, S. Guarnieri, O. Tripp, R. Berg. F4F: taint analysis of framework-based web applications. In OOPSLA, 2011.

Digital Library

[28]

M. Sridharan, R. Bodik. Refinement-based context-sensitive points-to analysis for Java. In PLDI, 2006.

Digital Library

[29]

O. Tripp, M. Pistoia, S. J. Fink, M. Sridharan, O. Weisman. TAJ: effective taint analysis of web applications. In PLDI, 2009.

Digital Library

[30]

R. Vallée-Rai, P. Co, E. Gagnon, L. Hendren, P. Lam, V. Sundaresan. Soot: a Java bytecode optimization framework. In CASCON, 1999.

[31]

J. Whaley, M. S. Lam. Cloning-based context-sensitive pointer alias analysis using binary decision diagrams. In OOPSLA, 2004.

Digital Library

[32]

Y. Xie, A. Aiken. Static detection of security vulnerabilities in scripting languages. In USENIX Security Symposium, 2006.

Digital Library

[33]

J. Yang, D. Evans, D. Bhardwaj, T. Bhat, M. Das. Perracotta: mining temporal API rules from imperfect traces. In ICSE, 2006.

Digital Library

[34]

H. Zhu, T. Dillig, I. Dillig. Automated inference of library specifications for source-sink property verification. In APLAS, 2013.

Digital Library

Cited By

Wu RHe YHuang JWang CTang WShi QXiao XZhang CRoychoudhury APaiva AAbreu RStorey M(2024)LibAlchemy: A Two-Layer Persistent Summary Design for Taming Third-Party Libraries in Static Bug-Finding SystemsProceedings of the IEEE/ACM 46th International Conference on Software Engineering10.1145/3597503.3639132(1-13)Online publication date: 20-May-2024
https://dl.acm.org/doi/10.1145/3597503.3639132
Zhang WWang GChen JXiong YLiu YZhang LBissyandé TKlein JBird CSarro F(2023)OrdinalFix: Fixing Compilation Errors via Shortest-Path CFL ReachabilityProceedings of the 38th IEEE/ACM International Conference on Automated Software Engineering10.1109/ASE56229.2023.00072(1200-1211)Online publication date: 11-Nov-2023
https://dl.acm.org/doi/10.1109/ASE56229.2023.00072
Christakis MCottenier TFilieri ALuo LMansur MPike LRosner NSchäf MSengupta AVisser WRoychoudhury ACadar CKim M(2022)Input splitting for cloud-based static application security testing platformsProceedings of the 30th ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering10.1145/3540250.3558944(1367-1378)Online publication date: 7-Nov-2022
https://dl.acm.org/doi/10.1145/3540250.3558944
Show More Cited By

Index Terms

Specification Inference Using Context-Free Language Reachability
1. Theory of computation
  1. Semantics and reasoning
    1. Program reasoning
      1. Program analysis
      2. Program verification
    2. Program semantics

Recommendations

Static specification inference using predicate mining
Proceedings of the 2007 PLDI conference

The reliability and correctness of complex software systems can be significantly enhanced through well-defined specifications that dictate the use of various units of abstraction (e.g., modules, or procedures). Often times, however, specifications are ...
Static specification inference using predicate mining
PLDI '07: Proceedings of the 28th ACM SIGPLAN Conference on Programming Language Design and Implementation

The reliability and correctness of complex software systems can be significantly enhanced through well-defined specifications that dictate the use of various units of abstraction (e.g., modules, or procedures). Often times, however, specifications are ...
From Verification to Specification Inference
TASE '12: Proceedings of the 2012 Sixth International Symposium on Theoretical Aspects of Software Engineering

Traditionally, the focus of specification mechanism has been on improving its ability to cover a wider range of problems more accurately, while the effectiveness of verification is left to the underlying theorem provers. Our work attempts a novel ...

Comments

Information & Contributors

Information

Published In

cover image ACM Conferences

POPL '15: Proceedings of the 42nd Annual ACM SIGPLAN-SIGACT Symposium on Principles of Programming Languages

January 2015

716 pages

ISBN:9781450333009

DOI:10.1145/2676726

General Chair:
Sriram Rajamani
Microsoft Research, India
,
Program Chair:
David Walker
Princeton University, USA

ACM SIGPLAN Notices Volume 50, Issue 1
POPL '15
January 2015
682 pages
ISSN:0362-1340
EISSN:1558-1160
DOI:10.1145/2775051
Editor:
Andy Gill
University of Kansas, Lawrence, KS
Issue’s Table of Contents

Copyright © 2015 ACM.

Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for components of this work owned by others than ACM must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. Request permissions from [email protected]

Sponsors

SIGPLAN: ACM Special Interest Group on Programming Languages

In-Cooperation

SIGACT: ACM Special Interest Group on Algorithms and Computation Theory

Publisher

Association for Computing Machinery

New York, NY, United States

Publication History

Published: 14 January 2015

Permissions

Request permissions for this article.

Request Permissions

Check for updates

Author Tags

Qualifiers

Research-article

Funding Sources

Air Force Research Laboratory

Conference

POPL '15

Sponsor:

SIGPLAN

POPL '15: The 42nd Annual ACM SIGPLAN-SIGACT Symposium on Principles of Programming Languages

January 15 - 17, 2015

Mumbai, India

Acceptance Rates

POPL '15 Paper Acceptance Rate 52 of 227 submissions, 23%;

Overall Acceptance Rate 860 of 4,328 submissions, 20%

Upcoming Conference

Contributors

Other Metrics

View Article Metrics

Bibliometrics & Citations

Bibliometrics

Article Metrics

39
Total Citations
View Citations
397
Total Downloads

Downloads (Last 12 months)11
Downloads (Last 6 weeks)2

Reflects downloads up to 08 Mar 2025

Other Metrics

View Author Metrics

Citations

Cited By

Wu RHe YHuang JWang CTang WShi QXiao XZhang CRoychoudhury APaiva AAbreu RStorey M(2024)LibAlchemy: A Two-Layer Persistent Summary Design for Taming Third-Party Libraries in Static Bug-Finding SystemsProceedings of the IEEE/ACM 46th International Conference on Software Engineering10.1145/3597503.3639132(1-13)Online publication date: 20-May-2024
https://dl.acm.org/doi/10.1145/3597503.3639132
Zhang WWang GChen JXiong YLiu YZhang LBissyandé TKlein JBird CSarro F(2023)OrdinalFix: Fixing Compilation Errors via Shortest-Path CFL ReachabilityProceedings of the 38th IEEE/ACM International Conference on Automated Software Engineering10.1109/ASE56229.2023.00072(1200-1211)Online publication date: 11-Nov-2023
https://dl.acm.org/doi/10.1109/ASE56229.2023.00072
Christakis MCottenier TFilieri ALuo LMansur MPike LRosner NSchäf MSengupta AVisser WRoychoudhury ACadar CKim M(2022)Input splitting for cloud-based static application security testing platformsProceedings of the 30th ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering10.1145/3540250.3558944(1367-1378)Online publication date: 7-Nov-2022
https://dl.acm.org/doi/10.1145/3540250.3558944
Huang KQiu X(2022)Bootstrapping Library-Based SynthesisStatic Analysis10.1007/978-3-031-22308-2_13(272-298)Online publication date: 5-Dec-2022
https://dl.acm.org/doi/10.1007/978-3-031-22308-2_13
Zhou ZDickerson RDelaware BJagannathan S(2021)Data-driven abductive inference of library specificationsProceedings of the ACM on Programming Languages10.1145/34854935:OOPSLA(1-29)Online publication date: 15-Oct-2021
https://dl.acm.org/doi/10.1145/3485493
Prabhu SFedyukovich GMadhukar KD'Souza DFreund SYahav E(2021)Specification synthesis with constrained Horn clausesProceedings of the 42nd ACM SIGPLAN International Conference on Programming Language Design and Implementation10.1145/3453483.3454104(1203-1217)Online publication date: 19-Jun-2021
https://dl.acm.org/doi/10.1145/3453483.3454104
Samak MKim DRinard M(2019)Synthesizing replacement classesProceedings of the ACM on Programming Languages10.1145/33711204:POPL(1-33)Online publication date: 20-Dec-2019
https://dl.acm.org/doi/10.1145/3371120
Eberhardt JSteffen SRaychev VVechev MMcKinley KFisher K(2019)Unsupervised learning of API aliasing specificationsProceedings of the 40th ACM SIGPLAN Conference on Programming Language Design and Implementation10.1145/3314221.3314640(745-759)Online publication date: 8-Jun-2019
https://dl.acm.org/doi/10.1145/3314221.3314640
(2018)Mining balanced API protocolsInternational Journal of Computational Science and Engineering10.1504/IJCSE.2018.09176416:3(289-302)Online publication date: 1-Jan-2018
https://dl.acm.org/doi/10.1504/IJCSE.2018.091764
Bastani OSharma RAiken ALiang P(2018)Active learning of points-to specificationsACM SIGPLAN Notices10.1145/3296979.319238353:4(678-692)Online publication date: 11-Jun-2018
https://dl.acm.org/doi/10.1145/3296979.3192383
Show More Cited By

View Options

Login options

Check if you have access through your login credentials or your institution to get full access on this article.

Full Access

Get this Publication

View options

PDF

View or Download as a PDF file.

eReader

View online with eReader.

Figures

Tables

Media

View Table of Conten