Abstract
The error detection in software is a problem that causes the loss of large amount of money in updates and patches. Many programmers spend their time correcting code instead of programming new features for their applications. This makes early detection of software errors become essential. Both in the fields of static analysis and model checking, great advances are being made to find errors in the software before the products are released. Although model checking techniques are more dedicated to find malware, it can be adapted for errors in the software. In this article we will discuss the techniques used today for the search of patterns and vulnerabilities within the software to know what are the possible solutions to this issue. We examine the problem from the point of view of their algorithms and their effectiveness in finding bugs. Although there are similar surveys, none of them addresses the comparison of best static analysis algorithms against the best mathematical logic languages for model checking, two fields that are becoming very important in the search for errors in software.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
Preview
Unable to display preview. Download preview PDF.
Similar content being viewed by others
References
Alur, R., de Alfaro, L., Henzinger, T.A., Mang, F.Y.C.: Automating Modular Verification. In: Baeten, J.C.M., Mauw, S. (eds.) CONCUR 1999. LNCS, vol. 1664, p. 82. Springer, Heidelberg (1999)
ARC, http://altarica.labri.fr/wp/?page_id=32 (last accessed February 20, 2014)
Balakrishnan, G., Reps, T.: Analyzing memory accesses in x86 executables. In: Duesterwald, E. (ed.) CC 2004. LNCS, vol. 2985, pp. 5–23. Springer, Heidelberg (2004)
Balakrishnan, G., Reps, T., Melski, D., Teitelbaum, T.: WYSINWYX: What You See Is Not What You eXecute. In: Meyer, B., Woodcock, J. (eds.) VSTTE 2005. LNCS, vol. 4171, pp. 202–213. Springer, Heidelberg (2008)
Ben-Ari, M., Pnueli, A., Manna, Z.: The temporal logic of branching time. Acta Informatica 20(3), 207–226 (1983)
Christodorescu, M., Jha, S., Seshia, S.A., Song, D., Bryant, R.E.: Semantics-aware malware detection. In: Proc. IEEE Symposium on Security and Privacy, pp. 32–46 (2005)
Christodorescu, M., Jha, S.: Static analysis of executables to detect malicious patterns. Wisconsin Univ-Madison dept of Computer Sciences (2006)
Clarke, E.M., Emerson, E.A.: Design and synthesis of synchronization skeletons using branching time temporal logic. In: Kozen, D. (ed.) Logics of Programs. LNCS, vol. 131, pp. 52–71. Springer, Heidelberg (1982)
Clarke, E.M., Emerson, E.A., Sistla, A.P.: Automatic verification of finite-state concurrent systems using temporal logic specifications. ACM Transactions on Programming Languages and Systems 8(2), 244 (1986)
Clarke, E.M., Grumberg, O.: Avoiding the state explosion problem in temporal logic model checking. In: Proceedings of the Sixth Annual ACM Symposium on Principles of Distributed Computing, pp. 294–303. ACM (December 1987)
Clarke, E., Grumberg, O., Jha, S., Lu, Y., Veith, H.: Progress on the state explosion problem in model checking. In: Wilhelm, R. (ed.) Informatics: 10 Years Back, 10 Years Ahead. LNCS, vol. 2000, pp. 176–194. Springer, Heidelberg (2001)
CodeSurfer, http://www.grammatech.com/research/technologies/codesurfer (last accessed February 20, 2014)
Cousot, P.: Abstract interpretation: a unified lattice model for static analysis of programs by construction or approximation of fixpoints. In: Proceedings of the 4th ACM SIGACT-SIGPLAN, pp. 238–252 (1977)
Cousot, P., Cousot, R.: Refining Model Checking by Abstract Interpretation. Automated Software Engineering Journal 6(1), 69–95 (1999)
Dijkstra, E.W.: Guarded commands, nondeterminacy and formal derivation of program. Communications of the ACM, 453–457 (1975)
D’Silva, V., Kroening, D., Weissenbacher, G.: A survey of automated techniques for formal software verification. IEEE Transactions on Computer-Aided Design of Integrated Circuits and Systems 27(7), 1165–1178 (2008)
Emerson, E.A., Clarke, E.M.: Characterizing correctness properties of parallel programs using fixpoints. In: de Bakker, J., van Leeuwen, J. (eds.) Automata, Languages and Programming. LNCS, vol. 85, pp. 169–181. Springer, Heidelberg (1980)
Emerson, E.A., Halpern, J.Y.: Decisions procedures and expressiveness in the temporal logic of branching time. In: Handbook of Theorical Computer Science, vol. B: Formal models and Semantics. Elsevier (1985)
Emerson, E.A., Halpern, J.Y.: Sometimes and not never revisited: on branching versus linear time temporal logic. Journal of the ACM (JACM) 33(1), 151–178 (1986)
Engler, D., Musuvathi, M.: Static analysis versus software model checking for bug finding. In: Steffen, B., Levi, G. (eds.) VMCAI 2004. LNCS, vol. 2937, pp. 191–210. Springer, Heidelberg (2004)
F.L.I.R.T., https://www.hex-rays.com/products/ida/tech/flirt/index.shtml (last accessed February 20, 2014)
Frama-C, http://frama-c.com/ (last accessed February 20, 2014)
Hoare, C.A.R.: An Axiomatic Basis for Computer Programming. Commun. ACM 12 (1969)
Holzman, G.J.: Design and validation of computer protocols. Prentice-Hall (1990)
IDA Pro, https://www.hex-rays.com/products/ida/ (last accessed February 20, 2014)
Java+ITP, http://maude.cs.uiuc.edu/tools/javaitp/ (last accessed February 20, 2014)
Kinder, J., Katzenbeisser, S., Schallhart, C., Veith, H.: Detecting malicious code by model checking. In: Julisch, K., Kruegel, C. (eds.) DIMVA 2005. LNCS, vol. 3548, pp. 174–187. Springer, Heidelberg (2005)
Konur, S.: A survey on temporal logics. arXiv preprint (2010)
Kozen, D.: Result on the Propositional μ-calculus. Journal of Theoretical Computer Science 27, 333–354 (1983)
Leveson, N.: An Investigation of the Therac-25 Accidents. IEEE Computer 26, 18–41 (1993)
Lions, J.L.: ARIANE 5, Flight 501 Failure (1993), http://www.di.unito.it/~damiani/ariane5rep.html (last accessed February 20, 2014)
Manna, Z., Pnueli, A.: The Temporal Logic of Reactive and Concurrent Systems. Springer (1991)
mCRL2, http://www.mcrl2.org/ (last accessed February 20, 2014)
NuSMV, http://nusmv.fbk.eu/ (last accessed February 20, 2014)
Pnueli, A.: The temporal logic of programs. In: Foundations of Computer Science 18th (1977)
Predator, http://www.fit.vutbr.cz/research/groups/verifit/tools/predator/ (last accessed February 20, 2014)
Queille, J.P., Sifakis, J.: Specification and verification of concurrent systems in CESAR. In: Dezani-Ciancaglini, M., Montanari, U. (eds.) International Symposium on Programming. LNCS, vol. 137, pp. 337–351. Springer, Heidelberg (1982)
Reynolds, J.: Automatic computation of data set definitions. Science (1967)
Song, F., Touili, T.: Efficient malware detection using model-checking. In: Giannakopoulou, D., Méry, D. (eds.) FM 2012. LNCS, vol. 7436, pp. 418–433. Springer, Heidelberg (2012)
Song, F., Touili, T.: PoMMaDe: pushdown model-checking for malware detection. In: Proceedings of the 2013 9th Joint Meeting on Foundations of Software Engineering, pp. 607–610. ACM (August 2013)
SPIN, http://spinroot.com/spin/whatispin.html (last accessed February 20, 2014)
The First Computer Bug, http://www.history.navy.mil/photos/images/h96000/h96566kc.htm (last accessed February 20, 2014)
Author information
Authors and Affiliations
Corresponding author
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2014 Springer International Publishing Switzerland
About this paper
Cite this paper
García-Ferreira, I., Laorden, C., Santos, I., Bringas, P.G. (2014). A Survey on Static Analysis and Model Checking. In: de la Puerta, J., et al. International Joint Conference SOCO’14-CISIS’14-ICEUTE’14. Advances in Intelligent Systems and Computing, vol 299. Springer, Cham. https://doi.org/10.1007/978-3-319-07995-0_44
Download citation
DOI: https://doi.org/10.1007/978-3-319-07995-0_44
Publisher Name: Springer, Cham
Print ISBN: 978-3-319-07994-3
Online ISBN: 978-3-319-07995-0
eBook Packages: EngineeringEngineering (R0)