research-article

Static analysis for software assurance: soundness, scalability and adaptiveness

Authors:

Arnaud J. Venet,

Michael R. LowryAuthors Info & Claims

FoSER '10: Proceedings of the FSE/SDP workshop on Future of software engineering research

Pages 393 - 396

https://doi.org/10.1145/1882362.1882442

Published: 07 November 2010 Publication History

Abstract

Standard approaches to software assurance are either process-based or test-based. We propose to include static analysis by Abstract interpretation to the software development cycle. Static analysis by Abstract Interpretation provides a high level of assurance as well as ground-truth evidence in support of its findings. Successes in the verification of large industrial codes demonstrate the readiness of this technology. However, in order to be practical in real development environments, static analysis must be able to scale and yield few false positives without the need for expert hand-tuning. We present a research agenda to reach this goal based on the development of adaptive static analysis algorithms.

References

[1]

T. Ball and S. K. Rajamani. The slam project: debugging system software via static analysis. In POPL, pages 1--3, 2002.

Digital Library

[2]

O. Bouissou, E. Conquet, P. Cousot, R. Cousot, J. Feret, K. Ghorbal, É. Goubault, D. Lesens, L. Mauborgne, A. Miné, S. Putot, X. Rival, and M. Turin. Space software validation using abstract interpretation. In Proc. of the Int. Space System Engineering Conf., Data Systems in Aerospace (DASIA 2009), volume SP-669, pages 1--7, May 2009.

[3]

G. Brat and Arnaud Venet. Precise and scalable static program analysis of NASA flight software. In Proceedings of the IEEE Aerospace Conference, Big Sky, MT, 2005.

[4]

A. Chapoutot and M. Martel. Abstract simulation: a static analysis of simulink models. In 6th IEEE International Conference on Embedded Systems and Software (ICESS '09), 2009.

Digital Library

[5]

L. Chen, A. Miné, J. Wang, and P. Cousot. A sound floating-point polyhedra abstract domain. In G. Ramalingam, editor, Proceedings of the sixth Asian Symposium (APLAS '08), pages 3--18, Bangalore, India, 2009.

Digital Library

[6]

P. Cousot and R. Cousot. Abstract interpretation: a unified lattice model for static analysis of programs by construction or approximation of fixpoints. In Conference Record of the Fourth Annual ACM SIGPLAN-SIGACT Symposium on Principles of Programming Languages, pages 238--252, Los Angeles, California, 1977. ACM Press, New York, NY.

Digital Library

[7]

P. Cousot, R. Cousot, J. Feret, L. Mauborgne, A. Miné, D. Monniaux, and X. Rival. The ASTRÉE Analyser. In M. Sagiv, editor, Proc. of the European Symposium on Programming (ESOP '05), volume 3444 of Lecture Notes in Computer Science, pages 21--30, April 2-10 2005.

Digital Library

[8]

P. Cousot and N. Halbwachs. Automatic discovery of linear restraints among variables of a program. In Conference Record of the Fifth Annual ACM SIGPLAN-SIGACT Symposium on Principles of Programming Languages, pages 84--97, Tucson, Arizona, 1978.

Digital Library

[9]

Coverity. Prevent. (www.coverity.com).

[10]

B. A. Davey and H. A. Priestley. Introduction to lattices and order. Cambridge University Press, Cambridge, 1990.

[11]

J. Féret. The arithmetic-geometric progression abstract domain. In Verification, Model Checking and Abstract Interpretation (VMCAI '05), number 3385 in LNCS, pages 42--58, 2005.

[12]

GrammaTech. CodeSonar. (www.grammatech.com).

[13]

T. A. Henzinger, R. Jhala, R. Majumdar, and G. Sutre. Lazy abstraction. In POPL, pages 58--70, 2002.

Digital Library

[14]

M. Karr. Affine relationships among variables of a program. Acta Inf., 6:133--151, 1976.

Digital Library

[15]

T. Lev-Ami and S. Sagiv. Tvla: A system for implementing static analyses. In Static Analysis Symposium, pages 280--301, 2000.

Digital Library

[16]

A. Loginov, T. W. Reps, and S. Sagiv. Abstraction refinement via inductive learning. In CAV, pages 519--533, 2005.

Digital Library

[17]

A. Miné. The octagon abstract domain. In Proc. of the Workshop on Analysis, Slicing, and Transformation (AST '01), IEEE, pages 310--319, October 2001.

Digital Library

[18]

T. W. Reps, S. Sagiv, and G. Yorsh. Symbolic implementation of the best transformer. In VMCAI, pages 252--266, 2004.

[19]

R. Rugina. Quantitative shape analysis. In Static Analysis Symposium, pages 228--245, 2004.

[20]

S. Sagiv, T. W. Reps, and R. Wilhelm. Parametric shape analysis via 3-valued logic. ACM Trans. Program. Lang. Syst., 24(3):217--298, 2002.

Digital Library

[21]

The MathWorks. PolySpace. (\texttthttp://www.mathworks.com/products/polyspace).

[22]

A. Venet. Abstract cofibered domains: Application to the alias analysis of untyped programs. In SAS, pages 366--382, 1996.

Digital Library

[23]

A. Venet. A scalable nonuniform pointer analysis for embedded programs. In SAS, pages 149--164, 2004.

[24]

A. Venet and G. P. Brat. Precise and efficient static array bound checking for large embedded C programs. In Proc. of the Int. Conf. on Programming Language Design and Implementation (PLDI), pages 231--242, June 2004.

Digital Library

Cited By

Eito-Brun R(2021)A Proposal for the Tailoring of AUTOSAR Coding Guidelines C++ to ISO 26262-6:2018Systems, Software and Services Process Improvement10.1007/978-3-030-85521-5_33(505-517)Online publication date: 25-Aug-2021
https://doi.org/10.1007/978-3-030-85521-5_33
Sherine KRanjan PJayalal NGopalakrishnan TValsa B(2018)Verification of On-board Software of ISRO Launch Vehicles Using Polyspace-A Case Study2018 7th International Conference on Reliability, Infocom Technologies and Optimization (Trends and Future Directions) (ICRITO)10.1109/ICRITO.2018.8748315(182-187)Online publication date: Aug-2018
https://doi.org/10.1109/ICRITO.2018.8748315
Rahaman SYao D(2017)Program Analysis of Cryptographic Implementations for Security2017 IEEE Cybersecurity Development (SecDev)10.1109/SecDev.2017.23(61-68)Online publication date: Sep-2017
https://doi.org/10.1109/SecDev.2017.23
Show More Cited By

Index Terms

Static analysis for software assurance: soundness, scalability and adaptiveness

Recommendations

Pushdown control-flow analysis for free
POPL '16

Traditional control-flow analysis (CFA) for higher-order languages introduces spurious connections between callers and callees, and different invocations of a function may pollute each other's return flows. Recently, three distinct approaches have been ...
An algorithmic mitigation of large spurious interprocedural cycles in static analysis

We present a simple algorithmic extension of the approximate call-strings approach to mitigate substantial performance degradation caused by spurious interprocedural cycles. Spurious interprocedural cycles are, in a realistic setting, the key reasons ...
Numerical static analysis with Soot
SOAP '13: Proceedings of the 2nd ACM SIGPLAN International Workshop on State Of the Art in Java Program analysis

Numerical static analysis computes an approximation of all the possible values that a numeric variable may assume, in any execution of the program. Many numerical static analyses have been proposed exploiting the theory of abstract interpretation, which ...

Comments

Information & Contributors

Information

Published In

cover image ACM Conferences

FoSER '10: Proceedings of the FSE/SDP workshop on Future of software engineering research

November 2010

460 pages

ISBN:9781450304276

DOI:10.1145/1882362

General Chair:
Gruia-Catalin Roman
Washington University in St. Louis, USA
,
Program Chair:
Kevin Sullivan
University of Virginia, USA

Copyright © 2010 ACM.

Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for components of this work owned by others than ACM must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. Request permissions from [email protected]

Sponsors

SIGSOFT: ACM Special Interest Group on Software Engineering

Publisher

Association for Computing Machinery

New York, NY, United States

Publication History

Published: 07 November 2010

Permissions

Request permissions for this article.

Request Permissions

Check for updates

Author Tags

Qualifiers

Research-article

Conference

SIGSOFT/FSE'10

Sponsor:

SIGSOFT

SIGSOFT/FSE'10: 18th ACM SIGSOFT Symposium on the Foundations of Software Engineering

November 7 - 8, 2010

New Mexico, Santa Fe, USA

Contributors

Other Metrics

View Article Metrics

Bibliometrics & Citations

Bibliometrics

Article Metrics

4
Total Citations
View Citations
306
Total Downloads

Downloads (Last 12 months)10
Downloads (Last 6 weeks)2

Reflects downloads up to 06 Oct 2024

Other Metrics

View Author Metrics

Citations

Cited By

Eito-Brun R(2021)A Proposal for the Tailoring of AUTOSAR Coding Guidelines C++ to ISO 26262-6:2018Systems, Software and Services Process Improvement10.1007/978-3-030-85521-5_33(505-517)Online publication date: 25-Aug-2021
https://doi.org/10.1007/978-3-030-85521-5_33
Sherine KRanjan PJayalal NGopalakrishnan TValsa B(2018)Verification of On-board Software of ISRO Launch Vehicles Using Polyspace-A Case Study2018 7th International Conference on Reliability, Infocom Technologies and Optimization (Trends and Future Directions) (ICRITO)10.1109/ICRITO.2018.8748315(182-187)Online publication date: Aug-2018
https://doi.org/10.1109/ICRITO.2018.8748315
Rahaman SYao D(2017)Program Analysis of Cryptographic Implementations for Security2017 IEEE Cybersecurity Development (SecDev)10.1109/SecDev.2017.23(61-68)Online publication date: Sep-2017
https://doi.org/10.1109/SecDev.2017.23
Flückiger LUtz H(2013)Service Oriented Robotic Architecture for Space Robotics: Design, Testing, and Lessons LearnedJournal of Field Robotics10.1002/rob.2148531:1(176-191)Online publication date: 4-Nov-2013
https://doi.org/10.1002/rob.21485

View Options

Get Access

Login options

Check if you have access through your login credentials or your institution to get full access on this article.

Full Access

Get this Publication

View options

PDF

View or Download as a PDF file.

eReader

View online with eReader.

Media

Figures

Other

Tables

View Table of Contents