阅读软件分析论文 [ISSTA 13]Hybrid Learning:Interface Generation through Static,Dynamic,and Symbolic Analysis

前言

在此阅读ISSTA 13 软件分析论文。

这篇论文应该和形式化方法有点沾边的，这位作者最近也是一直在搞形式化方法，值得一读。

1 基本信息

Howar F, Giannakopoulou D, Rakamarić Z. Hybrid learning: interface generation through static, dynamic, and symbolic analysis[C]//Proceedings of the 2013 International Symposium on Software Testing and Analysis. ACM, 2013: 268-279.

一作：Falk Howar
主页：http://www.falkhowar.de/

2 文章内容

开门见山，指出要解决的问题：

This paper addresses the problem of efficient generation of component interfaces through learning.

描述问题，并说明以前工作：

Given a white-box component C with specified unsafe states, an interface captures safe orderings of invocations of C’s public methods. In previous work we presented Psyco, an interface generation framework that combines automata learning with symbolic component analysis: learning drives the framework in exploring different combinations of method invocations, and symbolic analysis computes method guards corresponding to constraints on the method parameters for safe execution.

本文工作：

In this work we propose solutions to the two main bottlenecks of Psyco.

进一步描述：

The explosion of method sequences that learning generates to validate its computed interfaces is reduced through partial order reduction resulting from a static analysis of the component. To avoid scalability issues associated with symbolic analysis, we propose novel algorithms that are primarily based on dynamic, concrete component execution, while resorting to symbolic analysis on a limited, as needed, basis. Dynamic execution enables the introduction of a concept of state matching, based on which our proposed approach detects, in some cases, that it has exhausted the exploration of all component behaviors. On the other hand, symbolic analysis is enhanced with symbolic summaries. Our new approach, X-Psyco, has been implemented in the Java Pathfinder (JPF) software verification platform.

验证工具有效性：

We demonstrated the effectiveness of X-Psyco on a number of realistic software components by generating more complete and precise interfaces than was previously possible.

讲真有点看不懂。里面的术语有点多。

大意是：
这篇文章解决通过learning来有效产生组件接口的问题。给定一个有指定不安全状态的白盒组件C，一个接口会捕捉C的公共方法的安全分类。在之前工作，我们presented（好词啊）Psyco，一个能结合自动机学习和符号组件分析的接口生成框架：learning驱动框架去探索不同方法调用的组合，符号分析则计算和方法参数（for safe execution）上约束对应的method guards。 在本文，我们推出Psyco的两个主要瓶颈的解决方案。

通过对组件进行的静态分析导致的偏序缩减，learning为了验证其computed interfaces而产生的方法序列的扩展被减少。为了避免符号执行带来的规模问题，我们推出了主要基于动态的、具体的组件执行的先进算法（将符号分析用在一个limited，as needed，basis上）。在部分案例中（it has exhausted the exploration of all component behaviors），动态执行引入状态匹配的概念（基于我们推出的方法所检测到的）。另一方面，符号分析被symbolic summaries加强。我们的新方法，也叫X-Psyco，在JPF（java路径探测）软件验证平台上实现。

通过产生比之前更复杂更准确的接口（interface），我们在多个现实存在的软件组件中描述了X-Psyco的性能。

3 几个QA

1）就是想了解一下符号执行基本知识。以及静态分析，动态执行等。
这篇文章对我来说很深奥，而且顶会文章不可能给你介绍基础知识。
所以这篇文章基本找不到基础知识。
要学基础知识，得另寻他文。

2）X-Psyco进一步介绍

This work proposes X-Psyco, a hybrid \mutant" of the Psyco algorithm that significantly improves performance through a novel combination of learning with static, concrete, and symbolic analysis.

确实是一种combination。

Although we like to refer to X-Psyco as a mutant of Psyco, it is in fact a new framework, with novel algorithms for performing most of the work at a concrete level, while using symbolic techniques lazily to guarantee completeness.

4 感谢

1）这篇文章的abstract很别具一格。
开头就与众不同。
2）We demonstrated the effectiveness of X-Psyco on a number of realistic software components by generating more complete and precise interfaces than was previously possible.
结尾也与众不同。很厉害。
3）算是发现了：学术领域很多combination。