An Evaluation of Automata Algorithms for String Analysis

Hooimeijer, Pieter; Veanes, Margus

doi:10.1007/978-3-642-18275-4_18

Cited by 51 publications

(48 citation statements)

References 31 publications

(57 reference statements)

Supporting

Mentioning

Contrasting

Order By: Relevance

“…A symbolic finite-state automaton [22] extends this by encoding the edge as (q s , ψ, q e ), where ψ ⊆ Σ encodes the set of input values permitted by the transition. A number of encodings have been proposed for these sets of values, including hash-sets, range predicates and bit-vector constraints; these are discussed in [8].…”

Section: Symbolic Finite State Automatamentioning

confidence: 99%

Unbounded Model-Checking with Interpolation for Regular Language Constraints

Gange

Navas

Stuckey

et al. 2013

Tools and Algorithms for the Construction and Analysis of Systems

View full text Add to dashboard Cite

Abstract. We present a decision procedure for the problem of, given a set of regular expressions R1, . . . , Rn, determining whether R = R1 ∩ · · · ∩ Rn is empty. Our solver, revenant, finitely unrolls automata for R1, . . . , Rn, encoding each as a set of propositional constraints. If a SAT solver determines satisfiability then R is non-empty. Otherwise our solver uses unbounded model checking techniques to extract an interpolant from the bounded proof. This interpolant serves as an overapproximation of R. If the solver reaches a fixed-point with the constraints remaining unsatisfiable, it has proven R to be empty. Otherwise, it increases the unrolling depth and repeats. We compare revenant with other stateof-the-art string solvers. Evaluation suggests that it behaves better for constraints that express the intersection of sets of regular languages, a case of interest in the context of verification.

show abstract

Section: Symbolic Finite State Automatamentioning

confidence: 99%

Unbounded Model-Checking with Interpolation for Regular Language Constraints

Gange

Navas

Stuckey

et al. 2013

Tools and Algorithms for the Construction and Analysis of Systems

View full text Add to dashboard Cite

show abstract

“…A lazy solving technique [11] uses automaton with transitions annotated with integer ranges. A good comparison of the automaton-based approaches is given in [10]. Many of these solvers provide no support or only very limited support for hybrid constraints (i.e.…”

Section: Introductionmentioning

confidence: 99%

PASS: String Solving with Parameterized Array and Interval Automaton

Ghosh

2013

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Abstract. The problem of solving string constraints together with numeric constraints has received increasing interest recently. Existing methods use either bit-vectors or automata (or their combination) to model strings, and reduce string constraints to bit-vector constraints or automaton operations, which are then solved in the respective domain. Unfortunately, they often fail to achieve a good balance between efficiency, accuracy, and comprehensiveness. In this paper we illustrate a new technique that uses parameterized arrays as the main data structure to model strings, and converts string constraints into quantified expressions that are solved through quantifier elimination. We present an efficient and sound quantifier elimination algorithm. In addition, we use an automaton model to handle regular expressions and reason about string values faster. Our method does not need to enumerate string lengths (as bit-vector based methods do), or concrete string values (as automaton based methods do). Hence, it can achieve much better accuracy and efficiency. In particular, it can identify unsatisfiable cases quickly. Our solver (named PASS) supports most of the popular string operations, including string comparisons, string-numeric conversions, and regular expressions. Experimental results demonstrate the advantages of our method.

show abstract

“…On the other hand, the stateof-the-art in this field is still limited: approaches that rely on automata and use regular expressions are precise but slow, and they do not scale up [14,24,21,13], while many other approaches are focused on particular properties or class of programs [10,18,12]. Genericity and scalability are the main advantages of the abstract interpretation approach [4,5], though its instantiation to textual values has been quite limited up to now.…”

Section: Introductionmentioning

confidence: 99%