FlowDroid

Arzt, Steven; Rasthofer, Siegfried; Fritz, Christian; Bodden, Eric; Bartel, Alexandre; Klein, Jacques; Traon, Yves Le; Octeau, Damien; McDaniel, Patrick

doi:10.1145/2594291.2594299

Cited by 702 publications

(86 citation statements)

References 26 publications

(30 reference statements)

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Challenge 1: The design and implementation of a domainspeci c language (DSL) for expressing static-analysis rules. 2 High-level intermediate representation. While the DSL above must be easy for humans to understand, to enable automated optimizations of the static analysis we instead envision a dedicated domain-speci c intermediate representation (IR) of the static analysis, which is not designed to be optimally understandable by humans, but instead to be optimally amenable to domain-speci c optimizations, i.e., optimizations that are only correct when taking into account speci c knowledge about the domain of static program analyses.…”

Section: Core Concepts and Challengesmentioning

confidence: 99%

“…Over the past decades, static code analysis has made signi cant progress, and has seen many novel applications: originally used mainly for the purpose of ahead-of-time program optimization [18,19], it has now become also a common tool for program understanding as well as for nding software quality defects, in particular security vulnerabilities [2,10,22]. This success is due to decades of static-analysis research, which yielded the discovery of novel algorithms, data structures and design principles that make static analyses more precise and scalable than ever before.…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Self-adaptive static analysis

Bodden

2018

Proceedings of the 40th International Conference on Software Engineering: New Ideas and Emerging Results

Self Cite

View full text Add to dashboard Cite

Static code analysis is a powerful approach to detect quality de ciencies such as performance bottlenecks, safety violations or security vulnerabilities already during a software system's implementation. Yet, as current software systems continue to grow, current staticanalysis systems more frequently face the problem of insu cient scalability. We argue that this is mainly due to the fact that current static analyses are implemented fully manually, often in generalpurpose programming languages such as Java or C, or in declarative languages such as Datalog. This design choice prede nes the way in which the static analysis evaluates, and limits the optimizations and extensions static-analysis designers can apply.To boost scalability to a new level, we propose to fuse staticanalysis with just-in-time-optimization technology, introducing for the rst time static analyses that are managed and inherently self-adaptive. Those analyses automatically adapt themselves to yield a performance/precision tradeo that is optimal with respect to the analyzed software system and to the analysis itself.Self-adaptivity is enabled by the novel idea of designing a dedicated intermediate representation, not for the analyzed program but for the analysis itself. This representation allows for an automatic optimization and adaptation of the analysis code, both ahead-of-time (through static analysis of the static analysis) as well as just-in-time during the analysis' execution, similar to just-in-time compilers.

show abstract

Section: Core Concepts and Challengesmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Self-adaptive static analysis

Bodden

2018

Proceedings of the 40th International Conference on Software Engineering: New Ideas and Emerging Results

Self Cite

View full text Add to dashboard Cite

show abstract

“…Given an application executable A j , its ID is the summation of all possible methods invoked at runtime. For computing the possible invoked methods of an application, we use FlowDroid [7], a state-of-the-art tool that uses context-, flow-, field-, and object-sensitive android lifecycle-aware control and data-flow analysis [7]. For a method M k j that belongs to A j , its instruction distribution can be represented…”

Section: Computing Instruction Distributionmentioning

confidence: 99%

Obfuscation resilient search through executable classification

Bell

Kaiser

et al. 2018

Proceedings of the 2nd ACM SIGPLAN International Workshop on Machine Learning and Programming Languages

View full text Add to dashboard Cite

Android applications are usually obfuscated before release, making it difficult to analyze them for malware presence or intellectual property violations. Obfuscators might hide the true intent of code by renaming variables and/or modifying program structures. It is challenging to search for executables relevant to an obfuscated application for developers to analyze efficiently. Prior approaches toward obfuscation resilient search have relied on certain structural parts of apps remaining as landmarks, un-touched by obfuscation. For instance, some prior approaches have assumed that the structural relationships between identifiers are not broken by obfuscators; others have assumed that control flow graphs maintain their structures. Both approaches can be easily defeated by a motivated obfuscator. We present a new approach, Macneto, to search for programs relevant to obfuscated executables leveraging deep learning and principal components on instructions. Macneto makes few assumptions about the kinds of modifications that an obfuscator might perform. We show that it has high search precision for executables obfuscated by a state-of-the-art obfuscator that changes control flow. Further, we also demonstrate the potential of Macneto to help developers understand executables, where Macneto infers keywords (which are from relevant un-obfuscated programs) for obfuscated executables.

show abstract

“…Static analyses attempt to capture the semantics of such frameworks to the extent possible. E.g., the FlowDroid [Arzt et al 2014] framework implements basic processing of Android XML layout files. Yet such support is always vastly incomplete (as will also be apparent in our experimental evaluation) due to the complexity and ever-changing nature of modern frameworks.…”

Section: Motivation and Main Ideamentioning

confidence: 99%

Heaps don't lie: countering unsoundness with heap snapshots

Grech

Fourtounis

Francalanza

et al. 2017

Proc. ACM Program. Lang.

View full text Add to dashboard Cite

Static analyses aspire to explore all possible executions in order to achieve soundness. Yet, in practice, they fail to capture common dynamic behavior. Enhancing static analyses with dynamic information is a common pattern, with tools such as Tamiflex. Past approaches, however, miss significant portions of dynamic behavior, due to native code, unsupported features (e.g., invokedynamic or lambdas in Java), and more. We present techniques that substantially counteract the unsoundness of a static analysis, with virtually no intrusion to the analysis logic. Our approach is reified in the HeapDL toolchain and consists in taking whole-heap snapshots during program execution, that are further enriched to capture significant aspects of dynamic behavior, regardless of the causes of such behavior. The snapshots are then used as extra inputs to the static analysis. The approach exhibits both portability and significantly increased coverage. Heap information under one set of dynamic inputs allows a static analysis to cover many more behaviors under other inputs. A HeapDL-enhanced static analysis of the DaCapo benchmarks computes 99.5% (median) of the call-graph edges of unseen dynamic executions (vs. 76.9% for the Tamiflex tool).

show abstract

FlowDroid

Cited by 702 publications

References 26 publications

Self-adaptive static analysis

Self-adaptive static analysis

Obfuscation resilient search through executable classification

Heaps don't lie: countering unsoundness with heap snapshots

Contact Info

Product

Resources

About