Norn: An SMT Solver for String Constraints

Abdulla, Parosh Aziz; Atig, Mohamed Faouzi; Chen, Yu‐Fang; Holík, Lukáš; Rezine, Ahmed; Rümmer, Philipp; Stenman, Jari

doi:10.1007/978-3-319-21690-4_29

Cited by 69 publications

(84 citation statements)

References 9 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…(1) Besides the length bound, on what factors does the running time of counting algorithm depend? (2) Why are the values of α estimated from the experimental results larger than the theoretical result α = 2? For the first question (1), the empirical results show that beside length bound, the size of the input CFG also affects the running time.…”

Section: Basic Performancementioning

confidence: 96%

“…It supports equations, length, substring and replacement as constraints, but does not support regular language containment (membership). More recent tools such as CVC4 [20], S3 [30] and Norn [2] support regular language containment. For example, Norn is based on [1], which provides a sound overapproximation of the strings generated by a Horn-clause program.…”

Section: String Constraint Solvingmentioning

confidence: 99%

See 1 more Smart Citation

Counting Algorithms for Recognizable and Algebraic Series

Chu

Hashimoto

Seki

2018

IEICE Trans. Inf. & Syst.

View full text Add to dashboard Cite

SUMMARYFormal series are a natural extension of formal languages by associating each word with a value called a coefficient or a weight. Among them, recognizable series and algebraic series can be regarded as extensions of regular languages and context-free languages, respectively. The coefficient of a word w can represent quantities such as the cost taken by an operation on w, the probability that w is emitted. One of the possible applications of formal series is the string counting in quantitative analysis of software. In this paper, we define the counting problems for formal series and propose algorithms for the problems. The membership problem for an automaton or a grammar corresponds to the problem of computing the coefficient of a given word in a given series. Accordingly, we define the counting problem for formal series in the following two ways. For a formal series S and a natural number d, we define CC(S , d) to be the sum of the coefficients of all the words of length d in S and S C(S , d) to be the number of words of length d that have non-zero coefficients in S. We show that for a given recognizable series S and a natural number d, CC(S , d) can be computed in O(η log d) time where η is an upper-bound of time needed for a single state-transition matrix operation, and if the state-transition matrices of S are commutative for multiplication, S C(S , d) can be computed in polynomial time of d. We extend the notions to tree series and discuss how to compute them efficiently. Also, we propose an algorithm that computes CC(S , d) in square time of d for an algebraic series S. We show the CPU time of the proposed algorithm for computing CC(S , d) for some contextfree grammars as S, one of which represents the syntax of C language. To examine the applicability of the proposed algorithms to string counting for the vulnerability analysis, we also present results on string counting for Kaluza Benchmark.

show abstract

Section: Basic Performancementioning

confidence: 96%

Section: String Constraint Solvingmentioning

confidence: 99%

Counting Algorithms for Recognizable and Algebraic Series

Chu

Hashimoto

Seki

2018

IEICE Trans. Inf. & Syst.

View full text Add to dashboard Cite

show abstract

“…In recent years, many algorithms for solving string constraints have been developed and implemented in SMT solvers such as Norn [6], CVC4 [12], and Z3 (e.g., Z3str2 [13] and Z3str3 [7]). To validate and benchmark these solvers, their developers have relied on hand-crafted input suites [1,4,5] or real-world examples from a limited set of industrial applications [2,11].…”

Section: Introductionmentioning

confidence: 99%

StringFuzz: A Fuzzer for String Solvers

Blotsky

Mora

Berzish

et al. 2018

Computer Aided Verification

View full text Add to dashboard Cite

Abstract. In this paper, we introduce StringFuzz: a modular SMT-LIB problem instance transformer and generator for string solvers. We supply a repository of instances generated by StringFuzz in SMT-LIB 2.0/2.5 format. We systematically compare Z3str3, CVC4, Z3str2, and Norn on groups of such instances, and identify those that are particularly challenging for some solvers. We briefly explain our observations and show how StringFuzz helped discover causes of performance degradations in Z3str3.

show abstract

“…Among them, Stranger, JST, StringGraph, S3, Z3-str2, and CVC4 support the most number of string operations (e.g., startsWith, endsWith, replace, replaceAll, length, and matches) that are essential in the context of vulnerability detection; they also support numeric constraints. Although Hampi and Kaluza have been widely-used as benchmarks for evaluating other solvers (see [7]- [9], [48]), they actually support only a smaller set of string operations than the solvers listed above; also, Hampi does not support numeric constraints. Support for regular expressions (which are usually used in attack specifications) is only provided -often in a limited form -by Sushi, Stranger, ABC, Kaluza, S3, Z3-str2, and CVC4.…”

Section: Related Workmentioning

confidence: 99%

“…There are many constraint solvers that provide, to a certain degree, support for strings: bit-vector based solvers like Hampi [45] and Kaluza [3]; automata-based solvers like Violist [46], Stranger [6], [14], ABC [47], StrSolve [15], Pass [16], StringGraph [17], and JST [18]; word-based solvers like Norn [48], S3 [8], and the aforementioned Sushi, CVC4, and Z3-str2. Among them, Stranger, JST, StringGraph, S3, Z3-str2, and CVC4 support the most number of string operations (e.g., startsWith, endsWith, replace, replaceAll, length, and matches) that are essential in the context of vulnerability detection; they also support numeric constraints.…”

Section: Related Workmentioning

confidence: 99%

Search-Driven String Constraint Solving for Vulnerability Detection

Thomé

Shar

Bianculli

et al. 2017

2017 IEEE/ACM 39th International Conference on Software Engineering (ICSE)

View full text Add to dashboard Cite

Abstract-Constraint solving is an essential technique for detecting vulnerabilities in programs, since it can reason about input sanitization and validation operations performed on user inputs. However, real-world programs typically contain complex string operations that challenge vulnerability detection. State-ofthe-art string constraint solvers support only a limited set of string operations and fail when they encounter an unsupported one; this leads to limited effectiveness in finding vulnerabilities.In this paper we propose a search-driven constraint solving technique that complements the support for complex string operations provided by any existing string constraint solver. Our technique uses a hybrid constraint solving procedure based on the Ant Colony Optimization meta-heuristic. The idea is to execute it as a fallback mechanism, only when a solver encounters a constraint containing an operation that it does not support.We have implemented the proposed search-driven constraint solving technique in the ACO-Solver tool, which we have evaluated in the context of injection and XSS vulnerability detection for Java Web applications. We have assessed the benefits and costs of combining the proposed technique with two state-ofthe-art constraint solvers (Z3-str2 and CVC4). The experimental results, based on a benchmark with 104 constraints derived from nine realistic Web applications, show that our approach, when combined in a state-of-the-art solver, significantly improves the number of detected vulnerabilities (from 4.7% to 71.9% for Z3-str2, from 85.9% to 100.0% for CVC4), and solves several cases on which the solver fails when used stand-alone (46 more solved cases for Z3-str2, and 11 more for CVC4), while still keeping the execution time affordable in practice.

show abstract

Norn: An SMT Solver for String Constraints

Cited by 69 publications

References 9 publications

Counting Algorithms for Recognizable and Algebraic Series

Counting Algorithms for Recognizable and Algebraic Series

StringFuzz: A Fuzzer for String Solvers

Search-Driven String Constraint Solving for Vulnerability Detection

Contact Info

Product

Resources

About