Parameterized model counting for string and numeric constraints

Aydin, Abdulbaki; Eiers, William; Bang, Lucas; Brennan, Tegan; Gavrilov, Miroslav; Bultan, Tevfik; Yu, Fang

doi:10.1145/3236024.3236064

Cited by 24 publications

(13 citation statements)

References 27 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The experimental results show that our approach outperforms fuzzing and is also effective in finding bugs in other types of solvers, as we demonstrate on the automata-based solver MT-ABC [11].…”

Section: Experimental Evaluationmentioning

confidence: 62%

“…Our technique is also not specific to SMT solvers. Since it treats the solver under test as a black box, it can be also applied to test the soundness and precision of other solvers, for instance, automatabased solvers, like SMC [26], ABC [10], and MT-ABC [11]. These solvers encode the input constraints as finite automata and determine their satisfiability by counting the number of possible models.…”

Section: Generating Unsatisfiable Formulasmentioning

confidence: 99%

“…Our technique generates satisfiable formulas together with models, and unsatisfiable formulas together with unsat cores; as they are incrementally complex, these formulas facilitate debugging and faster error localization. • We implemented our technique and evaluated it on three widely-used SMT solvers, Z3-seq [7,15], Z3str3 [13], and CVC4 [25], as well as on the automata-based solver MT-ABC [11]. Our experimental results show that our technique effectively detects soundness problems, and outperforms state-of-the-art fuzzing techniques in doing so.…”

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

Automatically testing string solvers

Bugariu

Müller

2020

Proceedings of the ACM/IEEE 42nd International Conference on Software Engineering

View full text Add to dashboard Cite

SMT solvers are at the basis of many applications, such as program verification, program synthesis, and test case generation. For all these applications to provide reliable results, SMT solvers must answer queries correctly. However, since they are complex, highlyoptimized software systems, ensuring their correctness is challenging. In particular, state-of-the-art testing techniques do not reliably detect when an SMT solver is unsound.In this paper, we present an automatic approach for generating test cases that reveal soundness errors in the implementations of string solvers, as well as potential completeness and performance issues. We synthesize input formulas that are satisfiable or unsatisfiable by construction and use this ground truth as test oracle. We automatically apply satisfiability-preserving transformations to generate increasingly-complex formulas, which allows us to detect many errors with simple inputs and, thus, facilitates debugging.The experimental evaluation shows that our technique effectively reveals bugs in the implementation of widely-used SMT solvers and applies also to other types of solvers, such as automatabased solvers. We focus on strings here, but our approach carries over to other theories and their combinations. CCS CONCEPTS• Software and its engineering → Software testing and debugging.

show abstract

Section: Experimental Evaluationmentioning

confidence: 62%

Section: Generating Unsatisfiable Formulasmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Automatically testing string solvers

Bugariu

Müller

2020

Proceedings of the ACM/IEEE 42nd International Conference on Software Engineering

View full text Add to dashboard Cite

show abstract

“…The constraint language for ABC supports all numeric constraints solved by off the shelf constraints solvers as well as typical string operations such as charAt, length, indexOf, substring, begins, concat, <, =, etc. Given a constraint C, ABC constructs a multi-track deterministic finite automaton (DFA) A C that characterizes all solutions for the constraint C, where L(A C ) corresponds to the set of solutions for C. For each string term γ or integer term β in the constraint grammar [4], ABC implements an automata constructor function which generates an automaton A that encodes the set of satisfying solutions for the term. Note that variables within string terms and integer terms appear in separate automata, as separate encodings are used for each (ASCII for strings, binary encoding for integers).…”

Section: Automata-based Constraint Solving and Model Countingmentioning

confidence: 99%

Incremental Attack Synthesis

Saha

Eiers

Kadron

et al. 2019

SIGSOFT Softw. Eng. Notes

Self Cite

View full text Add to dashboard Cite

Information leakage is a significant problem in modern software systems. Information leaks due to side channels are especially hard to detect and analyze. In this paper, we present techniques for automated synthesis of adaptive side-channel attacks that recover secret values. Our attack synthesis techniques iteratively generate inputs which, when fed to code that accesses the secret, reveal partial information about the secret based on the side-channel observations, reducing the remaining uncertainty about the secret in each attack step. Our approach is incremental, reusing results from prior iterations in each attack step to improve the efficiency of attack synthesis. We use symbolic execution to extract path constraints, automata-based model counting to estimate probabilities of execution paths, and meta-heuristics to maximize information gain based on entropy in order to minimize the number of synthesized attack steps.

show abstract

“…information flow analysis [16,23,29,31], Bayesian inference [8,11,26], and compiler optimization [25]. Originally stated with respect to Boolean formulas [5], more recent advances in model counting have extended counting capabilities to the theories of linear integer arithmetic [19,30], non-linear numeric constraints [6], strings [20,27,28], word-level counting for bit-vectors applied to the problem of automatic inference [7], and more recent work has begun to combine theories of strings and integers [2]. This paper presents the first tool with the capability of performing model counting directly on formulas with symbolic arrays.…”

mentioning

confidence: 99%

MCBAT: a practical tool for model counting constraints on bounded integer arrays

Molavi

Downing

Schneider

et al. 2020

Proceedings of the 28th ACM Joint Meeting on European Software Engineering Conference and Symposium on the Foundations of Softw

Self Cite

View full text Add to dashboard Cite

Model counting procedures for data structures are crucial for advancing the field of automated quantitative program analysis. We present a tool for Model Counting for Bounded Array Theory (MCBAT). MCBAT works on quantified integer array constraints in which all arrays have a finite length. We employ reductions from the theory of arrays to uninterpreted functions and linear integer arithmetic (LIA). Once reduced to LIA, we leverage Barvinok's polynomial time integer lattice point enumeration algorithm. Finally, we present a case study demonstrating applicability to automated quantitative program analysis. MCBAT is available for immediate use as a Docker image and the source code is freely available in our Github repository. CCS CONCEPTS • Software and its engineering → Formal methods; • Mathematics of computing → Combinatoric problems.

show abstract

Parameterized model counting for string and numeric constraints

Cited by 24 publications

References 27 publications

Automatically testing string solvers

Automatically testing string solvers

Incremental Attack Synthesis

MCBAT: a practical tool for model counting constraints on bounded integer arrays

Contact Info

Product

Resources

About