Program slicing enhances a verification technique combining static and dynamic analysis

Abstract

Recent research proposed efficient methods for software verification combining static and dynamic analysis, where static analysis reports possible runtime errors (some of which may be false alarms) and test generation confirms or rejects them. However, test generation may time out on real-sized programs before confirming some alarms as real bugs or rejecting some others as unreachable.To overcome this problem, we propose to reduce the source code by program slicing before test generation. This paper presents new optimized and adaptive usages of program slicing, provides underlying theoretical results and the algorithm these usages rely on. The method is implemented in a tool prototype called sante (Static ANalysis and TEsting). Our experiments show that our method with program slicing outperforms previous combinations of static and dynamic analysis. Moreover, simplifying the program makes it easier to analyze detected errors and remaining alarms.

How Test Generation Helps Software Specification and Deductive Verification in Frama-C

“…The SANTE method [6] proposed a combination of value analysis, slicing and test generation in order to detect runtime errors. Our present work combines deductive verification with testing, treats complete E-ACSL specifications (while SANTE treated only simple assertions) and thus handles in addition a large class of functional properties that were not supported in SANTE. Future work includes further evaluation of the proposed methodology, experiments on real-size programs and a better support of E-ACSL constructs in our implementation (inductive predicates, assigns clauses, validity checks for non-input pointers).…”

“…Static analysis is performed on the source code without executing the program, whereas dynamic analysis is based on the program execution. Both are complementary and can be advantageously combined [10,3,14,6,7,5,18].…”

Survey on static program analysis results refinement approaches

“…Слайсинг программ также может использоваться для эффективного объединения статического и динамического анализа. В работе [44] описывается инструмент SANTE, который объединяет подход статического анализа для обнаружения дефектов в программах и генерацию тестов для подтверждения найденных дефектов. В связи с тем, что генерация тестов для больших программ может занимать значительное время, авторы инструмента предлагают применять слайсинг программ с целью уменьшения исходного кода, а также исключения незначительных деталей программы с точки зрения генерации теста, до начала самого процесса генерации тестов.…”

“… статический анализ и генерация тестов [40,43,45,58];  статический анализ и проверка моделей [47];  статический анализ и верификация в процессе исполнения [52];  статический анализ и симуляция исполнения [56];  статический анализ и символьное исполнение [44,60,61,63,67,68,71].…”

Efficient Verification-Driven Slicing of UML/OCL Class Diagrams

“…The most recent work on program slicing focuses on the reduction of the source code by program slicing before test generation [11]. This method is implemented in a tool called SNATE (Static Analysis and Testing).…”