Scalable error detection using boolean satisfiability

Xie, Yichen; Aiken, Alex

doi:10.1145/1040305.1040334

Cited by 184 publications

(175 citation statements)

References 18 publications

Supporting

Mentioning

175

Contrasting

Order By: Relevance

“…Slicing is a solution known to be effective for making constraint solving scale [Xie and Aiken 2007]. Other approaches that rely upon model slicing to improve the performance of constraint solvers exist, but they focus mostly on the slicing of static models for satisfiability purposes (i.e.…”

Section: Related Workmentioning

confidence: 99%

Augmenting Field Data for Testing Systems Subject to Incremental Requirements Changes

Nardo

Pastore

Briand

2017

ACM Trans. Softw. Eng. Methodol.

View full text Add to dashboard Cite

When testing data processing systems, software engineers often use real world data to perform system level testing. However, in the presence of new data requirements software engineers may no longer benefit from having real world data with which to perform testing. Typically, new test inputs complying with the new requirements have to be manually written.We propose an automated model-based approach that combines data modelling and constraint solving to modify existing field data to generate test inputs for testing new data requirements. The approach scales in the presence of complex and structured data, thanks to both the reuse of existing field data and the adoption of an innovative input generation algorithm based on slicing the model into parts.We validated the scalability and effectiveness of the proposed approach using an industrial case study. The empirical study shows that the approach scales in the presence of large amounts of structured and complex data. The approach can produce, within a reasonable time, test input data that is over ten times larger in size than the data generated with constraint solving only. We also demonstrate that the generated test inputs achieve more code coverage than the test cases implemented by experienced software engineers.

show abstract

Section: Related Workmentioning

confidence: 99%

Augmenting Field Data for Testing Systems Subject to Incremental Requirements Changes

Nardo

Pastore

Briand

2017

ACM Trans. Softw. Eng. Methodol.

View full text Add to dashboard Cite

show abstract

“…Explicit flow analysis tools [9,16,24] can be used to detect a variety of integrity violations, such as SQL injection vulnerabilities [16,9], format string vulnerabilities [6,21], missed access control checks [25], and user-kernel pointer bugs [13]. These tools can also be used to check confidentiality-oriented properties, to ensure that secret data is not inadvertently leaked.…”

Section: Program Analysis For Securitymentioning

confidence: 99%

Implicit Flows: Can’t Live with ‘Em, Can’t Live without ‘Em

King

Hicks

et al. 2008

Information Systems Security

View full text Add to dashboard Cite

Abstract. Verifying that programs trusted to enforce security actually do so is a practical concern for programmers and administrators. However, there is a disconnect between the kinds of tools that have been successfully applied to real software systems (such as taint mode in Perl and Ruby), and information-flow compilers that enforce a variant of the stronger security property of noninterference. Tools that have been successfully used to find security violations have focused on explicit flows of information, where high-security information is directly leaked to output. Analysis tools that enforce noninterference also prevent implicit flows of information, where high-security information can be inferred from a program's flow of control. However, these tools have seen little use in practice, despite the stronger guarantees that they provide.To better understand why, this paper experimentally investigates the explicit and implicit flows identified by the standard algorithm for establishing noninterference. When applied to implementations of authentication and cryptographic functions, the standard algorithm discovers many real implicit flows of information, but also reports an extremely high number of false alarms, most of which are due to conservative handling of unchecked exceptions (e.g., null pointer exceptions). After a careful analysis of all sources of true and false alarms, due to both implicit and explicit flows, the paper concludes with some ideas to improve the false alarm rate, toward making stronger security analysis more practical.

show abstract

“…Saturn [25] is an efficient software error-detection tool that, like CBMC, translates C programs into boolean formulae that are then fed to a SAT solver. One of the distinguishing features of Saturn w.r.t.…”

Section: Related Workmentioning

confidence: 99%

Bounded Model Checking of Software Using SMT Solvers Instead of SAT Solvers

Armando

Mantovani

Platania

2006

Model Checking Software

109

View full text Add to dashboard Cite

Abstract. C Bounded Model Checking (CBMC) is one of the leading approaches to automatic software analysis. The key idea is to (i) build a propositional formula whose models correspond to program traces (of bounded length) that violate some given property and (ii) use state-ofthe-art SAT solvers to check the resulting formulae for satisfiability. In this paper we propose a generalisation of the CBMC approach based on an encoding into richer (but still decidable) theories than propositional logic. We show that our approach may lead to considerably more compact formulae than those obtained with CBMC. We have built a prototype implementation of our technique that uses a Satisfiability Modulo Theories (SMT) solver to solve the resulting formulae. Computer experiments indicate that our approach compares favourably with and on some significant problems outperforms CBMC.

show abstract

Scalable error detection using boolean satisfiability

Cited by 184 publications

References 18 publications

Augmenting Field Data for Testing Systems Subject to Incremental Requirements Changes

Augmenting Field Data for Testing Systems Subject to Incremental Requirements Changes

Implicit Flows: Can’t Live with ‘Em, Can’t Live without ‘Em

Bounded Model Checking of Software Using SMT Solvers Instead of SAT Solvers

Contact Info

Product

Resources

About