SMT-LIB Sequences and Regular Expressions

Bjørner, Nikolaj; Michel, Raphaël; Veanes, Margus

doi:10.29007/w5m5

Cited by 13 publications

(20 citation statements)

References 21 publications

(28 reference statements)

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In the first reduction, y is splitted and in the second reduction, x is splitted. Observe that the equivalence between RHS of [5] and RHS of [8], and the equivalence between RHS of [6] and RHS [7] form a recursion of the form of the original two clauses, causing infinite reduction.…”

Section: An Improved Algorithm For a Restricted Theory Of Stringsmentioning

confidence: 99%

“…From [6] and [7], we have y x 1 · y y 2 = Y4 · x y 1 . However, y x 1 will not cause splitting of x y 1 as VAR(x1) = x, which is the annotation of y1.…”

Section: An Improved Algorithm For a Restricted Theory Of Stringsmentioning

confidence: 99%

“…The inconsistency between validation functions can be found by comparing their DFAs. [7] surveyed a large set of existing string solvers and compared them using a table.…”

Section: Related Workmentioning

confidence: 99%

See 2 more Smart Citations

Z3-str: a z3-based string solver for web application analysis

Zheng

Zhang

Ganesh

2013

Proceedings of the 2013 9th Joint Meeting on Foundations of Software Engineering

Self Cite

162

134

View full text Add to dashboard Cite

Analyzing web applications requires reasoning about strings and non-strings cohesively. Existing string solvers either ignore non-string program behavior or support limited set of string operations. In this paper, we develop a general purpose string solver, called Z3-str, as an extension of the Z3 SMT solver through its plug-in interface. Z3-str treats strings as a primitive type, thus avoiding the inherent limitations observed in many existing solvers that encode strings in terms of other primitives. The logic of the plug-in has three sorts, namely, bool, int and string. The string-sorted terms include string constants and variables of arbitrary length, with functions such as concatenation, sub-string, and replace. The int-sorted terms are standard, with the exception of the length function over string terms. The atomic formulas are equations over string terms, and (in)-equalities over integer terms. Not only does our solver have features that enable whole program symbolic, static and dynamic analysis, but also it performs better than other solvers in our experiments. The application of Z3-str in remote code execution detection shows that its support of a wide spectrum of string operations is key to reducing false positives.

show abstract

Section: An Improved Algorithm For a Restricted Theory Of Stringsmentioning

confidence: 99%

“…From [6] and [7], we have y x 1 · y y 2 = Y4 · x y 1 . However, y x 1 will not cause splitting of x y 1 as VAR(x1) = x, which is the annotation of y1.…”

Section: An Improved Algorithm For a Restricted Theory Of Stringsmentioning

confidence: 99%

See 1 more Smart Citation

Z3-str: a z3-based string solver for web application analysis

Zheng

Zhang

Ganesh

2013

Proceedings of the 2013 9th Joint Meeting on Foundations of Software Engineering

Self Cite

162

134

View full text Add to dashboard Cite

show abstract

“…If an app does perform a string operation such as a substring, TASMAN picks a new unbound symbol, modelling that any value is possible. In the future, a more precise model may be possible when novel approaches in constraint solving [3,9] become available in production-grade solvers.…”

Section: Special Data Typesmentioning

confidence: 99%

Using targeted symbolic execution for reducing false-positives in dataflow analysis

Arzt

Rasthofer

Hahn

et al. 2015

Proceedings of the 4th ACM SIGPLAN International Workshop on State of the Art in Program Analysis

View full text Add to dashboard Cite

Static data flow analysis is an indispensable tool for finding potentially malicious data leaks in software programs. Programs, nowadays often consisting of millions of lines of code, have grown much too large to allow for a complete manual inspection. Nevertheless, security experts need to judge whether an application is trustworthy or not, developers need to find bugs, and quality experts need to assess the maturity of software products. Thus, analysts take advantage of automated data flow analysis tools to find candidates for suspicious leaks which are then further investigated. While much progress has been made in the area with a broad variety of static data flow analysis tools proposed in academia and being offered commercially, the number of false alarms raised by these tools is still a concern. Many of the false alarms are reported because the analysis tool detects data flows along paths which are not realizable at runtime, e.g., due to contradictory conditions on the path. Still, every single report is a potential issue and must be reviewed by an expert which is labor-intensive and costly. In this work, we therefore propose TASMAN, a post-analysis based on symbolic execution that removes such false data leaks along unrealizable paths from the result set. Thus, it greatly improves the usefulness of the result presented to the human analyst. In our experiments on DroidBench examples, TASMAN reduces the number of false positives by about 80% without pruning any true positives. Additionally, TASMAN also identified false positives in real-world examples which we confirmed by hand. With an average execution time of 5.4 seconds per alleged leak to be checked on large real-world applications, TASMAN is fast enough for practical use

show abstract

“…Symbolic automata originated from the intent to support regular expressions in the context of static and dynamic program analysis [43]. Lately, they were also used for supporting regular expressions (modulo label theories) in the context of modern logical inference engines [9,42].…”

Section: Introductionmentioning

confidence: 99%

Minimization of symbolic automata

D’Antoni

Veanes

2014

Proceedings of the 41st ACM SIGPLAN-SIGACT Symposium on Principles of Programming Languages

Self Cite

View full text Add to dashboard Cite

Symbolic Automata extend classical automata by using symbolic alphabets instead of finite ones. Most of the classical automata algorithms rely on the alphabet being finite, and generalizing them to the symbolic setting is not a trivial task. In this paper we study the problem of minimizing symbolic automata. We formally define and prove the basic properties of minimality in the symbolic setting, and lift classical minimization algorithms (Huffman-Moore's and Hopcroft's algorithms) to symbolic automata. While Hopcroft's algorithm is the fastest known algorithm for DFA minimization, we show how, in the presence of symbolic alphabets, it can incur an exponential blowup. To address this issue, we introduce a new algorithm that fully benefits from the symbolic representation of the alphabet and does not suffer from the exponential blowup. We provide comprehensive performance evaluation of all the algorithms over large benchmarks and against existing state-of-the-art implementations. The experiments show how the new symbolic algorithm is faster than previous implementations.

show abstract

SMT-LIB Sequences and Regular Expressions

Cited by 13 publications

References 21 publications

Z3-str: a z3-based string solver for web application analysis

Z3-str: a z3-based string solver for web application analysis

Using targeted symbolic execution for reducing false-positives in dataflow analysis

Minimization of symbolic automata

Contact Info

Product

Resources

About