Symbolic Boolean derivatives for efficiently solving extended regular expression constraints

Stanford, Caleb; Veanes, Margus; Bjørner, Nikolaj

doi:10.1145/3453483.3454066

Cited by 16 publications

(28 citation statements)

References 53 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…CertiStr aims to build a stand-alone string solver and the forward-propagation is only over the string constraints. Many developments of string solvers, string analysis techniques, and automata-theoretic techniques were also directly motivated by security vulnerability detection, e.g., [2,3,10,13,22,29,35,[37][38][39]. To the best of our knowledge, CertiStr is the first tool that provides certification of a string analysis method that is applicable to security vulnerability detection.…”

Section: Related Workmentioning

confidence: 99%

CertiStr: a certified string solver

Kan

Lin

Rümmer

et al. 2022

Proceedings of the 11th ACM SIGPLAN International Conference on Certified Programs and Proofs

View full text Add to dashboard Cite

Theories over strings are among the most heavily researched logical theories in the SMT community in the past decade, owing to the error-prone nature of string manipulations, which often leads to security vulnerabilities (e.g. cross-site scripting and code injection). The majority of the existing decision procedures and solvers for these theories are themselves intricate; they are complicated algorithmically, and also have to deal with a very rich vocabulary of operations. This has led to a plethora of bugs in implementation, which have for instance been discovered through fuzzing.In this paper, we present CertiStr, a certified implementation of a string constraint solver for the theory of strings with concatenation and regular constraints. CertiStr aims to solve string constraints using a forward-propagation algorithm based on symbolic representations of regular constraints as symbolic automata, which returns three results: sat, unsat, and unknown, and is guaranteed to terminate for the string constraints whose concatenation dependencies are acyclic. The implementation has been developed and proven correct in Isabelle/HOL, through which an effective solver in OCaml was generated. We demonstrate the effectiveness and efficiency of CertiStr against the standard Kaluza benchmark, in which 80.4% tests are in the string constraint fragment of CertiStr. Of these 80.4% tests, CertiStr can solve 83.5% (i.e. CertiStr returns sat or unsat) within 60s.

show abstract

Section: Related Workmentioning

confidence: 99%

CertiStr: a certified string solver

Kan

Lin

Rümmer

et al. 2022

Proceedings of the 11th ACM SIGPLAN International Conference on Certified Programs and Proofs

View full text Add to dashboard Cite

show abstract

“…concatenation or substring replacement. Reasoning about strings requires solving combinatorial problems involving such constraints, which is difficult to do both efficiently and completely, and a large number of approaches have been developed [1,52]. Our problem of grammar inference is in some ways the inverse: instead of wanting to model all possible strings a function can return or express, we want to model all possible strings a function can accept (without throwing an error or getting stuck).…”

Section: Related Workmentioning

confidence: 99%

Grammars for Free: Toward Grammar Inference for Ad Hoc Parsers

Schröder

Cito

2022

2022 IEEE/ACM 44th International Conference on Software Engineering: New Ideas and Emerging Results (ICSE-NIER)

View full text Add to dashboard Cite

Ad hoc parsers are everywhere: they appear any time a string is split, looped over, interpreted, transformed, or otherwise processed. Every ad hoc parser gives rise to a language: the possibly infinite set of input strings that the program accepts without going wrong. Any language can be described by a formal grammar: a finite set of rules that can generate all strings of that language. But programmers do not write grammars for ad hoc parsers-even though they would be eminently useful. Grammars can serve as documentation, aid program comprehension, generate test inputs, and allow reasoning about language-theoretic security. We propose an automatic grammar inference system for ad hoc parsers that would enable all of these use cases, in addition to opening up new possibilities in mining software repositories and bi-directional parser synthesis.

show abstract

“…It differs from previous approaches because it is actually a meta-solver or portfolio solver. Indeed, apart from the above mentioned Z3str3, Z3str4 also includes in its portfolio two additional solvers: LAS, a CEGAR-style length abstraction solver, and Z3seq [149], a Z3-based solver built on top of Z3 (see Section 4.3). Z3str4 uses algorithm selection [98] techniques to select which sequence of algorithms or "arm" is supposedly better for a given unforeseen problem instance.…”

Section: Word-based Approachesmentioning

confidence: 99%

“…As an alternative to the Boolean encoding of strings, a straightforward approach is to reason on sequences of characters (or, equivalently, integers). For example, Z3seq [149] is a Z3-based approach-not belonging to the Z3str* family-supporting a general theory of sequences over arbitrary datatypes. Hence, Z3seq can be used as a string solver by considering strings as sequences of characters.…”

Section: Unfolding-based Approachesmentioning

confidence: 99%

“…Z3seq [149] is a word-based approach that may also be considered unfolding-based because it does not implement a theory of strings, but it reduces to the theory of sequences and characters. We cannot consider it an automatabased approach, because it uses symbolic Boolean derivatives to handle regular expressions without actually building automata.…”

Section: Hybrid Approachesmentioning

confidence: 99%

See 1 more Smart Citation

A Survey on String Constraint Solving

AmadiniRoberto

2021

ACM Comput. Surv.

View full text Add to dashboard Cite

String constraint solving refers to solving combinatorial problems involving constraints over string variables. String solving approaches have become popular over the past few years given the massive use of strings in different application domains like formal analysis, automated testing, database query processing, and cybersecurity. This article reports a comprehensive survey on string constraint solving by exploring the large number of approaches that have been proposed over the past few decades to solve string constraints.

show abstract

Symbolic Boolean derivatives for efficiently solving extended regular expression constraints

Cited by 16 publications

References 53 publications

CertiStr: a certified string solver

CertiStr: a certified string solver

Grammars for Free: Toward Grammar Inference for Ad Hoc Parsers

A Survey on String Constraint Solving

Contact Info

Product

Resources

About