WCET squeezing

Knoop, Jens; Kovács, Laura; Zwirchmayr, Jakob

doi:10.1145/2516821.2516847

Cited by 23 publications

(2 citation statements)

References 17 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Related to our work is the large body of research in worst-case execution time analysis-in particular for real-time systems [17][18][19][20]. There are many techniques for worst-case execution time estimation leveraging model checking [21][22][23], symbolic execution [24,25], integer linear programming [23,26], abstract interpretation [27], or a combination [22]. An overview can be found in Wilhelm et al [28].…”

Section: Related Workmentioning

confidence: 99%

Complexity vulnerability analysis using symbolic execution

Luckow

Kersten

Păsăreanu

2020

Software Testing Verif & Rel

View full text Add to dashboard Cite

We describe techniques based on symbolic execution for finding software vulnerabilities that are due to algorithmic complexity. Such vulnerabilities allow an attacker to mount denial-of-service attacks to deny service to benign users or to otherwise disable a software system. The techniques use an efficient guided symbolic execution of a program to compute bounds on the worstcase complexity (for increasing input sizes) and to generate test values that trigger the worst-case behaviours. The resulting bounds are fitted to a function to obtain a prediction of the worst-case program behaviour at any input size. Scalability is achieved by using path policies that guide the symbolic execution towards worst-case paths. The policies are learned from the worst-case results obtained with exhaustive exploration at small input sizes and are applied to guide exploration at larger input sizes, where unguided exhaustive exploration is not possible. To achieve precision in the analysis, the path policies take into account the history of choices made along the path when deciding which branch to execute next. Furthermore, the computation is contextpreserving, meaning that the decision for each branch depends on the history computed with respect to the enclosing method. We further report preliminary results on a complementary technique that uses machine learning for building the path policies that guide the search. The techniques are implemented in open-source projects that build on the Symbolic Pathfinder tool for analysing Java programs. Experimental evaluation shows that the techniques can find vulnerabilities in complex Java programs and can outperform previous symbolic approaches.

show abstract

Section: Related Workmentioning

confidence: 99%

Complexity vulnerability analysis using symbolic execution

Luckow

Kersten

Păsăreanu

2020

Software Testing Verif & Rel

View full text Add to dashboard Cite

show abstract

“…In six out of seven benchmarks, the method yields precise timings. Knoop et al [39] presents a tool for WCET squeezing, which combines symbolic execution with IPET for computing a precise WCET bound. WCET Squeezing is an iterative postprocess implemented in the r-TuBound [40] toolchain.…”

Section: Symbolic Execution For Timing Analysismentioning

confidence: 99%

Symbolic execution and timed automata model checking for timing analysis of Java real-time systems

2015

View full text Add to dashboard Cite

This paper presents SYMRT, a tool based on a combination of symbolic execution and real-time model checking for timing analysis of Java systems. Symbolic execution is used for the generation of a safe and tight timing model of the analyzed system capturing the feasible execution paths. The model is combined with suitable execution environment models capturing the timing behavior of the target host platform including the Java virtual machine and complex hardware features such as caching. The complete timing model is a network of timed automata which directly facilitates safe estimates of worst and best case execution time to be determined using the UPPAAL model checker. Furthermore, the integration of the proposed techniques into the TETASARTS tool facilitates reasoning about additional timing properties such as the schedulability of periodically and sporadically released Java real-time tasks (under specific scheduling policies), worst case response time, and more.

show abstract

Facilitating program performance profiling via evolutionary symbolic execution

Aquino

Braione

Denaro

et al. 2019

Software Testing Verif & Rel

View full text Add to dashboard Cite

Summary Performance profiling can benefit from test cases that hit high‐cost executions of programs. In this paper, we investigate the problem of automatically generating test cases that trigger the worst‐case execution of programs and propose a novel technique that solves this problem with an unprecedented combination of symbolic execution and evolutionary algorithms. Our technique, which we refer to as ‘Evolutionary Symbolic Execution’, embraces the execution cost of the program paths as the fitness function to pursue the worst execution. It defines an original set of evolutionary operators, based on symbolic execution, which suitably sample the possible program paths to make the search process effective. Specifically, our technique defines a memetic algorithm that (i) incrementally evolves by steering symbolic execution to traverse new program paths that comply with execution conditions combined and refined from the currently collected worse program paths and (ii) periodically applies local optimizations to the execution conditions of the worst currently identified program path to further speed up the identification of the worst path. We report on a set of initial experiments indicating that our technique succeeds in generating good worst‐case test cases for programs with which existing approaches cannot cope. Also, we show that, as far as the problem of generating worst‐case test cases is concerned, the distinguishing evolutionary operators based on symbolic execution that we define in this paper are more effective than traditional operators that directly manipulate the program inputs.

show abstract

WCET squeezing

Cited by 23 publications

References 17 publications

Complexity vulnerability analysis using symbolic execution

Complexity vulnerability analysis using symbolic execution

Symbolic execution and timed automata model checking for timing analysis of Java real-time systems

Facilitating program performance profiling via evolutionary symbolic execution

Contact Info

Product

Resources

About