What Do We Know About Language Equations?

Kunc, Michal

doi:10.1007/978-3-540-73208-2_3

Cited by 31 publications

(10 citation statements)

References 53 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Some of the problems discussed in this work are similar to those in the recent decision procedure literature, but focuses more on complexity bounds and decidability results. Kunc provides an overview of this area [14,13]. The idea of treating a constraint solving problem as an explicit search problem is not new; many existing decision procedures are built around backtracking search (e.g., [24]).…”

Section: Related Workmentioning

confidence: 99%

Solving string constraints lazily

Hooimeijer

Weimer

2010

Proceedings of the IEEE/ACM International Conference on Automated Software Engineering

View full text Add to dashboard Cite

Decision procedures have long been a fixture in program analysis, and reasoning about string constraints is a key element in many program analyses and testing frameworks. Recent work on string analysis has focused on providing decision procedures that model string operations. Separating string analysis from its client applications has important and familiar benefits: it enables the independent improvement of string analysis tools and it saves client effort.We present a constraint solving algorithm for equations over string variables. We focus on scalability with regard to the size of the input constraints. Our algorithm performs an explicit search for a satisfying assignment; the search space is constructed lazily based on an automata representation of the constraints. We evaluate our approach by comparing its performance with that of existing string decision procedures. Our prototype is, on average, several orders of magnitude faster than the fastest existing implementation.

show abstract

Section: Related Workmentioning

confidence: 99%

Solving string constraints lazily

Hooimeijer

Weimer

2010

Proceedings of the IEEE/ACM International Conference on Automated Software Engineering

View full text Add to dashboard Cite

show abstract

“…There has been extensive theoretical work on language equations; Kunc provides an overview [28]. Work in this area has typically focused on complexity bounds and decidability results.…”

Section: Related Workmentioning

confidence: 99%

A decision procedure for subset constraints over regular languages

HooimeijerPieter

WeimerWestley

2009

SIGPLAN Not.

View full text Add to dashboard Cite

Reasoning about string variables, in particular program inputs, is an important aspect of many program analyses and testing frameworks. Program inputs invariably arrive as strings, and are often manipulated using high-level string operations such as equality checks, regular expression matching, and string concatenation. It is difficult to reason about these operations because they are not well-integrated into current constraint solvers.We present a decision procedure that solves systems of equations over regular language variables. Given such a system of constraints, our algorithm finds satisfying assignments for the variables in the system. We define this problem formally and render a mechanized correctness proof of the core of the algorithm. We evaluate its scalability and practical utility by applying it to the problem of automatically finding inputs that cause SQL injection vulnerabilities.

show abstract

“…A subset of work on explicit state space model checking (e.g., [3]) has focused on general algorithms to perform fast state space reduction. Similarly, there is theoretical work on word equations that involves automata [1,17], as well as algorithms work on the efficient construction of automata from regular expressions (e.g., [14]). …”

Section: Related Workmentioning

confidence: 99%

An Evaluation of Automata Algorithms for String Analysis

Hooimeijer

Veanes

2011

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Abstract. There has been significant recent interest in automated reasoning techniques, in particular constraint solvers, for string variables. These techniques support a wide variety of clients, ranging from static analysis to automated testing. The majority of string constraint solvers rely on finite automata to support regular expression constraints. For these approaches, performance depends critically on fast automata operations such as intersection, complementation, and determinization. Existing work in this area has not yet provided conclusive results as to which core algorithms and data structures work best in practice.In this paper, we study a comprehensive set of algorithms and data structures for performing fast automata operations. Our goal is to provide an apples-to-apples comparison between techniques that are used in current tools. To achieve this, we re-implemented a number of existing techniques. We use an established set of regular expressions benchmarks as an indicative workload. We also include several techniques that, to the best of our knowledge, have not yet been used for string constraint solving. Our results show that there is a substantial performance difference across techniques, which has implications for future tool design.

show abstract

What Do We Know About Language Equations?

Cited by 31 publications

References 53 publications

Solving string constraints lazily

Solving string constraints lazily

A decision procedure for subset constraints over regular languages

An Evaluation of Automata Algorithms for String Analysis

Contact Info

Product

Resources

About