SHF: Small: Collaborative Research: Towards Automated Model Synthesis of Library and System Functions for Program-Environment Co-Analysis

程序分析的快速发展极大地促进了许多应用，包括安全漏洞检测、软件故障定位、性能优化等。然而，处理库函数和系统调用（也称为环境函数）在程序分析中提出了普遍和关键的挑战。尽管这些环境函数不是由开发人员编写的，但它们是程序语义的固有部分，因此对于程序分析来说，共同分析程序及其执行环境是理想的。尽管重要，但在实践中实现方案-环境共分析是一项挑战。首先，获取某些环境函数的源代码的困难排除了基于源代码的分析。此外，即使源代码是可用的，代码库往往是巨大的和复杂的，使分析困难。在这个项目中，目标是开发一个高度自动化的技术，可以构建模型的环境功能，从他们的二进制实现和一组初始输入。模型本质上是提供与被建模的功能相同的功能的程序，但实质上是简化的。这样的程序可以作为应用程序的一部分，从而实现程序-环境协同分析。所提出的技术将导致一个高度自动化的解决方案，将在很大程度上减轻程序分析开发人员手工制作模型的负担。此外，它还将使程序环境协同分析变得可行和更精确，从而能够检测到安全漏洞和其他方法无法检测到的软件缺陷。此外，PI希望拟议的研究能够促进程序分析和操作系统的学习，并提供许多机会将研究结果纳入计算机科学的相关课程。

The rapid advance of program analysis greatly benefits many applications, including security vulnerability detection, software fault localization, performance optimization, to name a few. However, handling library functions and system calls (also referred to as environmental functions) presents a pervasive and critical challenge in program analysis. Even though these environmental functions are not written by developers, they are an intrinsic part of program semantics and consequently it would be ideal for a program analysis to co-analyze the program and its execution environment. Despite its importance, achieving program-environment co-analysis in practice is challenging. First, the difficulty to acquire the source code of some environmental functions precludes source code based analysis. Moreover, even if source code is available, the code base is often prohibitively large and complex, making analysis difficult.In this project, the goal is to develop a highly automated technique that can construct models for environmental functions from their binary implementations and a set of initial inputs. The models are essentially programs that provide the same functionality of the functions being modeled, yet substantially simplified. Such programs can be included as part of the application, enabling program-environment co-analysis. The proposed technique will lead to a highly automated solution that will largely offload the onus of manually crafting models from program analysis developers' shoulders. Moreover, it will make program environment co-analysis feasible and more precise, enabling detection of security vulnerability and software defects that are otherwise undetectable. Additionally, the PIs expect the proposed research to foster learnings in both program analysis and operating systems, as well as providing many opportunities to incorporate findings to relevant courses in computer science.