SHF:Small: Rooting Out Data- and Control-Flow Anomalies in Event-Based Systems

SHF:Small：根除基于事件的系统中的数据和控制流异常

• 批准号: 1717963
• 负责人: Nenad Medvidovic
• 金额: $ 50万
• 依托单位: University of Southern California
• 依托单位国家: 美国
• 项目类别: Standard Grant
• 财政年份: 2017
• 资助国家: 美国
• 起止时间: 2017-08-15 至 2022-07-31
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=1717963&HistoricalAwards=false
• 关键词: SHF; Small; Rooting; Out; Data

Distributed event-based (DEB) software systems are widespread, spanning diverse domains such as user interfaces, financial markets, logistics, and mobile applications. Unlike traditional software systems, in DEB systems software components do not directly interact but rely on brokers to transfer data and notifications of different events. Consequently, components in DEB systems are highly decoupled, which yields scalable, easy-to-evolve applications. However, this flexibility and scalability comes at a price: It is difficult to have an accurate insight into the structure and functionality of a DEB system, which makes it difficult to ensure a DEB system's desired behavior and absence of security vulnerabilities. Many techniques have been developed for dealing with analogous issues in traditional software systems. However, those techniques provide inadequate and/or misleading information when applied to DEB systems. This project is providing a suite of tools for ensuring software correctness, reliability, and security that are specifically targeted at DEB systems. The project does so by developing novel program analysis, runtime monitoring, and visualization techniques that account for the implicit invocation, concurrency, and ambiguous interfaces inherent in DEB systems. The project's specific focus is on (1) data-flow anomalies that cause correctness and reliability issues and (2) data- and control-flow anomalies that cause security problems. The broader impact of this research is direct: It provides to engineers in a wide range of important software development domains analysis and visualization techniques that are comparable to techniques available in traditional domains. On one hand, the flexibility of DEB systems bodes well for their continued adoption and expansion. On the other hand, that adoption is impeded by obstacles in understanding, analyzing, debugging, evolving, and securing DEB systems. This research presents a significant step in the direction of providing the necessary remedies and helping to realize the full potential of DEB systems.

基于事件的分布式软件系统（DEB）非常广泛，跨越了不同的领域，如用户界面、金融市场、物流和移动的应用。与传统的软件系统不同，在DEB系统中，软件组件不直接交互，而是依赖于代理来传输数据和不同事件的通知。因此，DEB系统中的组件是高度解耦的，这产生了可伸缩的，易于发展的应用程序。然而，这种灵活性和可扩展性是有代价的：很难准确了解DEB系统的结构和功能，这使得很难确保DEB系统的期望行为和没有安全漏洞。在传统的软件系统中，已经开发了许多技术来处理类似的问题。然而，当应用于DEB系统时，这些技术提供不充分和/或误导性的信息。该项目提供了一套工具，用于确保专门针对DEB系统的软件正确性，可靠性和安全性。该项目通过开发新颖的程序分析，运行时监控和可视化技术来实现这一点，这些技术可以解释DEB系统中固有的隐式调用，并发性和模糊接口。该项目的具体重点是（1）导致正确性和可靠性问题的数据流异常，以及（2）导致安全问题的数据流和控制流异常。这项研究的更广泛的影响是直接的：它为工程师提供了广泛的重要软件开发领域的分析和可视化技术，这些技术与传统领域的技术相当。一方面，DEB系统的灵活性预示着它们的持续采用和扩展。另一方面，这种采用受到理解，分析，调试，发展和保护DEB系统方面的障碍的阻碍。这项研究在提供必要的补救措施和帮助实现DEB系统的全部潜力方面迈出了重要的一步。

项目成果

Leveraging Program Analysis to Reduce User-Perceived Latency in Mobile Applications

• DOI: 10.1145/3180155.3180249
• 发表时间: 2018-05
• 期刊: 2018 IEEE/ACM 40th International Conference on Software Engineering (ICSE)
• 作者: Yixue Zhao;Marcelo Schmitt Laser;Yingjun Lyu;N. Medvidović

SEALANT: A detection and visualization tool for inter-app security vulnerabilities in Android

SEALANT：Android 中应用程序间安全漏洞的检测和可视化工具

• DOI: 10.1109/ase.2017.8115699
• 发表时间: 2017
• 期刊: 32nd IEEE/ACM International Conference on Automated Software Engineering (ASE 2017
• 作者: Lee, Youn Kyu;Yoodee, Peera;Shahbazian, Arman;Nam, Daye;Medvidovic, Nenad
• 通讯作者: Medvidovic, Nenad

A Microservice Architecture for Online Mobile App Optimization

• DOI: 10.1109/mobilesoft.2019.00017
• 发表时间: 2019-02
• 期刊: 2019 IEEE/ACM 6th International Conference on Mobile Software Engineering and Systems (MOBILESoft)
• 作者: Yixue Zhao;N. Medvidović

Empirically Assessing Opportunities for Prefetching and Caching in Mobile Apps

• DOI: 10.1145/3238147.3238215
• 发表时间: 2018-09
• 期刊: 2018 33rd IEEE/ACM International Conference on Automated Software Engineering (ASE)
• 作者: Yixue Zhao;Paul Wat;Marcelo Schmitt Laser;N. Medvidović