SHF:Small: Rooting Out Data- and Control-Flow Anomalies in Event-Based Systems

分布式基于事件（DEB）的软件系统非常广泛，跨越不同的领域，例如用户界面、金融市场、物流和移动应用程序。与传统的软件系统不同，在DEB系统中，软件组件不直接交互，而是依赖代理来传输数据和不同事件的通知。因此，DEB系统中的组件是高度解耦的，从而产生可伸缩的、易于发展的应用程序。然而，这种灵活性和可伸缩性是有代价的：很难准确地了解DEB系统的结构和功能，这使得很难确保DEB系统的预期行为和没有安全漏洞。为了处理传统软件系统中的类似问题，已经开发了许多技术。然而，这些技术在应用于DEB系统时提供了不充分和/或误导性的信息。该项目提供了一套工具，用于确保针对DEB系统的软件正确性、可靠性和安全性。该项目通过开发新的程序分析、运行时监控和可视化技术来实现这一点，这些技术解释了DEB系统中固有的隐式调用、并发性和模糊接口。该项目的具体重点是(1)导致正确性和可靠性问题的数据流异常，以及(2)导致安全性问题的数据流和控制流异常。这项研究的广泛影响是直接的：它为工程师提供了广泛的重要软件开发领域的分析和可视化技术，这些技术可与传统领域中可用的技术相媲美。一方面，DEB系统的灵活性预示着它们的持续采用和扩展。另一方面，在理解、分析、调试、发展和保护DEB系统方面的障碍阻碍了这种采用。这项研究在提供必要的补救措施和帮助实现DEB系统的全部潜力的方向上迈出了重要的一步。

Distributed event-based (DEB) software systems are widespread, spanning diverse domains such as user interfaces, financial markets, logistics, and mobile applications. Unlike traditional software systems, in DEB systems software components do not directly interact but rely on brokers to transfer data and notifications of different events. Consequently, components in DEB systems are highly decoupled, which yields scalable, easy-to-evolve applications. However, this flexibility and scalability comes at a price: It is difficult to have an accurate insight into the structure and functionality of a DEB system, which makes it difficult to ensure a DEB system's desired behavior and absence of security vulnerabilities. Many techniques have been developed for dealing with analogous issues in traditional software systems. However, those techniques provide inadequate and/or misleading information when applied to DEB systems. This project is providing a suite of tools for ensuring software correctness, reliability, and security that are specifically targeted at DEB systems. The project does so by developing novel program analysis, runtime monitoring, and visualization techniques that account for the implicit invocation, concurrency, and ambiguous interfaces inherent in DEB systems. The project's specific focus is on (1) data-flow anomalies that cause correctness and reliability issues and (2) data- and control-flow anomalies that cause security problems. The broader impact of this research is direct: It provides to engineers in a wide range of important software development domains analysis and visualization techniques that are comparable to techniques available in traditional domains. On one hand, the flexibility of DEB systems bodes well for their continued adoption and expansion. On the other hand, that adoption is impeded by obstacles in understanding, analyzing, debugging, evolving, and securing DEB systems. This research presents a significant step in the direction of providing the necessary remedies and helping to realize the full potential of DEB systems.