CSR: Medium: Systems Support for Scalable, Easy-to-Implement, and Multilingual Static Analyses of Modern Software

点击翻译按钮获取中文摘要

Static program analysis has been widely used in academia and industry to find bugs, security vulnerabilities, and performance optimization opportunities. Supporting sophisticated analysis algorithms on large codebases has been a key challenge in the program analysis research for decades. This inability is the major factor that prevents analysis-based techniques from being widely adopted in industry. This project revisits this problem from a data-driven perspective and develops novel system solutions that can make static program analyses easy to implement, support large codebases, and support programs written in multiple languages.The project will develop a transformative approach with four elements: (1) develop disk-based out-of-core systems to parallelize and scale constraint-based path-sensitive analysis; (2) develop system support for flow-sensitive analysis by treating it as evolving graph processing; (3) develop a distributed system solution to SAT solving --- a 50-year old problem --- to enable SAT-based applications to solve larger problems with the resources available in modern computing; and (4) analyze the Android operating system and apps together to find complicated (a) bugs, (b) security vulnerabilities, and (c) performance problems, which involve interactions between the system and an app as well as multiple apps.The systems developed by the project will make precise static analysis algorithms more efficient and scalable, enabling them to process modern software programs that existing techniques could not analyze. Since these programs are used every day by many users and businesses, making them more robust and secure extends the benefit to a broad community. The project will develop big data systems for sophisticated code analysis, opening a new direction to scale program analysis. It will involve several PhD students and infuse research into the undergraduate and graduate curricula to train developers of the future.All the system implementations, experimental data, and documents from the project will be publicly available and maintained at https://www.ics.uci.edu/~guoqingx/research/projects/analysis.html .This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.