Collaborative Research: SHF: Medium: Precise Static Analysis of Event-based Systems

合作研究：SHF：中：基于事件的系统的精确静态分析

• 批准号: 2106710
• 负责人: Iulian Neamtiu
• 金额: $ 60万
• 依托单位: New Jersey Institute of Technology
• 依托单位国家: 美国
• 项目类别: Standard Grant
• 财政年份: 2021
• 资助国家: 美国
• 起止时间: 2021-10-01 至 2025-09-30
• 项目状态: 未结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=2106710&HistoricalAwards=false
• 关键词: Collaborative; Research; SHF; Medium; Precise

Event-based programming is used to construct software systems withbillions of users, including mobile apps, Web clients and servers, andInternet-of-Things devices. Despite their popularity, event-basedsystems are poorly understood and prone to errors because theunderlying platform, not the program, generates and invokesevents. These difficulties have wide-ranging consequences such aslosing users' work in mobile apps, silent errors or downtime in Webservices, and unexpected Internet-of-Things device behavior. Thisproject is (1) making event-based systems easier to analyze, (2)constructing an approach for extracting order between certain key eventsbefore the program runs, to prevent ordering errors, and (3) allowingrigorous reasoning about event-induced volatility, to prevent errorssuch as state loss and state inconsistency. The project isintroducing students to new approaches to event-based systemreliability, as well as providing researchers and software developerswith models and infrastructure for analyzing such systems. End-usersare expected to benefit from more reliable event-based systems, whether mobile,browser/server, or Internet-of-Things. The project is increasing theparticipation of underrepresented groups in computing via outreach,mentoring, and research involvement.Event-based systems continue to surge in popularity. The relativenovelty of this paradigm, coupled with essential programmingdifficulties (such as non-deterministic event processing, asynchronousstate manipulation, and state destruction) complicate the constructionof robust, reliable applications. Furthermore, there is a shortage ofprogram-analysis approaches and tools for this space. To address theseissues, this project is introducing program-analysis foundations andpractical tools such as event sensitivity, making eventcreation/initiation a first-class object of program analysis, andallowing precise analysis via path-based event ordering. The projectis intended to result in: static analyses that incorporate the aforementionedadvances, enabling analysis of event-based applications; as well asautomatically-constructed platform models (which addressdeficiencies in current, manual/ad-hoc platform models, and are intended to beusable in other contexts, e.g., to facilitate programunderstanding). The project is targeting the Android mobile platform,JavaScript client and server programs, as well as Internet-of-Thingsapplications. Using these tools, developers and researchers areable to gain effective insights into event-based applicationsfacilitating the construction of reliable applications as well asexposing incorrect behavior in existing programs; this, in turn isbenefiting event-based ecosystems' users.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.

基于事件的编程用于构建拥有数十亿用户的软件系统，包括移动的应用程序、Web客户端和服务器以及物联网设备。尽管基于事件的系统很受欢迎，但人们对它的理解却很少，而且容易出错，因为是底层平台而不是程序生成和调用事件。这些困难会造成广泛的后果，例如丢失用户在移动的应用程序中的工作，Web服务中的无声错误或停机，以及意外的物联网设备行为。这个项目是（1）使基于事件的系统更容易分析，（2）构建一种方法，用于在程序运行之前提取某些关键事件之间的顺序，以防止排序错误，以及（3）允许对事件引起的波动进行严格推理，以防止诸如状态丢失和状态不一致等错误。 该项目向学生介绍基于事件的系统可靠性的新方法，并为研究人员和软件开发人员提供分析此类系统的模型和基础设施。最终用户有望从更可靠的基于事件的系统中受益，无论是移动的、浏览器/服务器还是物联网。 该项目通过外展、指导和研究参与，增加了代表性不足的群体对计算的参与。基于事件的系统继续流行。 这种范式的相对新颖性，加上基本的编程困难（如非确定性事件处理，错误的状态操作和状态销毁），使健壮，可靠的应用程序的构建复杂化。 此外，这一领域缺乏程序分析方法和工具。为了解决这些问题，该项目正在引入程序分析基础和实用工具，如事件敏感性，使事件创建/启动成为程序分析的第一类对象，并通过基于路径的事件排序进行精确分析。该项目旨在实现：静态分析，结合上述进展，支持基于事件的应用程序的分析;以及自动构建的平台模型（解决当前手动/特设平台模型中的缺陷，并可用于其他环境，例如，以促进程序理解）。该项目针对Android移动的平台、JavaScript客户端和服务器程序以及物联网应用程序。利用这些工具，开发人员和研究人员能够有效地洞察基于事件的应用程序，促进可靠应用程序的构建，并揭露现有程序中的错误行为;这反过来又使基于事件的生态系统的用户受益。该奖项反映了NSF的法定使命，并通过使用基金会的智力价值和更广泛的影响审查标准进行评估，被认为值得支持。

项目成果

Detecting Potential User-data Save & Export Losses due to Android App Termination

• DOI: 10.1109/ast58925.2023.00019
• 发表时间: 2023-05
• 期刊: 2023 IEEE/ACM International Conference on Automation of Software Test (AST)
• 作者: Sydur Rahaman;Umar Farooq;Iulian Neamtiu;Zhijia Zhao