SHF: Small: Practical Dynamic Program Reasoning Across Language Boundaries

SHF：小：跨语言边界的实用动态程序推理

• 批准号: 2146233
• 负责人: Haipeng Cai
• 金额: $ 48.58万
• 依托单位: Washington State University
• 依托单位国家: 美国
• 项目类别: Standard Grant
• 财政年份: 2022
• 资助国家: 美国
• 起止时间: 2022-06-01 至 2025-05-31
• 项目状态: 未结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=2146233&HistoricalAwards=false
• 关键词: SHF; Small; Practical; Dynamic; Program

Given the different and complementary strengths of various programming languages, it is well justified to combine multiple languages in developing a software system, which has become a norm in today's software practice. In fact, the vast majority (over 80%) of modern software systems are multi-language software. Meanwhile, software failures are known to be costly, and a common methodology for preventing these failures and reducing the cost is to reason about run-time behaviors of software (i.e., dynamic program reasoning). However, extant software-quality assurance support based on dynamic program reasoning still focuses on, and is limited to, software developed in single languages, largely dismissing what happens at and across language boundaries. As a result, cross-language behaviors are left unattended and holistic quality assurance of multi-language systems is critically lacking. This project aims to advance the state of knowledge about software-quality assurance by enabling practical dynamic program reasoning across language boundaries. The research will result in a new foundation of dynamic analysis and a series of application tools to diagnose cross-language correctness and security issues, which will help produce multi-language systems of improved quality. Moreover, this project will have an industrial impact realized through collaborations with and result disseminations via industrial partners, and will broaden the participation in computing of underrepresented minorities. The technical aims of the project are divided into three thrusts. First, multi-language code-construction mechanisms and their effects on the resulting software’s behavior and quality will be characterized. This will produce new knowledge about how modern multi-language software is constructed in terms of language selection and interoperation. Then, in the second thrust, practically scalable and cost-effective analyses for holistic cross-language dependence reasoning will be developed, as informed by the knowledge and insights gained from the characterization study. The key principle is to model and reason about cross-language code dependencies in a way that not only overcomes semantics disparities caused by language heterogeneity but also readily accommodates new/additional languages. The third thrust will build on the cross-language dependence reasoning to develop practically efficient and precise cross-language information flow reasoning, which will then provide immediate support for diagnosing program faults regarding functionality bugs and security vulnerabilities across language boundaries. This project will validate the generated new knowledge and techniques through extensive evaluation against real-world, complex multi-language systems in terms of scalability, cost-effectiveness, and capabilities in practical applications.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.

鉴于各种编程语言的不同和互补的优势，在开发软件系统时联合收割机使用多种语言是完全合理的，这已成为当今软件实践的一种规范。事实上，现代软件系统的绝大多数（超过80%）是多语言软件。同时，已知软件故障是昂贵的，并且用于防止这些故障并降低成本的常见方法是推理软件的运行时行为（即，动态程序推理）。然而，现存的软件质量保证支持的基础上动态程序推理仍然集中在，并仅限于，软件开发的单一语言，在很大程度上驳回发生什么和跨语言的边界。因此，跨语言行为被忽视，多语言系统的整体质量保证严重缺乏。该项目旨在通过实现跨语言边界的实用动态程序推理来推进有关软件质量保证的知识状态。该研究将为动态分析奠定新的基础，并开发一系列诊断跨语言正确性和安全性问题的应用工具，这将有助于提高多语言系统的质量。此外，该项目将通过与工业伙伴的合作和成果传播产生工业影响，并将扩大代表性不足的少数群体对计算的参与。该项目的技术目标分为三个方面。首先，多语言代码的建设机制和它们对软件的行为和质量的影响的特点。这将产生关于现代多语言软件如何在语言选择和互操作方面构建的新知识。然后，在第二个推力，实际上可扩展的和具有成本效益的分析整体跨语言依赖推理将开发，从表征研究中获得的知识和见解告知。关键原则是对跨语言代码依赖性进行建模和推理，不仅要克服语言异质性造成的语义差异，而且要容易适应新的/额外的语言。第三个重点将建立在跨语言依赖推理的基础上，以开发实际有效和精确的跨语言信息流推理，这将为诊断跨语言边界的功能错误和安全漏洞方面的程序故障提供即时支持。该项目将通过对真实世界的复杂多语言系统的可扩展性、成本效益和实际应用能力的广泛评估，验证所产生的新知识和技术。该奖项反映了NSF的法定使命，并通过使用基金会的知识价值和更广泛的影响审查标准进行评估，被认为值得支持。

项目成果

PolyFax: a toolkit for characterizing multi-language software

PolyFax：用于表征多语言软件的工具包

• DOI: 10.1145/3540250.3558925
• 发表时间: 2022
• 期刊: Proceedings of the 30th ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering
• 作者: Li, Wen;Li, Li;Cai, Haipeng
• 通讯作者: Cai, Haipeng

PolyCruise: A Cross-Language Dynamic Information Flow Analysis

PolyCruise：跨语言动态信息流分析

• 发表时间: 2022
• 期刊: Proceedings of the 31st USENIX Security Symposium
• 作者: Wen Li, Jiang Ming

Language-agnostic dynamic analysis of multilingual code: promises, pitfalls, and prospects

与语言无关的多语言代码动态分析：承诺、陷阱和前景

• DOI: 10.1145/3540250.3560880
• 发表时间: 2022
• 期刊: Proceedings of the 30th ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering
• 作者: Yang, Haoran;Li, Wen;Cai, Haipeng
• 通讯作者: Cai, Haipeng

Understanding Language Selection in Multi-language Software Projects on GitHub

了解 GitHub 上多语言软件项目中的语言选择

• DOI: 10.1109/icse-companion52605.2021.00119
• 发表时间: 2021
• 期刊: IEEE/ACM 43rd International Conference on Software Engineering: Companion Proceedings (ICSE-Companion
• 作者: Li, Wen;Meng, Na;Li, Li;Cai, Haipeng
• 通讯作者: Cai, Haipeng

On the vulnerability proneness of multilingual code

多语言代码的漏洞倾向

• DOI: 10.1145/3540250.3549173
• 发表时间: 2022
• 期刊: Proceedings of the 30th ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering
• 作者: Li, Wen;Li, Li;Cai, Haipeng
• 通讯作者: Cai, Haipeng