SHF: Small: Multi-Version eXecution for Managed Languages

SHF：小型：托管语言的多版本执行

• 批准号: 2227183
• 负责人: Luís Gabriel Ganchinho de Pina
• 金额: $ 54.07万
• 依托单位: University of Illinois at Chicago
• 依托单位国家: 美国
• 项目类别: Standard Grant
• 财政年份: 2023
• 资助国家: 美国
• 起止时间: 2023-07-01 至 2026-06-30
• 项目状态: 未结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=2227183&HistoricalAwards=false
• 关键词: SHF; Small; Multi; Version; eXecution

Multi-Version eXecution (MVX) allows to run multiple versions of the same program (variants) at the same time. MVX has direct applications in the broad areas of reliability (many variants can tolerate one variant crashing), security (a vulnerability exploited on one variant can be detected by the other variants), and availability (one can perform a software update on one variant while other variants keep executing). Unfortunately, current MVX cannot be applied to programs written in managed languages, which make up the vast majority of the programs used today. This project expands the applicability of MVX to managed languages, thus making MVX applicable to the majority of programs used nowadays. The project’s novelties are: (i) tools and techniques to apply MVX to popular managed languages and programs written in them, such as Java, Javascript, and Python; (ii) a direct application to apply MVX inside state-of-the-art commercial internet browsers via the Javascript code that animates and defines web pages; and (iii) tools and techniques to retrofit existing programs with MVX support with minimal developer support. The project's impacts are: to use MVX to improve the overall reliability, security, and availability of software written in managed languages, which includes critical infrastructure and modern internet browsers that millions of users in the US use every day.Current MVX techniques capture the interaction of a program with the underlying Operating System. Such approaches fail for managed languages, as managed languages have a rich runtime system with a non-deterministic behavior not directly related with the program being executed (e.g., when to perform Garbage Collection, when to perform Just-In-Time compilation, and what code to compile/optimize). In this project, the research team captures the interaction between the program and the language runtime, which effectively lifts the level of abstraction of MVX and enables novel solutions for well known limitations of MVX (e.g., multi-threading support, divergence handling). The presented approach relies on semantics-preserving automatic program transformations to enable MVX, and this project is divided in three thrusts. The first thrust focuses on JavaScript as executed inside commercial internet browsers. The second thrust focuses on Java and similar languages (e.g., C#, Python), by identifying language-level abstractions to capture via bytecode instrumentation and developing novel techniques to support MVX for multi-threaded programs. Finally, the third thrust focuses on automatic techniques that allow to execute divergent variants (e.g., two versions of the same program).This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.

多版本执行（MVX）允许同时运行同一程序的多个版本（变体）。MVX在可靠性（许多变体可以容忍一个变体崩溃）、安全性（在一个变体上利用的漏洞可以被其他变体检测到）和可用性（在其他变体继续执行时，可以在一个变体上执行软件更新）等广泛领域有直接的应用。不幸的是，当前的MVX不能应用于用托管语言编写的程序，而托管语言构成了今天使用的绝大多数程序。这个项目扩展了MVX对托管语言的适用性，从而使MVX适用于目前使用的大多数程序。该项目的新颖之处在于：(i)将MVX应用于流行的托管语言和用它们编写的程序（如Java、Javascript和Python）的工具和技术；（ii）在最先进的商业互联网浏览器中通过Javascript代码应用MVX的直接应用程序，该Javascript代码用于动画和定义网页；（iii）在最少的开发人员支持下，使用MVX支持对现有程序进行改造的工具和技术。该项目的影响是：使用MVX来提高用托管语言编写的软件的整体可靠性、安全性和可用性，其中包括美国数百万用户每天使用的关键基础设施和现代互联网浏览器。当前的MVX技术捕获程序与底层操作系统的交互。这种方法对于托管语言来说是失败的，因为托管语言有一个丰富的运行时系统，其不确定性行为与正在执行的程序没有直接关系（例如，何时执行垃圾收集，何时执行即时编译，以及编译/优化哪些代码）。在这个项目中，研究团队捕获了程序和语言运行库之间的交互，这有效地提升了MVX的抽象水平，并为MVX众所周知的局限性（例如，多线程支持，发散处理）提供了新的解决方案。所提出的方法依赖于保持语义的自动程序转换来启用MVX，该项目分为三个重点。第一个重点是在商业互联网浏览器内执行的JavaScript。第二个重点是Java和类似的语言（例如，c#, Python），通过确定通过字节码检测捕获的语言级抽象，并开发新的技术来支持多线程程序的MVX。最后，第三个重点是允许执行不同变体（例如，同一程序的两个版本）的自动技术。该奖项反映了美国国家科学基金会的法定使命，并通过使用基金会的知识价值和更广泛的影响审查标准进行评估，被认为值得支持。