Static analysis for dummies: experiencing LiSA
Static analysis for dummies: experiencing LiSA
复制标题
傻瓜式静态分析：体验 LiSA
DOI：
10.1145/3460946.3464316
复制
发表时间：
2021
期刊：
影响因子：
--
通讯作者：
Agostino Cortesi
中科院分区：
文献类型：
--
作者：
Pietro Ferrara;L. Negrini;Vincenzo Arceri;Agostino Cortesi
基于语义的静态分析在能够设计和实现新的分析之前需要有重要的理论背景。不幸的是，即使是从头开始开发一个玩具静态分析器，也需要实现一个基础设施（解析器、控制流图表示、定点算法等）。这对计算机科学的本科生和硕士生来说要求太高了。这种方法的困难可以条件的软件验证，这是非常重要的安全系统的设计上的技能的收购。在本文中，我们将展示丽莎（静态分析库）如何在这方面发挥作用。丽莎实现了基本的基础设施，允许非专家用户开发甚至简单的分析（例如，数值和数值非关系域），只关注感兴趣的属性的适当表示和程序语句的合理近似的设计。
Semantics-based static analysis requires a significant theoretical background before being able to design and implement a new analysis. Unfortunately, the development of even a toy static analyzer from scratch requires to implement an infrastructure (parser, control flow graphs representation, fixpoint algorithms, etc.) that is too demanding for bachelor and master students in computer science. This approach difficulty can condition the acquisition of skills on software verification which are of major importance for the design of secure systems. In this paper, we show how LiSA (Library for Static Analysis) can play a role in that respect. LiSA implements the basic infrastructure that allows a non-expert user to develop even simple analyses (e.g., dataflow and numerical non-relational domains) focusing only on the design of the appropriate representation of the property of interest and of the sound approximation of the program statements.