SHF: Small: Collaborative Research: Towards Automated Model Synthesis of Library and System Functions for Program-Environment Co-Analysis

程序分析的快速发展极大地促进了许多应用，包括安全漏洞检测、软件故障定位、性能优化等。然而，处理库函数和系统调用（也称为环境函数）在程序分析中是一个普遍而关键的挑战。尽管这些环境函数不是由开发人员编写的，但它们是程序语义的内在组成部分，因此，对于程序分析人员来说，共同分析程序及其执行环境是理想的。尽管它很重要，但在实践中实现程序-环境联合分析是具有挑战性的。首先，一些环境函数的源代码难以获取，这阻碍了基于源代码的分析。此外，即使源代码是可用的，代码库也常常是非常大和复杂的，使得分析变得困难。在这个项目中，目标是开发一种高度自动化的技术，可以根据环境函数的二进制实现和一组初始输入来构建模型。模型本质上是提供与被建模的功能相同的功能的程序，但实际上简化了。这样的程序可以作为应用程序的一部分，从而实现程序-环境协同分析。所建议的技术将导致高度自动化的解决方案，将在很大程度上减轻程序分析开发人员手工制作模型的负担。此外，它将使程序环境协同分析变得可行和更精确，从而能够检测到其他情况下无法检测到的安全漏洞和软件缺陷。此外，pi期望拟议的研究能够促进程序分析和操作系统的学习，并提供许多机会将研究结果纳入计算机科学的相关课程。

The rapid advance of program analysis greatly benefits many applications, including security vulnerability detection, software fault localization, performance optimization, to name a few. However, handling library functions and system calls (also referred to as environmental functions) presents a pervasive and critical challenge in program analysis. Even though these environmental functions are not written by developers, they are an intrinsic part of program semantics and consequently it would be ideal for a program analysis to co-analyze the program and its execution environment. Despite its importance, achieving program-environment co-analysis in practice is challenging. First, the difficulty to acquire the source code of some environmental functions precludes source code based analysis. Moreover, even if source code is available, the code base is often prohibitively large and complex, making analysis difficult.In this project, the goal is to develop a highly automated technique that can construct models for environmental functions from their binary implementations and a set of initial inputs. The models are essentially programs that provide the same functionality of the functions being modeled, yet substantially simplified. Such programs can be included as part of the application, enabling program-environment co-analysis. The proposed technique will lead to a highly automated solution that will largely offload the onus of manually crafting models from program analysis developers' shoulders. Moreover, it will make program environment co-analysis feasible and more precise, enabling detection of security vulnerability and software defects that are otherwise undetectable. Additionally, the PIs expect the proposed research to foster learnings in both program analysis and operating systems, as well as providing many opportunities to incorporate findings to relevant courses in computer science.