CSR: Medium: Systems Support for Scalable, Easy-to-Implement, and Multilingual Static Analyses of Modern Software

静态程序分析在学术界和工业界被广泛用于发现错误、安全漏洞和性能优化机会。几十年来，在大型代码库上支持复杂的分析算法一直是程序分析研究中的一个关键挑战。这种无能为力是阻碍基于分析的技术在工业中广泛采用的主要因素。这个项目从数据驱动的角度重新审视了这个问题，并开发了新的系统解决方案，使静态程序分析易于实现，支持大型代码库，并支持用多种语言编写的程序。该项目将开发一种具有四个要素的变革性方法：(1)开发基于磁盘的核心外系统以并行化和扩展基于约束的路径敏感分析；(2)通过将流敏感分析视为演化图形处理来开发系统支持；(3)开发一个分布式系统解决方案来解决SAT问题-一个50年的问题-使基于SAT的应用程序能够利用现代计算中可用的资源解决更大的问题；以及(4)分析Android操作系统和应用程序，以发现复杂的(A)错误，(B)安全漏洞，(C)性能问题，涉及系统与应用程序之间的交互以及多个应用程序。该项目开发的系统将使精确的静态分析算法更高效和可扩展，使它们能够处理现有技术无法分析的现代软件程序。由于许多用户和企业每天都在使用这些程序，因此使它们更加健壮和安全将惠及更广泛的社区。该项目将开发用于复杂代码分析的大数据系统，为规模化程序分析开辟新的方向。它将涉及几名博士生，并将研究注入本科生和研究生课程，以培养未来的开发人员。所有系统实施、实验数据和项目文件将在https://www.ics.uci.edu/~guoqingx/research/projects/analysis.html公开和维护。该奖项反映了美国国家科学基金会的法定使命，并通过使用基金会的智力优势和更广泛的影响审查标准进行评估，被认为值得支持。

Static program analysis has been widely used in academia and industry to find bugs, security vulnerabilities, and performance optimization opportunities. Supporting sophisticated analysis algorithms on large codebases has been a key challenge in the program analysis research for decades. This inability is the major factor that prevents analysis-based techniques from being widely adopted in industry. This project revisits this problem from a data-driven perspective and develops novel system solutions that can make static program analyses easy to implement, support large codebases, and support programs written in multiple languages.The project will develop a transformative approach with four elements: (1) develop disk-based out-of-core systems to parallelize and scale constraint-based path-sensitive analysis; (2) develop system support for flow-sensitive analysis by treating it as evolving graph processing; (3) develop a distributed system solution to SAT solving --- a 50-year old problem --- to enable SAT-based applications to solve larger problems with the resources available in modern computing; and (4) analyze the Android operating system and apps together to find complicated (a) bugs, (b) security vulnerabilities, and (c) performance problems, which involve interactions between the system and an app as well as multiple apps.The systems developed by the project will make precise static analysis algorithms more efficient and scalable, enabling them to process modern software programs that existing techniques could not analyze. Since these programs are used every day by many users and businesses, making them more robust and secure extends the benefit to a broad community. The project will develop big data systems for sophisticated code analysis, opening a new direction to scale program analysis. It will involve several PhD students and infuse research into the undergraduate and graduate curricula to train developers of the future.All the system implementations, experimental data, and documents from the project will be publicly available and maintained at https://www.ics.uci.edu/~guoqingx/research/projects/analysis.html .This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.