一句话：提出不变式引导的乐观指针分析，在运行时验证乐观假设，平均将指向集缩小13.15倍。
指针分析对许多软件安全缓解手段至关重要，但其结果往往不精确：报告的指向集是程序执行中可能形成的真实指向集的超集。为提升精度，作者提出 Kaleidoscope，它采用不变式引导的乐观（IGO）指针分析：分析阶段做出乐观假设，随后在运行时对这些假设进行验证；若假设在运行时不再成立，则回退到不精确的基线分析，从而保持可靠性（soundness）。在9个应用上的评估表明，相较于当前最先进的指针分析框架，Kaleidoscope 平均将指向集大小缩减13.15倍。作者还展示了如何利用 Kaleidoscope 实现控制流完整性（CFI），以增强传统 CFI 策略的安全性。
Pointer analysis techniques are crucial for many software security mitigation approaches. However, these techniques suffer from imprecision; hence, the reported points-to sets are a superset of the actual points-to sets that can possibly form during program execution. To improve the precision of pointer analysis techniques, we propose Kaleidoscope. By using an invariant-guided optimistic (IGO) pointer analysis approach, Kaleidoscope makes optimistic assumptions during the pointer analysis that it later validates at runtime. If these optimistic assumptions do not hold true at runtime, Kaleidoscope falls back to an imprecise baseline analysis, thus preserving soundness. We show that Kaleidoscope reduces the average points-to set size by 13.15× across a set of 9 applications over the current state-of-the-art pointer analysis framework. Furthermore, we demonstrate how Kaleidoscope can implement control flow integrity (CFI) to increase the security of traditional CFI policies.