一句话：提出属性间感知的值流分析框架，通过消除多属性检查中的冗余与不一致，大幅提升可扩展性。
现代静态分析器常需同时检查几十甚至上百个值流性质，高精度要求下可扩展性较差。作者观察到核心分析引擎忽略被检查性质之间的协同关系，错失大量优化机会。本文利用属性间感知（inter-property awareness），在同时考虑多个性质时捕获并消除冗余与不一致。评估在标准基准程序和10个真实软件系统中检查20个值流性质。结果表明，该方法比现有方法快8倍以上，内存消耗仅为1/7；且未牺牲有效性：发现的39个缺陷已被开发者修复，其中4个因安全影响获得CVE编号。
Modern static analyzers often need to simultaneously check a few dozen or even hundreds of value-flow properties, causing serious scalability issues when high precision is required. A major factor to this deficiency, as we observe, is that the core static analysis engine is oblivious of the mutual synergy among the properties being checked, thus inevitably losing many optimization opportunities. Our work is to leverage the inter-property awareness and to capture redundancies and inconsistencies when many properties are considered at the same time. We have evaluated our approach by checking twenty value-flow properties in standard benchmark programs and ten real-world software systems. The results demonstrate that our approach is more than 8× faster than existing ones but consumes only 1/7 of the memory. Such substantial improvement in analysis efficiency is not achieved by sacrificing the effectiveness: at the time of writing, thirty-nine bugs found by our approach have been fixed by developers and four of them have been assigned CVE IDs due to their security impact.
DOI 原文 ·
@inproceedings{paperbot5675,
title = {Conquering the extensional scalability problem for value-flow analysis frameworks},
author = {Qingkai Shi and Rongxin Wu and Gang Fan and Charles Zhang},
booktitle = {ICSE},
year = {2020},
doi = {10.1145/3377811.3380346}
}