一句话：介绍如何使用 WALA 框架实现多语言程序静态分析，并演示污点分析与代码机器学习图应用。
静态分析广泛用于故障定位、漏洞检测、代码克隆识别、重构和优化等任务，但自行实现静态分析器并非易事，因此工程师常借助现有框架。本教程围绕 IBM T.J. Watson Libraries for Analysis（WALA）介绍程序分析的实践方法。教程首先梳理理解相关算法与技术实现所需的背景知识，随后概述 WALA 框架及其对 Java 字节码、JavaScript、Android、Python 等多语言和框架代码的分析支持，并通过多个现场演示展示如何基于 WALA 实现客户端分析。演示重点覆盖两类常见用途：安全分析中的污点分析，以及利用分析图进行代码的机器学习。
Static analysis is widely used in research and practice for multiple purposes such as fault localization, vulnerability detection, code clone identification, code refactoring, optimization, etc. Since implementing static analyzers is a non-trivial task, engineers often rely on existing frameworks to implement their techniques. The IBM T.J. Watson Libraries for Analysis (WALA) is one of such frameworks that allows the analysis of multiple environments, such as Java bytecode (and related languages), JavaScript, Android, Python, etc. In this tutorial, we walk through the process of using WALA for program analysis. First, the tutorial will cover all the required background knowledge that is necessary to understand the technical implementation details of the explained algorithms and techniques. Subsequently, we provide a technical overview of the WALA framework and its support for analysis of multiple programming languages and frameworks code. Then, we will do several live demonstration of using WALA to implement client analyses. We will focus on two common uses of analysis: a form of security analysis, taint analysis, and on using analysis graphs for machine learning of code.
DOI 原文 ·
@inproceedings{paperbot7067,
title = {Program analysis using WALA (tutorial)},
author = {Joanna C. S. Santos and Julian Dolby},
booktitle = {FSE},
year = {2022},
doi = {10.1145/3540250.3569449}
}