一句话:实证揭示现有去膨胀技术常过度拟合所用输入、通用性低,并提出两种可提升通用性而不显著牺牲缩减的增强方法。
程序去膨胀(debloating)通常依据一组输入构成的用法画像来识别要保留的程序特征,产出对这些输入行为正确的精简程序。但只关注缩减会使结果过度拟合所用输入,因此还需考虑通用性,即去膨胀后程序对画像外输入仍保持正确行为的程度,而现有评估大多只报告缩减。为此,作者对 4 种技术(3 种最新方法与 1 种基线)在 25 个程序及其不同输入集上评估了缩减与通用性,发现这些方法确实会产生过度拟合、通用性低的结果。基于此,作者提出两种增强方法,评估表明它们能在不明显牺牲体积缩减的前提下提升通用性,并给出了按需选择方法的指南。
Existing approaches for program debloating often use a usage profile, typically provided as a set of inputs, for identifying the features of a program to be preserved. Specifically, given a program and a set of inputs, these techniques produce a reduced program that behaves correctly for these inputs. Focusing only on reduction, however, would typically result in programs that are overfitted to the inputs used for debloating. For this reason, another important factor to consider in the context of debloating is generality, which measures the extent to which a debloated program behaves correctly also for inputs that were not in the initial usage profile. Unfortunately, most evaluations of existing debloating approaches only consider reduction, thus providing partial information on the effectiveness of these approaches. To address this limitation, we perform an empirical evaluation of the reduction and generality of 4 debloating techniques, 3 state-of-the-art ones, and a baseline, on a set of 25 programs and different sets of inputs for these programs. Our results show that these approaches can indeed produce programs that are overfitted to the inputs used and have low generality. Based on these results, we also propose two new augmentation approaches and evaluate their effectiveness. The results of this additional evaluation show that these two approaches can help improve program generality without significantly affecting size reduction. Finally, because different approaches have different strengths and weaknesses, we also provide guidelines to help users choose the most suitable approach based on their specific needs and context.