一句话:面向可配置静态分析工具,提出自动测试与调试框架,并开展实证研究与基准构建。
静态分析是检测真实软件缺陷的重要手段,但可配置静态分析工具的配置空间复杂且测试不足,阻碍其广泛采用。本文(博士研究)聚焦自动测试与调试此类工具:首先对 Android 可配置污点分析工具进行实证研究,理解其性能与行为;这些发现推动 ECSTATIC 框架的设计,该框架超越污点分析,可测试和调试任意可配置静态分析工具。下一步将自动创建带 ground truth 和分析特征的真实世界静态分析基准,以提升工具的可靠性。
Static analysis is an important tool for detecting bugs in real-world software. The advent of numerous analysis algorithms with their own tradeoffs has led to the proliferation of configurable static analysis tools, but their complex, undertested configuration spaces are obstacles to their widespread adoption. To improve the reliability of these tools, my research focuses on developing new approaches to automatically test and debug them. First, I describe an empirical study that helps to understand the performance and behavior of configurable taint analysis tools for Android. The findings of this study motivate the development of ECSTATIC, a framework for testing and debugging that goes beyond taint analysis to test any configurable static analysis tool. The next steps for this research involve the automatic creation of real-world benchmarks for static analysis with associated ground truths and analysis features.