一句话：通过实证研究与蜕变/差分测试，刻画并自动检测静态分析框架的程序表示缺陷。
静态分析框架（SAF）如 Soot 和 WALA 会将程序转换为调用图等程序表示，供漏洞检测、隐私泄露识别等下游分析使用，因此表示正确性至关重要。本文对 SAF 的程序表示缺陷开展系统实证研究：从四个流行框架收集 141 个 issue，归纳其根因、症状与修复策略，总结九项发现及避免和检测此类缺陷的启示。基于这些启示，作者实现自动化测试框架 SAScope，采用蜕变测试与差分测试。评估表明，SAScope 可检测 19 个程序表示缺陷，其中 6 个已被确认或修复，验证了其有效性。
Static analysis frameworks (SAFs) such as Soot and WALA have been a fundamental support in today’s software analysis. They usually adopt various analysis techniques to transform programs into different representations which imply specific properties, e.g., call graph can demonstrate the calling relationships between methods in a program, and users rely on these program representations for further analysis like vulnerability detection and privacy leakage recognition. Hence, providing proper program representation is essential for SAFs. We conducted a systematic empirical study on program representation faults of static analysis frameworks. In our study, we first collect 141 issues from four popular SAFs and summarize their root causes, symptoms, and fix strategies, and reveal nine findings and some implications to avoid and detect program representation faults. Additionally, we implemented an automated testing framework named SAScope based on the metamorphic and differential testing motivated by findings and implications. Overall, SAScope can detect 19 program representation faults where 6 of them have been confirmed or fixed, demonstrating its effectiveness.
@inproceedings{paperbot8464,
title = {Characterizing and Detecting Program Representation Faults of Static Analysis Frameworks},
author = {Huaien Zhang and Yu Pei and Shuyun Liang and Zezhong Xing and Shin Hwei Tan},
booktitle = {ISSTA},
year = {2024},
doi = {10.1145/3650212.3680398}
}