2008 Eighth IEEE International Working Conference on Source Code Analysis and Manipulation最新文献_第3页

From Indentation Shapes to Code Structures 从缩进形状到代码结构

2008 Eighth IEEE International Working Conference on Source Code Analysis and Manipulation Pub Date : 2008-10-03 DOI: 10.1109/SCAM.2008.31

Abram Hindle, Michael W. Godfrey, R. Holt

{"title":"From Indentation Shapes to Code Structures","authors":"Abram Hindle, Michael W. Godfrey, R. Holt","doi":"10.1109/SCAM.2008.31","DOIUrl":"https://doi.org/10.1109/SCAM.2008.31","url":null,"abstract":"In a previous study, we showed that indentation was regular across multiple languages and the variance in the level of indentation of a block of revised code is correlated with metrics such as McCabe cyclomatic complexity. Building on that work the current paper investigates the relationship between the \"shape'' of the indentation of the revised code block (the \"revision'') and the corresponding syntactic structure of the code. We annotated revisions matching these three indentation shapes: \"flat'' (all lines are equally indented), \"slash'' (indentation becomes increasingly deep), or \"bubble'' (indentation increases and then decreases). We then classified the code structure as one of: function definition, loop, expression, comment, etc. We studied thousands of revisions, coming from over 200 software projects, written in a variety of languages. Our study indicates that indentation shape correlates positively with code structure; that is, certain shapes typically correspond to certain code structures. For example, flat shapes commonly correspond to comments while bubble shapes commonly correspond to conditionals and function definitions. These results can form the basis of a tool framework that can analyze code in a language independent way to support browsing targeted to viewing particular code structures such as conditionals or comments.","PeriodicalId":433693,"journal":{"name":"2008 Eighth IEEE International Working Conference on Source Code Analysis and Manipulation","volume":"10 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2008-10-03","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"127665955","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 6

Automated Detection of Code Vulnerabilities Based on Program Analysis and Model Checking 基于程序分析和模型检查的代码漏洞自动检测

2008 Eighth IEEE International Working Conference on Source Code Analysis and Manipulation Pub Date : 2008-10-03 DOI: 10.1109/SCAM.2008.24

Lei Wang, Qiang Zhang, Peng Zhao

{"title":"Automated Detection of Code Vulnerabilities Based on Program Analysis and Model Checking","authors":"Lei Wang, Qiang Zhang, Peng Zhao","doi":"10.1109/SCAM.2008.24","DOIUrl":"https://doi.org/10.1109/SCAM.2008.24","url":null,"abstract":"Ensuring the correctness and reliability of software systems is one of the main problems in software development. Model checking, a static analysis method, is preponderant in improving the precision of vulnerabilities detection. However, when applied to buffer overflow and other bugs, it is hard to automatically construct the model for detecting the vulnerabilities. To address this problem we propose an approach that combines constraint based analysis and model checking together. We trace the memory size of buffer-related variables and instrument the code with corresponding constraint assertions before the potential vulnerable points by constraint based analysis. Then the problem of detecting vulnerabilities is converted into the problem of detecting vulnerabilities to verifying the reach ability of these assertions by model checking. In order to reduce the cost of model checking, program slicing is introduced to reduce the code size. CodeAuditor is a prototype implementation of our approach. With CodeAuditor, several yet unreported vulnerabilities are discovered in several open source software, and the performance is shown to be improved significantly with the help of program slicing.","PeriodicalId":433693,"journal":{"name":"2008 Eighth IEEE International Working Conference on Source Code Analysis and Manipulation","volume":"11 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2008-10-03","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"130084067","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 36

Exploiting the Correspondence between Micro Patterns and Class Names 利用微模式和类名之间的对应关系

2008 Eighth IEEE International Working Conference on Source Code Analysis and Manipulation Pub Date : 2008-10-03 DOI: 10.1109/SCAM.2008.23

Jeremy Singer, C. Kirkham

引用次数: 31

TBCppA: A Tracer Approach for Automatic Accurate Analysis of C Preprocessor's Behaviors TBCppA:一种自动准确分析C预处理器行为的示踪方法

2008 Eighth IEEE International Working Conference on Source Code Analysis and Manipulation Pub Date : 2008-10-03 DOI: 10.1109/SCAM.2008.13

K. Gondow, Hayato Kawashima, T. Imaizumi

引用次数: 1

90% Perspiration: Engineering Static Analysis Techniques for Industrial Applications 90%的汗水:工业应用的工程静态分析技术

2008 Eighth IEEE International Working Conference on Source Code Analysis and Manipulation Pub Date : 2008-10-03 DOI: 10.1109/SCAM.2008.11

P. Anderson

引用次数: 11

Type Highlighting: A Client-Driven Visual Approach for Class Hierarchies Reengineering 类型高亮:类层次结构再造的客户端驱动的可视化方法

2008 Eighth IEEE International Working Conference on Source Code Analysis and Manipulation Pub Date : 2008-10-03 DOI: 10.1109/SCAM.2008.16

Petru Florin Mihancea

引用次数: 6

User-Input Dependence Analysis via Graph Reachability 基于图可达性的用户输入依赖性分析

2008 Eighth IEEE International Working Conference on Source Code Analysis and Manipulation Pub Date : 2008-03-01 DOI: 10.1109/SCAM.2008.22

Bernhard Scholz, Chenyi Zhang, C. Cifuentes

{"title":"User-Input Dependence Analysis via Graph Reachability","authors":"Bernhard Scholz, Chenyi Zhang, C. Cifuentes","doi":"10.1109/SCAM.2008.22","DOIUrl":"https://doi.org/10.1109/SCAM.2008.22","url":null,"abstract":"Bug-checking tools have been used with some success in recent years to find bugs in software. For finding bugs that can cause security vulnerabilities, bug checking tools require a program analysis which determines whether a software bug can be controlled by user-input. In this paper we introduce a static program analysis for computing user-input dependencies. This analysis can be used as a pre-processing filter to a static bug checking tool for identifying bugs that can potentially be exploited as security vulnerabilities. In order for the analysis to be applicable to large commercial software in the millions of lines of code, runtime speed and scalability of the user-input dependence analysis is of key importance. Our user-input dependence analysis takes both data and control dependencies into account. We extend static single assignment (SSA) form by augmenting phi-nodes with control dependencies. A formal definition of user-input dependence is expressed in a dataflow analysis framework as a meet-over-all-paths (MOP) solution. We reduce the equation system to a sparse equation system exploiting the properties of SSA. The sparse equation system is solved as a reachability problem that results in a fast algorithm for computing user-input dependencies. We have implemented a call-insensitive and a call-sensitive analysis. The paper gives preliminary results on the comparison of their efficiency for various benchmarks.","PeriodicalId":433693,"journal":{"name":"2008 Eighth IEEE International Working Conference on Source Code Analysis and Manipulation","volume":"7 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2008-03-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"115291088","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 48