2018 33rd IEEE/ACM International Conference on Automated Software Engineering (ASE)最新文献_第9页

Differential Program Analysis with Fuzzing and Symbolic Execution 基于模糊和符号执行的差分程序分析

2018 33rd IEEE/ACM International Conference on Automated Software Engineering (ASE) Pub Date : 2018-09-01 DOI: 10.1145/3238147.3241537

Yannic Noller

引用次数: 4

ReScue: Crafting Regular Expression DoS Attacks* 救援:制作正则表达式DoS攻击*

2018 33rd IEEE/ACM International Conference on Automated Software Engineering (ASE) Pub Date : 2018-09-01 DOI: 10.1145/3238147.3238159

Yuju Shen, Yanyan Jiang, Chang Xu, Ping Yu, Xiaoxing Ma, Jian Lu

引用次数: 37

Towards Automatic Restrictification of CUDA Kernel Arguments CUDA内核参数的自动限制

2018 33rd IEEE/ACM International Conference on Automated Software Engineering (ASE) Pub Date : 2018-09-01 DOI: 10.1145/3238147.3241533

R. Diarra

引用次数: 1

Improving Automatic Source Code Summarization via Deep Reinforcement Learning 通过深度强化学习改进自动源代码摘要

2018 33rd IEEE/ACM International Conference on Automated Software Engineering (ASE) Pub Date : 2018-09-01 DOI: 10.1145/3238147.3238206

Yao Wan, Zhou Zhao, Min Yang, Guandong Xu, Haochao Ying, Jian Wu, Philip S. Yu

{"title":"Improving Automatic Source Code Summarization via Deep Reinforcement Learning","authors":"Yao Wan, Zhou Zhao, Min Yang, Guandong Xu, Haochao Ying, Jian Wu, Philip S. Yu","doi":"10.1145/3238147.3238206","DOIUrl":"https://doi.org/10.1145/3238147.3238206","url":null,"abstract":"Code summarization provides a high level natural language description of the function performed by code, as it can benefit the software maintenance, code categorization and retrieval. To the best of our knowledge, most state-of-the-art approaches follow an encoder-decoder framework which encodes the code into a hidden space and then decode it into natural language space, suffering from two major drawbacks: a) Their encoders only consider the sequential content of code, ignoring the tree structure which is also critical for the task of code summarization; b) Their decoders are typically trained to predict the next word by maximizing the likelihood of next ground-truth word with previous ground-truth word given. However, it is expected to generate the entire sequence from scratch at test time. This discrepancy can cause an exposure bias issue, making the learnt decoder suboptimal. In this paper, we incorporate an abstract syntax tree structure as well as sequential content of code snippets into a deep reinforcement learning framework (i.e., actor-critic network). The actor network provides the confidence of predicting the next word according to current state. On the other hand, the critic network evaluates the reward value of all possible extensions of the current state and can provide global guidance for explorations. We employ an advantage reward composed of BLEU metric to train both networks. Comprehensive experiments on a real-world dataset show the effectiveness of our proposed model when compared with some state-of-the-art methods.","PeriodicalId":6622,"journal":{"name":"2018 33rd IEEE/ACM International Conference on Automated Software Engineering (ASE)","volume":"94 1","pages":"397-407"},"PeriodicalIF":0.0,"publicationDate":"2018-09-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"80904942","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 300

VulSeeker: A Semantic Learning Based Vulnerability Seeker for Cross-Platform Binary VulSeeker:基于语义学习的跨平台二进制文件漏洞搜索器

2018 33rd IEEE/ACM International Conference on Automated Software Engineering (ASE) Pub Date : 2018-09-01 DOI: 10.1145/3238147.3240480

Jian Gao, Xin Yang, Ying Fu, Yu Jiang, Jiaguang Sun

{"title":"VulSeeker: A Semantic Learning Based Vulnerability Seeker for Cross-Platform Binary","authors":"Jian Gao, Xin Yang, Ying Fu, Yu Jiang, Jiaguang Sun","doi":"10.1145/3238147.3240480","DOIUrl":"https://doi.org/10.1145/3238147.3240480","url":null,"abstract":"Code reuse improves software development efficiency, however, vulnerabilities can be introduced inadvertently. Many existing works compute the code similarity based on CFGs to determine whether a binary function contains a known vulnerability. Unfortunately, their performance in cross-platform binary search is challenged. This paper presents VulSeeker, a semantic learning based vulnerability seeker for cross-platform binary. Given a target function and a vulnerable function, VulSeeker first constructs the labeled semantic flow graphs and extracts basic block features as numerical vectors for both of them. Then the embedding vector of the whole binary function is generated by feeding the numerical vectors of basic blocks to the customized semantics aware DNN model. Finally, the similarity of the two binary functions is measured based on the Cosine distance. The experimental results show that VulSeeker outperforms the state-of-the-art approaches in terms of accuracy. For example, compared to the most recent and related work Gemini, VulSeeker finds 50.00% more vulnerabilities in the top-10 candidates and 13.89% more in the top-50 candidates, and improves the values of AUC and ACC for 8.23% and 12.14% respectively. The video is presented at https://youtu.be/Mw0mr84gpI8.","PeriodicalId":6622,"journal":{"name":"2018 33rd IEEE/ACM International Conference on Automated Software Engineering (ASE)","volume":"50 1","pages":"896-899"},"PeriodicalIF":0.0,"publicationDate":"2018-09-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"78979448","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 107

CPA-SymExec: Efficient Symbolic Execution in CPAchecker CPA-SymExec: CPAchecker中的高效符号执行

2018 33rd IEEE/ACM International Conference on Automated Software Engineering (ASE) Pub Date : 2018-09-01 DOI: 10.1145/3238147.3240478

Dirk Beyer, T. Lemberger

{"title":"CPA-SymExec: Efficient Symbolic Execution in CPAchecker","authors":"Dirk Beyer, T. Lemberger","doi":"10.1145/3238147.3240478","DOIUrl":"https://doi.org/10.1145/3238147.3240478","url":null,"abstract":"We present CPA-SymExec, a tool for symbolic execution that is implemented in the open-source, configurable verification framework CPAchecker. Our implementation automatically detects which symbolic facts to track, in order to obtain a small set of constraints that are necessary to decide reachability of a program area of interest. CPA-SymExec is based on abstraction and counterexample-guided abstraction refinement (CEGAR), and uses a constraint-interpolation approach to detect symbolic facts. We show that our implementation can better mitigate the path-explosion problem than symbolic execution without abstraction, by comparing the performance to the state-of-the-art Klee-based symbolic-execution engine Symbiotic and to Klee itself. For the experiments we use two kinds of analysis tasks: one for finding an executable path to a specific location of interest (e.g., if a test vector is desired to show that a certain behavior occurs), and one for confirming that no executable path to a specific location exists (e.g., if it is desired to show that a certain behavior never occurs). CPA-SymExec is released under the Apache 2 license and available (inclusive source code) at https://cpachecker.sosy-lab.org. A demonstration video is available at https://youtu.be/qoBHtvPKtnw.","PeriodicalId":6622,"journal":{"name":"2018 33rd IEEE/ACM International Conference on Automated Software Engineering (ASE)","volume":"24 1","pages":"900-903"},"PeriodicalIF":0.0,"publicationDate":"2018-09-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"73752381","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 4

RUDSEA: Recommending Updates of Dockerfiles via Software Environment Analysis RUDSEA:通过软件环境分析推荐Dockerfiles的更新

2018 33rd IEEE/ACM International Conference on Automated Software Engineering (ASE) Pub Date : 2018-09-01 DOI: 10.1145/3238147.3240470

Foyzul Hassan, Rodney Rodriguez, Xiaoyin Wang

引用次数: 31

TDroid: Exposing App Switching Attacks in Android with Control Flow Specialization TDroid:通过控制流专业化暴露Android中的应用切换攻击

2018 33rd IEEE/ACM International Conference on Automated Software Engineering (ASE) Pub Date : 2018-09-01 DOI: 10.1145/3238147.3238188

Jie Liu, Diyu Wu, Jingling Xue

{"title":"TDroid: Exposing App Switching Attacks in Android with Control Flow Specialization","authors":"Jie Liu, Diyu Wu, Jingling Xue","doi":"10.1145/3238147.3238188","DOIUrl":"https://doi.org/10.1145/3238147.3238188","url":null,"abstract":"The Android multitasking mechanism can be plagued with app switching attacks, in which a malicious app replaces the legitimate top activity of the focused app with one of its own, thus mounting, e.g., phishing and denial-of-service attacks. Existing market-level defenses are still ineffective, as static analysis is fundamentally unable to reason about the intention of an app and dynamic analysis has low coverage. We introduce TDroid, a new market-level approach to detecting app switching attacks. The challenge lies in how to handle a plethora of input-dependent branch predicates (forming an exponential number of paths) that control the execution of the code responsible for launching such attacks. TDroid tackles this challenge by combining static and dynamic analysis to analyze an app without producing any false positives. In its static analysis, TDroid transforms the app into runnable slices containing potentially app switching attacks, one slice per attack. In its dynamic analysis, TDroid executes these slices on an Android phone or emulator to expose their malicious GUIs. The novelty lies in the use of a new trigger-oriented slicing technique in producing runnable slices so that certain input-dependent branch predicates are specialized to execute always some fixed branches. Evaluated with a large set of malware apps, TDroid is shown to outperform the state of the art, by detecting substantially more app switching attacks, in a few minutes per app, on average.","PeriodicalId":6622,"journal":{"name":"2018 33rd IEEE/ACM International Conference on Automated Software Engineering (ASE)","volume":"17 1","pages":"236-247"},"PeriodicalIF":0.0,"publicationDate":"2018-09-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"81939107","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 10

Domain-Independent Multi-threaded Software Model Checking 领域无关的多线程软件模型检查

2018 33rd IEEE/ACM International Conference on Automated Software Engineering (ASE) Pub Date : 2018-09-01 DOI: 10.1145/3238147.3238195

Dirk Beyer, Karlheinz Friedberger

{"title":"Domain-Independent Multi-threaded Software Model Checking","authors":"Dirk Beyer, Karlheinz Friedberger","doi":"10.1145/3238147.3238195","DOIUrl":"https://doi.org/10.1145/3238147.3238195","url":null,"abstract":"Recent development of software aims at massively parallel execution, because of the trend to increase the number of processing units per CPU socket. But many approaches for program analysis are not designed to benefit from a multi-threaded execution and lack support to utilize multi-core computers. Rewriting existing algorithms is difficult and error-prone, and the design of new parallel algorithms also has limitations. An orthogonal problem is the granularity: computing each successor state in parallel seems too fine-grained, so the open question is to find the right structural level for parallel execution. We propose an elegant solution to these problems: Block summaries should be computed in parallel. Many successful approaches to software verification are based on summaries of control-flow blocks, large blocks, or function bodies. Block-abstraction memoization is a successful domain-independent approach for summary-based program analysis. We redesigned the verification approach of block-abstraction memoization starting from its original recursive definition, such that it can run in a parallel manner for utilizing the available computation resources without losing its advantages of being independent from a certain abstract domain. We present an implementation of our new approach for multi-core shared-memory machines. The experimental evaluation shows that our summary-based approach has no significant overhead compared to the existing sequential approach and that it has a significant speedup when using multi-threading.","PeriodicalId":6622,"journal":{"name":"2018 33rd IEEE/ACM International Conference on Automated Software Engineering (ASE)","volume":"53 1","pages":"634-644"},"PeriodicalIF":0.0,"publicationDate":"2018-09-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"87229867","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 5

Template-Guided Concolic Testing via Online Learning 通过在线学习模板引导的Concolic测试

2018 33rd IEEE/ACM International Conference on Automated Software Engineering (ASE) Pub Date : 2018-09-01 DOI: 10.1145/3238147.3238227

Sooyoung Cha, Seonho Lee, Hakjoo Oh

引用次数: 8