首页 > 最新文献

2019 International Symposium on Theoretical Aspects of Software Engineering (TASE)最新文献

英文 中文
Steering Interpolants Generation with Efficient Interpolation Abstraction Exploration 基于高效插值抽象探索的转向插值生成
Xiaozhen Zhang, W. Kong, Jianguo Jiang, Gang Hou, Akira Fukuda
Craig interpolation has emerged as an effective approximation method and can be widely applied in hardware and software model checking. Since the quality of interpolants can critically affect the success and failure, or convergence and divergence of model checking, researchers have put forward a novel and flexible interpolation abstraction-based technique to guide the computation of promising interpolants. In this technique, abstraction lattice is constructed to arrange families of interpolation abstraction for improving the quality of resulting interpolants. However, the original search strategy to explore an abstraction lattice is not efficient when abstraction lattice enlarges and the elapsed time to perform multiple search on the same abstraction lattice is obviously distinct for many problems. In this paper, in order to alleviate these problems, we propose a top-down search space pruning-based algorithm to search the abstraction lattice and implement this algorithm in the well-known model checker Eldarica. We conduct experiments on 179 benchmarks to compare our algorithm respectively against the original search algorithm in Eldarica and the state-of-the-art SMT solver Z3. The experimental results show that our algorithm performs much better in the sense that it is more efficient than Eldarica for most of the benchmarks and it can solve much more benchmarks than Z3.
克雷格插值是一种有效的逼近方法,可广泛应用于硬件和软件模型检验。由于插补量的质量对模型检验的成败或收敛发散具有重要影响,研究人员提出了一种新颖灵活的基于插补抽象的技术来指导有前途的插补量的计算。在该技术中,构造抽象格来排列插值抽象族,以提高插值结果的质量。然而,当抽象格扩大时,原有的抽象格搜索策略的效率不高,在同一抽象格上执行多次搜索的时间在许多问题上明显不同。为了缓解这些问题,本文提出了一种基于自顶向下搜索空间剪枝的抽象格搜索算法,并在著名的模型检查器Eldarica中实现该算法。我们在179个基准上进行了实验,分别将我们的算法与Eldarica中的原始搜索算法和最先进的SMT求解器Z3进行了比较。实验结果表明,我们的算法在大多数基准测试中都比Eldarica更有效,并且可以比Z3解决更多的基准测试。
{"title":"Steering Interpolants Generation with Efficient Interpolation Abstraction Exploration","authors":"Xiaozhen Zhang, W. Kong, Jianguo Jiang, Gang Hou, Akira Fukuda","doi":"10.1109/TASE.2019.00-11","DOIUrl":"https://doi.org/10.1109/TASE.2019.00-11","url":null,"abstract":"Craig interpolation has emerged as an effective approximation method and can be widely applied in hardware and software model checking. Since the quality of interpolants can critically affect the success and failure, or convergence and divergence of model checking, researchers have put forward a novel and flexible interpolation abstraction-based technique to guide the computation of promising interpolants. In this technique, abstraction lattice is constructed to arrange families of interpolation abstraction for improving the quality of resulting interpolants. However, the original search strategy to explore an abstraction lattice is not efficient when abstraction lattice enlarges and the elapsed time to perform multiple search on the same abstraction lattice is obviously distinct for many problems. In this paper, in order to alleviate these problems, we propose a top-down search space pruning-based algorithm to search the abstraction lattice and implement this algorithm in the well-known model checker Eldarica. We conduct experiments on 179 benchmarks to compare our algorithm respectively against the original search algorithm in Eldarica and the state-of-the-art SMT solver Z3. The experimental results show that our algorithm performs much better in the sense that it is more efficient than Eldarica for most of the benchmarks and it can solve much more benchmarks than Z3.","PeriodicalId":183749,"journal":{"name":"2019 International Symposium on Theoretical Aspects of Software Engineering (TASE)","volume":"53 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2019-07-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"115192538","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 0
A HOL Theory of the Differential for Matrix Functions 矩阵函数微分的HOL理论
Yuhan Nie, Zhiping Shi, Aixuan Wu, Ximeng Li, Guohui Wang, Yong Guan
The differential of matrix functions(DMF) plays an important role in mathematics and engineering. Common applications of it are found in optimization analysis, computer vision, robotics, etc. In this paper, a formal method based on HOL is used to construct the DMF based on Fréchet differential in matrix space. In order to illustrate the practical effectiveness of our work, we use our formalization to verify a property of matrix exponential.
矩阵函数的微分(DMF)在数学和工程中占有重要的地位。它的常见应用在优化分析、计算机视觉、机器人等领域。本文采用一种基于正则化的形式化方法来构造矩阵空间中基于fr微分的DMF。为了说明我们的工作的实际有效性,我们用我们的形式化证明了矩阵指数的一个性质。
{"title":"A HOL Theory of the Differential for Matrix Functions","authors":"Yuhan Nie, Zhiping Shi, Aixuan Wu, Ximeng Li, Guohui Wang, Yong Guan","doi":"10.1109/TASE.2019.00-10","DOIUrl":"https://doi.org/10.1109/TASE.2019.00-10","url":null,"abstract":"The differential of matrix functions(DMF) plays an important role in mathematics and engineering. Common applications of it are found in optimization analysis, computer vision, robotics, etc. In this paper, a formal method based on HOL is used to construct the DMF based on Fréchet differential in matrix space. In order to illustrate the practical effectiveness of our work, we use our formalization to verify a property of matrix exponential.","PeriodicalId":183749,"journal":{"name":"2019 International Symposium on Theoretical Aspects of Software Engineering (TASE)","volume":"13 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2019-07-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"115553932","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 0
Multi-Agent Automated Reasoning Toward Machine Self-Awareness: A Case Study 面向机器自我意识的多智能体自动推理:一个案例研究
Zhenbing Zeng, Jianlin Wang, Zhengfeng Yang
In this paper, we present a study on building a special SAARA (Self-Aware Automated Reasoning Agent) system for solving Freudenthal's Sum and Product puzzle, aimed to train the "self-reflection" and "subjective experience" abilities as in the Three Wise Men test performed by the Nao robots in Rensselaer Polytechnic Institute in July 2015. We show the dynamic evolution of corresponding knowledge sets in the automated reasoning process for the Sum and Product puzzle.
在本文中,我们研究了构建一个特殊的SAARA (Self-Aware Automated Reasoning Agent)系统来解决Freudenthal的Sum and Product谜题,旨在训练“自我反思”和“主观体验”的能力,就像2015年7月由Rensselaer理工学院的Nao机器人进行的三智人测试一样。我们展示了在求和和积难题的自动推理过程中相应知识集的动态演变。
{"title":"Multi-Agent Automated Reasoning Toward Machine Self-Awareness: A Case Study","authors":"Zhenbing Zeng, Jianlin Wang, Zhengfeng Yang","doi":"10.1109/TASE.2019.00-17","DOIUrl":"https://doi.org/10.1109/TASE.2019.00-17","url":null,"abstract":"In this paper, we present a study on building a special SAARA (Self-Aware Automated Reasoning Agent) system for solving Freudenthal's Sum and Product puzzle, aimed to train the \"self-reflection\" and \"subjective experience\" abilities as in the Three Wise Men test performed by the Nao robots in Rensselaer Polytechnic Institute in July 2015. We show the dynamic evolution of corresponding knowledge sets in the automated reasoning process for the Sum and Product puzzle.","PeriodicalId":183749,"journal":{"name":"2019 International Symposium on Theoretical Aspects of Software Engineering (TASE)","volume":"28 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2019-07-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"122713575","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 0
A Denotational Semantics for Dynamic Architectures 动态体系结构的指称语义
Diego Marmsoler
With the emergence of mobile and adaptive computing, dynamic architectures have become increasingly important. In such architectures, components can appear and disappear, and connections between them can change over time. Verification of such architectures is performed over the composition of its components, which is usually defined in an operational style. Sometimes however, a denotational style might be more convenient for verification. Thus, in the following paper, we propose a denotational semantics for composition in dynamic architectures based on fixed points in lattices. We show that it is well-defined by proving that fixed points are guaranteed to exist. Finally, we use our definition to derive a logical characterization of composition, which forms the basis of a framework for the interactive verification of dynamic architectures.
随着移动计算和自适应计算的出现,动态架构变得越来越重要。在这样的体系结构中,组件可以出现也可以消失,它们之间的连接可以随时间变化。这种体系结构的验证是在其组件的组合上执行的,这些组件通常以操作风格定义。然而,有时候,表示性样式可能更便于验证。因此,在下面的文章中,我们提出了一种基于格中不动点的动态结构组合的指称语义。我们通过证明不动点的保证存在来证明它是定义良好的。最后,我们使用我们的定义来推导组合的逻辑特征,它形成了动态体系结构交互式验证框架的基础。
{"title":"A Denotational Semantics for Dynamic Architectures","authors":"Diego Marmsoler","doi":"10.1109/TASE.2019.000-8","DOIUrl":"https://doi.org/10.1109/TASE.2019.000-8","url":null,"abstract":"With the emergence of mobile and adaptive computing, dynamic architectures have become increasingly important. In such architectures, components can appear and disappear, and connections between them can change over time. Verification of such architectures is performed over the composition of its components, which is usually defined in an operational style. Sometimes however, a denotational style might be more convenient for verification. Thus, in the following paper, we propose a denotational semantics for composition in dynamic architectures based on fixed points in lattices. We show that it is well-defined by proving that fixed points are guaranteed to exist. Finally, we use our definition to derive a logical characterization of composition, which forms the basis of a framework for the interactive verification of dynamic architectures.","PeriodicalId":183749,"journal":{"name":"2019 International Symposium on Theoretical Aspects of Software Engineering (TASE)","volume":"43 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2019-07-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"114903611","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 1
Constructing Benchmarks for Supporting Explainable Evaluations of Static Application Security Testing Tools 为支持可解释的静态应用程序安全测试工具的评估构建基准
Gaojian Hao, Feng Li, Wei Huo, Qing Sun, Wei Wang, Xinhua Li, Wei Zou
When evaluating Static Application Security Testing (SAST) tools, benchmarks based on real-world softwares are considered more representative than synthetic micro benchmarks. Generated from real-world software, the test cases in such kind of benchmarks usually contain multiple syntactic features which affect the vulnerability detection results reflecting SAST tools' capabilities in real-world settings. However, most existing benchmarks based on real-world software pay little attention to these syntactic features so that only limited information about the capabilities of SAST tools can be obtained from the evaluation results. In this paper, we provide a method of constructing benchmarks and evaluating SAST tools, which leverages the syntactic features to support the evaluation to be more explainable. To demonstrate the effectiveness, we applied our method to the benchmark built by Misha Zitser et al., generated 10 groups of test cases, and evaluated 2 SAST tools with them. The result shows that, with the benchmark constructed by our method, the evaluation could be more explainable which helps us to gain more information about the SAST tools' capabilities of vulnerability detection.
在评估静态应用程序安全测试(SAST)工具时,基于真实软件的基准测试被认为比合成微基准测试更具代表性。此类基准测试中的测试用例生成于真实软件,通常包含多个语法特征,这些特征会影响漏洞检测结果,反映SAST工具在真实环境中的能力。然而,大多数基于真实软件的现有基准测试很少关注这些语法特征,因此只能从评估结果中获得关于SAST工具功能的有限信息。在本文中,我们提供了一种构建基准和评估SAST工具的方法,该方法利用语法特征来支持评估,使其更易于解释。为了证明有效性,我们将我们的方法应用于Misha Zitser等人构建的基准,生成了10组测试用例,并用它们评估了2个SAST工具。结果表明,通过本文方法构建的基准,评估结果更具可解释性,有助于我们更好地了解SAST工具的漏洞检测能力。
{"title":"Constructing Benchmarks for Supporting Explainable Evaluations of Static Application Security Testing Tools","authors":"Gaojian Hao, Feng Li, Wei Huo, Qing Sun, Wei Wang, Xinhua Li, Wei Zou","doi":"10.1109/TASE.2019.00-18","DOIUrl":"https://doi.org/10.1109/TASE.2019.00-18","url":null,"abstract":"When evaluating Static Application Security Testing (SAST) tools, benchmarks based on real-world softwares are considered more representative than synthetic micro benchmarks. Generated from real-world software, the test cases in such kind of benchmarks usually contain multiple syntactic features which affect the vulnerability detection results reflecting SAST tools' capabilities in real-world settings. However, most existing benchmarks based on real-world software pay little attention to these syntactic features so that only limited information about the capabilities of SAST tools can be obtained from the evaluation results. In this paper, we provide a method of constructing benchmarks and evaluating SAST tools, which leverages the syntactic features to support the evaluation to be more explainable. To demonstrate the effectiveness, we applied our method to the benchmark built by Misha Zitser et al., generated 10 groups of test cases, and evaluated 2 SAST tools with them. The result shows that, with the benchmark constructed by our method, the evaluation could be more explainable which helps us to gain more information about the SAST tools' capabilities of vulnerability detection.","PeriodicalId":183749,"journal":{"name":"2019 International Symposium on Theoretical Aspects of Software Engineering (TASE)","volume":"44 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2019-07-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"129710083","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 5
Optimized Step Semantics Encoding for Bounded Model Checking of Timed Automata 时间自动机有界模型检验的优化步进语义编码
Zuxi Chen, Huixing Fang, Xiangyu Luo
To BMC of timed automata network, we present a novel time stamp semantics model for timed automata network with synchronization and shared variables, which allows not only mutually independent transitions but also dependent transitions to be compressed together between two states in succession. A key ingredient of our BMC encoding is the use of time stamp variables for shared variable accesses, which are overlooked in previous approaches. The proposed semantics represents the timed automata network in a significantly more compact way than previous step semantics, which allows maximally compressed steps of transitions and therefore is in this sense optimal. A preliminary experimental evaluation shows a significant performance improvement in the number of unrolling of BMC steps and run times as well.
针对时间自动机网络的BMC问题,提出了一种具有同步和共享变量的时间自动机网络的时间戳语义模型,该模型既可以将两个连续状态之间的相互独立的转换压缩在一起,也可以将相互依赖的转换压缩在一起。我们的BMC编码的一个关键要素是使用时间戳变量进行共享变量访问,这在以前的方法中被忽略了。所提出的语义以比以前的步骤语义更紧凑的方式表示时间自动机网络,它允许最大限度地压缩过渡步骤,因此在这个意义上是最优的。初步的实验评估表明,在展开BMC步骤的数量和运行时间方面,性能也得到了显著改善。
{"title":"Optimized Step Semantics Encoding for Bounded Model Checking of Timed Automata","authors":"Zuxi Chen, Huixing Fang, Xiangyu Luo","doi":"10.1109/TASE.2019.00-14","DOIUrl":"https://doi.org/10.1109/TASE.2019.00-14","url":null,"abstract":"To BMC of timed automata network, we present a novel time stamp semantics model for timed automata network with synchronization and shared variables, which allows not only mutually independent transitions but also dependent transitions to be compressed together between two states in succession. A key ingredient of our BMC encoding is the use of time stamp variables for shared variable accesses, which are overlooked in previous approaches. The proposed semantics represents the timed automata network in a significantly more compact way than previous step semantics, which allows maximally compressed steps of transitions and therefore is in this sense optimal. A preliminary experimental evaluation shows a significant performance improvement in the number of unrolling of BMC steps and run times as well.","PeriodicalId":183749,"journal":{"name":"2019 International Symposium on Theoretical Aspects of Software Engineering (TASE)","volume":"38 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2019-07-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"130076954","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 0
Handling Refinement of Continuous Behaviors: A Proof Based Approach with Event-B 处理连续行为的细化:基于Event-B的证明方法
G. Dupont, Y. A. Ameur, M. Pantel, N. Singh
Cyber-physical systems (CPS) are taking a crucial role in various areas of our society and industry. Yet, because of their hybrid nature (i.e. the integration of both continuous and discrete features), their design and verification are not easy to handle, in particular when they are part of a critical system. Their certification requires to exhibit a formal argumentation that formal methods should be able to provide. This paper addresses the formal development of CPS using correct-by-construction refinement and proof based approaches. It relies on the Event-B formal method. In addition to modeling both the discrete and continuous parts of a CPS, this paper presents a novel approach in two steps. First it shows that the generic formal model we have defined, integrating both discrete and continuous behaviors, can be instantiated by various kinds of CPS. Fundamentally, continuous behaviors modeled by differential equations mingle with discrete transition systems (mode automaton), which model discrete behaviors. Here, refinement is used as a decomposition mechanism. Second, it expands the refinement operation, well mastered in the discrete world, to cover continuous behaviors. We show that different levels of abstraction of continuous aspects can be glued in a refinement chain. The proposed approach has been completely formalized using Event-B on the Rodin platform and a case study based on water tanks is used to illustrate it.
信息物理系统(CPS)在我们社会和工业的各个领域发挥着至关重要的作用。然而,由于它们的混合性质(即连续和离散特征的集成),它们的设计和验证不容易处理,特别是当它们是关键系统的一部分时。他们的证明要求展示正式方法应该能够提供的正式论证。本文讨论了使用按构造修正和基于证明的方法来正式开发CPS。它依赖于Event-B形式化方法。除了对CPS的离散部分和连续部分进行建模外,本文还提出了一种分两个步骤的新方法。首先,它表明我们所定义的集成离散和连续行为的一般形式模型可以由各种CPS实例化。基本上,由微分方程建模的连续行为与离散过渡系统(模式自动机)混合在一起,后者对离散行为进行建模。在这里,细化被用作分解机制。其次,它扩展了在离散世界中很好地掌握的精化操作,以涵盖连续行为。我们展示了连续方面的不同抽象级别可以粘合在精化链中。所提出的方法已经在Rodin平台上使用Event-B完全形式化,并使用基于水箱的案例研究来说明它。
{"title":"Handling Refinement of Continuous Behaviors: A Proof Based Approach with Event-B","authors":"G. Dupont, Y. A. Ameur, M. Pantel, N. Singh","doi":"10.1109/TASE.2019.00-25","DOIUrl":"https://doi.org/10.1109/TASE.2019.00-25","url":null,"abstract":"Cyber-physical systems (CPS) are taking a crucial role in various areas of our society and industry. Yet, because of their hybrid nature (i.e. the integration of both continuous and discrete features), their design and verification are not easy to handle, in particular when they are part of a critical system. Their certification requires to exhibit a formal argumentation that formal methods should be able to provide. This paper addresses the formal development of CPS using correct-by-construction refinement and proof based approaches. It relies on the Event-B formal method. In addition to modeling both the discrete and continuous parts of a CPS, this paper presents a novel approach in two steps. First it shows that the generic formal model we have defined, integrating both discrete and continuous behaviors, can be instantiated by various kinds of CPS. Fundamentally, continuous behaviors modeled by differential equations mingle with discrete transition systems (mode automaton), which model discrete behaviors. Here, refinement is used as a decomposition mechanism. Second, it expands the refinement operation, well mastered in the discrete world, to cover continuous behaviors. We show that different levels of abstraction of continuous aspects can be glued in a refinement chain. The proposed approach has been completely formalized using Event-B on the Rodin platform and a case study based on water tanks is used to illustrate it.","PeriodicalId":183749,"journal":{"name":"2019 International Symposium on Theoretical Aspects of Software Engineering (TASE)","volume":"1 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2019-07-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"133096928","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 10
Automated Test Generation for IEC 61131-3 ST Programs via Dynamic Symbolic Execution 通过动态符号执行的IEC 61131-3 ST程序自动测试生成
Li Hao, Jianqi Shi, Ting Su, Yanhong Huang
A programmable logic controller (PLC) is essentially a computer dedicated to industrial control which is widely used in the field of global automation control. However, PLC software bugs can result in economic losses and even personal safety issues. PLC software must be thoroughly tested regarding function, structure, safety, and other aspects to avoid accidents. Existing PLC tools are mainly based on the manual setting of input data, which is not only unable to be well automated but also cannot provide information about code coverage. This paper presents an automated test case generation approach for a Structured Text (ST) language to reduce the cost of testing, using dynamic symbolic execution. We apply this method to implement the coverage-based automated test case generation tool STAutoTester. We have evaluated STAutoTester on 21 programs. The experimental results show that STAutoTester can effectively handle these programs. For 11 ST programs, STAutoTester reduces, on average, 87.5% of generated test cases compared to SYMPLC.
可编程逻辑控制器(PLC)本质上是专用于工业控制的计算机,广泛应用于全球自动化控制领域。但是,PLC软件漏洞会造成经济损失甚至人身安全问题。PLC软件必须经过功能、结构、安全等方面的彻底测试,避免发生事故。现有的PLC工具主要是基于人工设置输入数据,不仅不能很好地实现自动化,而且不能提供代码覆盖率的信息。本文提出了一种用于结构化文本(ST)语言的自动化测试用例生成方法,使用动态符号执行来减少测试成本。我们应用这个方法来实现基于覆盖率的自动化测试用例生成工具STAutoTester。我们已经在21个程序上评估了STAutoTester。实验结果表明,STAutoTester可以有效地处理这些程序。对于11个ST程序,与SYMPLC相比,STAutoTester平均减少了87.5%的生成测试用例。
{"title":"Automated Test Generation for IEC 61131-3 ST Programs via Dynamic Symbolic Execution","authors":"Li Hao, Jianqi Shi, Ting Su, Yanhong Huang","doi":"10.1109/TASE.2019.00004","DOIUrl":"https://doi.org/10.1109/TASE.2019.00004","url":null,"abstract":"A programmable logic controller (PLC) is essentially a computer dedicated to industrial control which is widely used in the field of global automation control. However, PLC software bugs can result in economic losses and even personal safety issues. PLC software must be thoroughly tested regarding function, structure, safety, and other aspects to avoid accidents. Existing PLC tools are mainly based on the manual setting of input data, which is not only unable to be well automated but also cannot provide information about code coverage. This paper presents an automated test case generation approach for a Structured Text (ST) language to reduce the cost of testing, using dynamic symbolic execution. We apply this method to implement the coverage-based automated test case generation tool STAutoTester. We have evaluated STAutoTester on 21 programs. The experimental results show that STAutoTester can effectively handle these programs. For 11 ST programs, STAutoTester reduces, on average, 87.5% of generated test cases compared to SYMPLC.","PeriodicalId":183749,"journal":{"name":"2019 International Symposium on Theoretical Aspects of Software Engineering (TASE)","volume":"74 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2019-07-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"132400657","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 7
Android Malware Family Classification and Characterization Using CFG and DFG 基于CFG和DFG的Android恶意软件家族分类与表征
Zhiwu Xu, Kerong Ren, Fu Song
Android malware has become a serious threat for our daily life, and thus there is a pressing need to effectively mitigate or defend against them. Recently, many approaches and tools to analyze Android malware have been proposed to protect legitimate users from the threat. However, most approaches focus on malware detection, while only a few of them consider malware classification or malware characterization. In this paper, we propose an extension of CDGDroid to classifying and characterizing Android malware families automatically. We first perform static analysis used in CDGDroid to extract control-flow graphs and data-flow graphs on the instruction level. Then we encode the graphs into matrices, and use them to build the family classification models via deep learning. For family characterization, we extract the n-gram sequences from the graphs, which are filtered according to the weights of the classification model built for the target family. And then we construct a vector space model and select the top-k sequences as a characterization of the target family. We have conducted some experiments to evaluate our approach and have identified that the family classification model taking the horizontal combination of CFG and DFG as features offers the best performance in terms of accuracy among all the models. Compared with CDGDroid, Drebin and many antivirus tools gathered in VirusTotal, our family classification model gives a better performance. Finally, We have also conducted experiments on family characterization, and the experimental results have shown that our characterization can capture the malicious behaviors of the testing families.
Android恶意软件已经成为我们日常生活的严重威胁,因此迫切需要有效地减轻或防御它们。最近,人们提出了许多分析Android恶意软件的方法和工具,以保护合法用户免受威胁。然而,大多数方法侧重于恶意软件检测,而只有少数方法考虑恶意软件分类或恶意软件特征。在本文中,我们提出了一个扩展的CDGDroid来自动分类和表征Android恶意软件家族。我们首先在CDGDroid中使用静态分析来提取指令级的控制流图和数据流图。然后我们将这些图编码成矩阵,并利用它们通过深度学习建立家族分类模型。对于家族特征,我们从图中提取n-gram序列,并根据为目标家族构建的分类模型的权重对其进行过滤。然后,我们构建一个向量空间模型,并选择top-k序列作为目标族的表征。我们进行了一些实验来评估我们的方法,并发现以CFG和DFG的水平组合为特征的家族分类模型在所有模型中具有最好的准确性。与VirusTotal中收集的CDGDroid、Drebin和许多杀毒工具相比,我们的家族分类模型具有更好的性能。最后,我们还进行了家族表征的实验,实验结果表明,我们的表征可以捕获测试家族的恶意行为。
{"title":"Android Malware Family Classification and Characterization Using CFG and DFG","authors":"Zhiwu Xu, Kerong Ren, Fu Song","doi":"10.1109/TASE.2019.00-20","DOIUrl":"https://doi.org/10.1109/TASE.2019.00-20","url":null,"abstract":"Android malware has become a serious threat for our daily life, and thus there is a pressing need to effectively mitigate or defend against them. Recently, many approaches and tools to analyze Android malware have been proposed to protect legitimate users from the threat. However, most approaches focus on malware detection, while only a few of them consider malware classification or malware characterization. In this paper, we propose an extension of CDGDroid to classifying and characterizing Android malware families automatically. We first perform static analysis used in CDGDroid to extract control-flow graphs and data-flow graphs on the instruction level. Then we encode the graphs into matrices, and use them to build the family classification models via deep learning. For family characterization, we extract the n-gram sequences from the graphs, which are filtered according to the weights of the classification model built for the target family. And then we construct a vector space model and select the top-k sequences as a characterization of the target family. We have conducted some experiments to evaluate our approach and have identified that the family classification model taking the horizontal combination of CFG and DFG as features offers the best performance in terms of accuracy among all the models. Compared with CDGDroid, Drebin and many antivirus tools gathered in VirusTotal, our family classification model gives a better performance. Finally, We have also conducted experiments on family characterization, and the experimental results have shown that our characterization can capture the malicious behaviors of the testing families.","PeriodicalId":183749,"journal":{"name":"2019 International Symposium on Theoretical Aspects of Software Engineering (TASE)","volume":"18 7 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2019-07-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"134251905","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 37
Stuttering for Markov Automata 马尔可夫自动机的口吃
Arpit Sharma
Stutter equivalences are important for system synthesis as well as system analysis. In this paper, we study stutter trace equivalences for Markov automata (MAs) and how they relate to metric temporal logic (MTL) formulas. We first define several variants of stutter trace equivalence for closed MA models. We perform button pushing experiments with a black box model of MA to obtain these equivalences. For every class of MA scheduler, a corresponding variant of stutter trace equivalence is defined. Then we investigate the relationship among these equivalences and also compare them with bisimulation for MAs. Finally, we prove that maximum and minimum probabilities of satisfying properties specified using metric temporal logic (MTL) formulas are preserved under some of these equivalences.
口吃等价对于系统综合和系统分析都很重要。本文研究了马尔可夫自动机(MAs)的口吃迹等价及其与度量时间逻辑(MTL)公式的关系。我们首先定义了封闭MA模型的口吃轨迹等价的几个变体。我们用MA的黑箱模型进行按键实验来获得这些等价。对于每一类MA调度器,都定义了一个相应的口吃迹等价变体。然后,我们研究了这些等价之间的关系,并将它们与MAs的双模拟进行了比较。最后,我们证明了用度量时间逻辑(MTL)公式指定的满足性质的最大和最小概率在某些等价下是保留的。
{"title":"Stuttering for Markov Automata","authors":"Arpit Sharma","doi":"10.1109/TASE.2019.000-7","DOIUrl":"https://doi.org/10.1109/TASE.2019.000-7","url":null,"abstract":"Stutter equivalences are important for system synthesis as well as system analysis. In this paper, we study stutter trace equivalences for Markov automata (MAs) and how they relate to metric temporal logic (MTL) formulas. We first define several variants of stutter trace equivalence for closed MA models. We perform button pushing experiments with a black box model of MA to obtain these equivalences. For every class of MA scheduler, a corresponding variant of stutter trace equivalence is defined. Then we investigate the relationship among these equivalences and also compare them with bisimulation for MAs. Finally, we prove that maximum and minimum probabilities of satisfying properties specified using metric temporal logic (MTL) formulas are preserved under some of these equivalences.","PeriodicalId":183749,"journal":{"name":"2019 International Symposium on Theoretical Aspects of Software Engineering (TASE)","volume":"25 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2019-07-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"116238260","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 2
期刊
2019 International Symposium on Theoretical Aspects of Software Engineering (TASE)
全部 Acc. Chem. Res. ACS Applied Bio Materials ACS Appl. Electron. Mater. ACS Appl. Energy Mater. ACS Appl. Mater. Interfaces ACS Appl. Nano Mater. ACS Appl. Polym. Mater. ACS BIOMATER-SCI ENG ACS Catal. ACS Cent. Sci. ACS Chem. Biol. ACS Chemical Health & Safety ACS Chem. Neurosci. ACS Comb. Sci. ACS Earth Space Chem. ACS Energy Lett. ACS Infect. Dis. ACS Macro Lett. ACS Mater. Lett. ACS Med. Chem. Lett. ACS Nano ACS Omega ACS Photonics ACS Sens. ACS Sustainable Chem. Eng. ACS Synth. Biol. Anal. Chem. BIOCHEMISTRY-US Bioconjugate Chem. BIOMACROMOLECULES Chem. Res. Toxicol. Chem. Rev. Chem. Mater. CRYST GROWTH DES ENERG FUEL Environ. Sci. Technol. Environ. Sci. Technol. Lett. Eur. J. Inorg. Chem. IND ENG CHEM RES Inorg. Chem. J. Agric. Food. Chem. J. Chem. Eng. Data J. Chem. Educ. J. Chem. Inf. Model. J. Chem. Theory Comput. J. Med. Chem. J. Nat. Prod. J PROTEOME RES J. Am. Chem. Soc. LANGMUIR MACROMOLECULES Mol. Pharmaceutics Nano Lett. Org. Lett. ORG PROCESS RES DEV ORGANOMETALLICS J. Org. Chem. J. Phys. Chem. J. Phys. Chem. A J. Phys. Chem. B J. Phys. Chem. C J. Phys. Chem. Lett. Analyst Anal. Methods Biomater. Sci. Catal. Sci. Technol. Chem. Commun. Chem. Soc. Rev. CHEM EDUC RES PRACT CRYSTENGCOMM Dalton Trans. Energy Environ. Sci. ENVIRON SCI-NANO ENVIRON SCI-PROC IMP ENVIRON SCI-WAT RES Faraday Discuss. Food Funct. Green Chem. Inorg. Chem. Front. Integr. Biol. J. Anal. At. Spectrom. J. Mater. Chem. A J. Mater. Chem. B J. Mater. Chem. C Lab Chip Mater. Chem. Front. Mater. Horiz. MEDCHEMCOMM Metallomics Mol. Biosyst. Mol. Syst. Des. Eng. Nanoscale Nanoscale Horiz. Nat. Prod. Rep. New J. Chem. Org. Biomol. Chem. Org. Chem. Front. PHOTOCH PHOTOBIO SCI PCCP Polym. Chem.
×
引用
GB/T 7714-2015
复制
MLA
复制
APA
复制
导出至
BibTeX EndNote RefMan NoteFirst NoteExpress
×
0
微信
客服QQ
Book学术公众号 扫码关注我们
反馈
×
意见反馈
请填写您的意见或建议
请填写您的手机或邮箱
×
提示
您的信息不完整,为了账户安全,请先补充。
现在去补充
×
提示
您因"违规操作"
具体请查看互助需知
我知道了
×
提示
现在去查看 取消
×
提示
确定
Book学术官方微信
Book学术文献互助
Book学术文献互助群
群 号:604180095
Book学术
文献互助 智能选刊 最新文献 互助须知 联系我们:info@booksci.cn
Book学术提供免费学术资源搜索服务,方便国内外学者检索中英文文献。致力于提供最便捷和优质的服务体验。
Copyright © 2023 Book学术 All rights reserved.
ghs 京公网安备 11010802042870号 京ICP备2023020795号-1