Continuously Reasoning about Programs using Differential Bayesian Inference
Programs often evolve by continuously integrating changes from multiple programmers. The effective adoption of program analysis tools in this continuous integration setting is hindered by the need to only report alarms relevant to a particular program change. We present a probabilistic framework, Drake, to apply program analyses to continuously evolving programs. Drake is applicable to a broad range of analyses that are based on deductive reasoning. The key insight underlying Drake is to compute a graph that concisely and precisely captures differences between the derivations of alarms produced by the given analysis on the program before and after the change. Performing Bayesian inference on the graph thereby enables to rank alarms by likelihood of relevance to the change. We evaluate Drake using Sparrow—a static analyzer that targets buffer-overrun, format-string, and integer-overflow errors—on a suite of ten widely-used C programs each comprising 13k–112k lines of code. Drake enables to discover all true bugs by inspecting only 30 alarms per benchmark on average, compared to 85 (3× more) alarms by the same ranking approach in batch mode, and 118 (4× more) alarms by a differential approach based on syntactic masking of alarms which also misses 4 of the 26 bugs overall.
Tue 25 Jun
|10:00 - 10:20|
Björn MathisCISPA Helmholtz Center for Information Security, Rahul GopinathCISPA Helmholtz Center for Information Security, Michaël MeraCISPA, Germany, Alexander KampmannCISPA Helmholtz Center for Information Security, Matthias HöscheleCISPA, Germany, Andreas ZellerSaarland UniversityMedia Attached
|10:20 - 10:40|
Kihong HeoUniversity of Pennsylvania, USA, Mukund RaghothamanUniversity of Pennsylvania, USA, Xujie SiUniversity of Pennsylvania, Mayur NaikUniversity of PennsylvaniaMedia Attached
|10:40 - 11:00|