Formal Verification and Security Group Research Interests Natasha - PowerPoint PPT Presentation

Formal Verification and Security Group Research Interests Natasha Sharygina www.verify.inf.usi.ch Universit` a della Svizzera Italiana (USI) October 30, 2009 FVS Group (USI) Research Interests October 30, 2009 1 / 21

Outline • FVS group at USI • Group projects • Synergy of precise and fast abstraction • SMT-based decision procedures • Loop summarization FVS Group (USI) Research Interests October 30, 2009 2 / 21

Formal Verification and Security Group at USI Universit` a della Svizzera Italiana (USI or University of Lugano) is located in the southernmost (and sunniest) part of Switzerland. Members: • Prof. Natasha Sharygina • Postdoc: Roberto Bruttomesso • PhD Students: Aliaksei Tsitovich, Simone Rollini FVS Group (USI) Research Interests October 30, 2009 3 / 21

Formal Verification and Security Group at USI FVS Group (USI) Research Interests October 30, 2009 3 / 21

Synergy of precise and fast abstraction FVS Group (USI) Research Interests October 30, 2009 4 / 21

Project motivation: existing approaches to abstraction in CEGAR loop are not perfect Precise abstraction • Minimal number of abstract transitions (no spurious transitions) FVS Group (USI) Research Interests October 30, 2009 5 / 21

Project motivation: existing approaches to abstraction in CEGAR loop are not perfect Precise abstraction • Minimal number of abstract transitions (no spurious transitions) • Adding new predicates is enough to refine spurious path FVS Group (USI) Research Interests October 30, 2009 5 / 21

Project motivation: existing approaches to abstraction in CEGAR loop are not perfect Precise abstraction • Minimal number of abstract transitions (no spurious transitions) • Adding new predicates is enough to refine spurious path • But... Very slow computation (exponential in the number of predicates). FVS Group (USI) Research Interests October 30, 2009 5 / 21

Project motivation: existing approaches to abstraction in CEGAR loop are not perfect Fast abstraction Precise abstraction • Many ways to approximate the • Minimal number of abstract abstraction (Cartesian transitions (no spurious abstraction, predicate transitions) partitioning etc.) • Adding new predicates is enough to refine spurious path • But... Very slow computation (exponential in the number of predicates). FVS Group (USI) Research Interests October 30, 2009 5 / 21

Project motivation: existing approaches to abstraction in CEGAR loop are not perfect Fast abstraction Precise abstraction • Many ways to approximate the • Minimal number of abstract abstraction (Cartesian transitions (no spurious abstraction, predicate transitions) partitioning etc.) • Adding new predicates is enough • Usually very fast computation to refine spurious path • But... Very slow computation (exponential in the number of predicates). FVS Group (USI) Research Interests October 30, 2009 5 / 21

Project motivation: existing approaches to abstraction in CEGAR loop are not perfect Fast abstraction Precise abstraction • Many ways to approximate the • Minimal number of abstract abstraction (Cartesian transitions (no spurious abstraction, predicate transitions) partitioning etc.) • Adding new predicates is enough • Usually very fast computation to refine spurious path • But... • But... Very slow computation • Introduces spurious transitions (exponential in the number of (abstraction contains both predicates). spurious transitions and spurious paths) • Requires many refinement iterations to remove numerous spurious transitions. FVS Group (USI) Research Interests October 30, 2009 5 / 21

Our solution: combine fast and precise predicate abstraction in CEGAR loop Start with fast abstraction Program Model Checking Abstraction No violations Counterexample π Real bug Refinement Simulation Spurious Refine as precise as possible FVS Group (USI) Research Interests October 30, 2009 6 / 21

Components of our algorithm • FastAbstraction : given a set of predicates Π and a concrete transition relation T computes program over-approximation for ˆ T Π . • PreciseAbstraction : given a set of predicates Π and a concrete transition relation T computes the minimal abstraction for ˆ T Π . • SpuriousTransition ( π ): given a path π , maps every transition t in = ˆ π to a set of predicates P , s.t. P ⊆ Π and t �| T P . • SpuriousPath ( π ): given a path π , maps every transition t in π to a = ˆ set of predicates P , s.t. π �| T σ SP ( t ) . Note that Π ⊆ P , i.e., SpuriousPath introduces new predicates. FVS Group (USI) Research Interests October 30, 2009 7 / 21

The “synergy” algorithm MixCegarLoop( TransitionSystem M, Property F ) begin Let’s proceed stepwise Π = InitialPredicates( F,T ) ; α = FastAbstraction( T, Π ) ; while not TIMEOUT do π = ModelCheck( α ,F ) ; if π = ∅ then return CORRECT; else σ ST = SpuriousTransition( π ) ; if σ ST � = ∅ then foreach t ∈ π do C = PreciseAbstraction( T, σ ST ( t ) ) ; α = α ∧ C ; else σ SP = SpuriousPath( π ) ; if σ SP � = ∅ then return INCORRECT; else foreach t ∈ π do Π = Π ∪ σ SP ( t ); C = PreciseAbstraction( T, σ SP ( t ) ) ; α = α ∧ C ; end FVS Group (USI) Research Interests October 30, 2009 8 / 21

The “synergy” algorithm Choose initial predi- MixCegarLoop( TransitionSystem M, Property F ) begin cates Π and use them Π = InitialPredicates( F,T ) ; α = FastAbstraction( T, Π ) ; for fast abstraction while not TIMEOUT do π = ModelCheck( α ,F ) ; if π = ∅ then return CORRECT; else σ ST = SpuriousTransition( π ) ; if σ ST � = ∅ then foreach t ∈ π do C = PreciseAbstraction( T, σ ST ( t ) ) ; α = α ∧ C ; else σ SP = SpuriousPath( π ) ; if σ SP � = ∅ then return INCORRECT; else foreach t ∈ π do Π = Π ∪ σ SP ( t ); C = PreciseAbstraction( T, σ SP ( t ) ) ; α = α ∧ C ; end FVS Group (USI) Research Interests October 30, 2009 8 / 21

The “synergy” algorithm Perform Model Check- MixCegarLoop( TransitionSystem M, Property F ) begin ing and obtain coun- Π = InitialPredicates( F,T ) ; α = FastAbstraction( T, Π ) ; terexample π (if it ex- while not TIMEOUT do π = ModelCheck( α ,F ) ; ists) if π = ∅ then return CORRECT; else σ ST = SpuriousTransition( π ) ; if σ ST � = ∅ then foreach t ∈ π do C = PreciseAbstraction( T, σ ST ( t ) ) ; α = α ∧ C ; else σ SP = SpuriousPath( π ) ; if σ SP � = ∅ then return INCORRECT; else foreach t ∈ π do Π = Π ∪ σ SP ( t ); C = PreciseAbstraction( T, σ SP ( t ) ) ; α = α ∧ C ; end FVS Group (USI) Research Interests October 30, 2009 8 / 21

The “synergy” algorithm MixCegarLoop( TransitionSystem M, Property F ) Compute spurious tran- begin Π = InitialPredicates( F,T ) ; sitions ( σ ST : ∀ t ∈ π → α = FastAbstraction( T, Π ) ; while not TIMEOUT do = ˆ P ⊆ Π ∧ t �| T P ) π = ModelCheck( α ,F ) ; if π = ∅ then return CORRECT; else σ ST = SpuriousTransition( π ) ; if σ ST � = ∅ then foreach t ∈ π do C = PreciseAbstraction( T, σ ST ( t ) ) ; α = α ∧ C ; else σ SP = SpuriousPath( π ) ; if σ SP � = ∅ then return INCORRECT; else foreach t ∈ π do Π = Π ∪ σ SP ( t ); C = PreciseAbstraction( T, σ SP ( t ) ) ; α = α ∧ C ; end FVS Group (USI) Research Interests October 30, 2009 8 / 21

The “synergy” algorithm 1 Perform Precise- MixCegarLoop( TransitionSystem M, Property F ) Abstraction for begin Π = InitialPredicates( F,T ) ; predicates P α = FastAbstraction( T, Π ) ; while not TIMEOUT do related to spurious π = ModelCheck( α ,F ) ; if π = ∅ then return CORRECT; transitions ∀ t ∈ π . else σ ST = SpuriousTransition( π ) ; if σ ST � = ∅ then 2 Remove detected foreach t ∈ π do spurious C = PreciseAbstraction( T, σ ST ( t ) ) ; α = α ∧ C ; transitions by else σ SP = SpuriousPath( π ) ; refining original if σ SP � = ∅ then return INCORRECT; abstraction else foreach t ∈ π do Π = Π ∪ σ SP ( t ); C = PreciseAbstraction( T, σ SP ( t ) ) ; Note, all spurious transitions related α = α ∧ C ; to detected predicates are removed end at once! FVS Group (USI) Research Interests October 30, 2009 8 / 21

The “synergy” algorithm Otherwise check if π MixCegarLoop( TransitionSystem M, Property F ) begin has any spurious path Π = InitialPredicates( F,T ) ; α = FastAbstraction( T, Π ) ; ( σ SP : t ∈ π → Π ⊆ while not TIMEOUT do π = ModelCheck( α ,F ) ; = ˆ P ∧ π �| T σ SP ( t ) ) if π = ∅ then return CORRECT; else σ ST = SpuriousTransition( π ) ; if σ ST � = ∅ then foreach t ∈ π do C = PreciseAbstraction( T, σ ST ( t ) ) ; α = α ∧ C ; else σ SP = SpuriousPath( π ) ; if σ SP � = ∅ then return INCORRECT; else foreach t ∈ π do Π = Π ∪ σ SP ( t ); C = PreciseAbstraction( T, σ SP ( t ) ) ; α = α ∧ C ; end FVS Group (USI) Research Interests October 30, 2009 8 / 21