residual monitoring of safety properties
play

Residual Monitoring of Safety Properties Prove what you can and - PowerPoint PPT Presentation

Residual Monitoring of Safety Properties Prove what you can and monitor the leftovers Matthew Dwyer joint work with Rahul Purandare, Sebastian Elbaum, Madeline Diep, and Alex Kinneer Department of Computer Science and Engineering Reality Check


  1. Dynamic Typestate Analysis sc = …open() [1] close sc.connect(…) close [1] open connect sc.read(…) 1 2 3 [5] read, write read, write sc.write(…) [4] read, write, connect connect, close err sc != null sc.close(); return

  2. Dynamic Typestate Analysis sc = …open() [1] close sc.connect(…) close [1] open connect sc.read(…) 1 2 3 [5] read, write read, write sc.write(…) [4] read, write, connect connect, close err sc != null sc.close(); return

  3. Dynamic Typestate Analysis sc = …open() [1] close sc.connect(…) close [1] open connect sc.read(…) 1 2 3 [5] read, write read, write sc.write(…) [4] read, write, connect connect, close err sc != null sc.close(); [1] return

  4. Dynamic Typestate Analysis sc = …open() [1] close sc.connect(…) close [1] open connect sc.read(…) 1 2 3 [5] read, write read, write sc.write(…) [4] read, write, connect connect, close err sc != null sc.close(); [1] return

  5. Leveraging Static Typestate Analysis {1} sc = …open() {1} {2} sc.connect(…) {3} {2} sc.read(…) {3} {3} {3} sc.write(…) {3} {3} sc != null {1,2,3} {1,2,3} sc.close(); {1, err} return {1, 2, 3, err}

  6. Leveraging Static Typestate Analysis sc = …open() [1] sc.connect(…) [1] sc.read(…) [5] sc.write(…) [4] sc != null sc.close(); [1] return

  7. Leveraging Static Typestate Analysis sc = …open() [1] sc.connect(…) [1] sc.read(…) sc.write(…) sc != null sc.close(); [1] return

  8. Safe Region A single-entry region, , of a control flow graph such that where

  9. Safe Region A region of a control flow graph for which – all paths have the same cumulative effect on the typestate FSA – no transitions from a non-error state to error state

  10. Safe Region A region of a control flow graph for which – all paths have the same cumulative effect on the typestate FSA – no transitions from a non-error state to error state 1

  11. Safe Region A region of a control flow graph for which – all paths have the same cumulative effect on the typestate FSA – no transitions from a non-error state to error state 1 2

  12. Safe Region A region of a control flow graph for which – all paths have the same cumulative effect on the typestate FSA – no transitions from a non-error state to error state 1 2

  13. Safe Region A region of a control flow graph for which – all paths have the same cumulative effect on the typestate FSA – no transitions from a non-error state to error state 1 2

  14. Example of Safe Region err 1 2 3 r1 1 -> 3 r2 2 -> 1 3 -> 2 r3 err -> err r4

  15. Example of Safe Region err 1 2 3 r1 r2 r3 r4

  16. Reachably Safe Region Not all states of a property reach all program points in a typestate analysis Reachably Safe Region – A region of a control flow graph which is safe relative to the subset of the typestates that may reach its entry

  17. Example of Reachably Safe Region err 1 2 3 public void simplifiedTransformData() { SocketChannel sc; open ByteBuffer buf; sc = SocketChannel.open(); connect sc.connect( new InetSocketAddress(…)); while while (sc.read(buf) != -1){ sc.write(buf); if } if (sc != null ) sc.close(); }

  18. Example of Reachably Safe Region err 1 2 3 public void simplifiedTransformData() { SocketChannel sc; open ByteBuffer buf; sc = SocketChannel.open(); connect sc.connect( new InetSocketAddress(…)); while while (sc.read(buf) != -1){ sc.write(buf); if } if (sc != null ) sc.close(); }

  19. Example of Reachably Safe Region err 1 2 3 public void simplifiedTransformData() { SocketChannel sc; open ByteBuffer buf; sc = SocketChannel.open(); connect sc.connect( new InetSocketAddress(…)); while while (sc.read(buf) != -1){ sc.write(buf); if } if (sc != null ) sc.close(); }

  20. Example of Reachably Safe Region err 1 2 3 public void simplifiedTransformData() { SocketChannel sc; open ByteBuffer buf; sc = SocketChannel.open(); connect sc.connect( new InetSocketAddress(…)); while while (sc.read(buf) != -1){ sc.write(buf); if } if (sc != null ) sc.close(); }

  21. Example of Reachably Safe Region err 1 2 3 public void simplifiedTransformData() { SocketChannel sc; open ByteBuffer buf; sc = SocketChannel.open(); connect sc.connect( new InetSocketAddress(…)); while while (sc.read(buf) != -1){ sc.write(buf); if } if (sc != null ) sc.close(); }

  22. Identity Safe Region • Identity Safe Region – A special case of a (reachably) safe region that yields identity summary on the subset of the typestates that may reach its entry

  23. Example of Identity Safe Region err 1 2 3 public void simplifiedTransformData() { SocketChannel sc; open ByteBuffer buf; sc = SocketChannel.open(); connect sc.connect( new InetSocketAddress(…)); while while (sc.read(buf) != -1){ sc.write(buf); if } if (sc != null ) sc.close(); }

  24. Example of Identity Safe Region err 1 2 3 public void simplifiedTransformData() { SocketChannel sc; open ByteBuffer buf; sc = SocketChannel.open(); connect sc.connect( new InetSocketAddress(…)); while while (sc.read(buf) != -1){ sc.write(buf); if } if (sc != null ) sc.close(); }

  25. Example of Identity Safe Region err 1 2 3 public void simplifiedTransformData() { SocketChannel sc; open ByteBuffer buf; sc = SocketChannel.open(); connect sc.connect( new InetSocketAddress(…)); while while (sc.read(buf) != -1){ sc.write(buf); if } if (sc != null ) sc.close(); }

  26. Algorithm Basic Steps 1. Reduces a control flow graph region to a sequence of single entry regions 2. Calls static typestate analysis to calculate functional summaries of reachable program regions 3. Within a region, identify candidate safe regions by marking boundaries that cannot be crossed by any safe region 4. Identify safe regions inside candidate safe regions 5. Drop (and if required, add) FSA transitions for safe regions 6. Repeat the steps for all regions that lie outside safe regions

  27. Algorithm Basic Steps 1. Reduces a control flow graph region to a sequence of single entry regions 2. Calls static typestate analysis to calculate functional summaries of reachable program regions 3. Within a region, identify candidate safe regions by marking boundaries that cannot be crossed by any safe region 4. Identify safe regions inside candidate safe regions 5. Drop (and if required, add) FSA transitions for safe regions 6. Repeat the steps for all regions that lie outside safe regions

  28. Reduce Control Flow Graph public void simplifiedTransformData() sc = …open() { SocketChannel sc; sc.connect(…) ByteBuffer buf; sc = SocketChannel.open(); sc.read(…) sc.connect( new InetSocketAddress(…)); while (sc.read(buf) != -1){ sc.write(…) sc.write(buf); } if (sc != null ) sc != null sc.close(); } sc.close(); return

  29. Reduce Control Flow Graph public void simplifiedTransformData() sc = …open() { SocketChannel sc; sc.connect(…) ByteBuffer buf; sc = SocketChannel.open(); sc.read(…) sc.connect( new InetSocketAddress(…)); while (sc.read(buf) != -1){ sc.write(…) sc.write(buf); } if (sc != null ) sc != null sc.close(); } sc.close(); return

  30. Reduce Control Flow Graph public void simplifiedTransformData() sc = …open() { SocketChannel sc; sc.connect(…) ByteBuffer buf; sc = SocketChannel.open(); while … sc.connect( new InetSocketAddress(…)); while (sc.read(buf) != -1){ sc != null sc.write(buf); } if (sc != null ) sc.close(); sc.close(); } return

  31. Reduce Control Flow Graph public void simplifiedTransformData() sc = …open() { SocketChannel sc; sc.connect(…) ByteBuffer buf; sc = SocketChannel.open(); while… sc.connect( new InetSocketAddress(…)); while (sc.read(buf) != -1){ sc != null sc.write(buf); } if (sc != null ) sc.close(); sc.close(); } return

  32. Reduce Control Flow Graph public void simplifiedTransformData() sc = …open() { SocketChannel sc; sc.connect(…) ByteBuffer buf; sc = SocketChannel.open(); while… sc.connect( new InetSocketAddress(…)); while (sc.read(buf) != -1){ if… sc.write(buf); } if (sc != null ) return sc.close(); }

  33. Algorithm Basic Steps 1. Reduces a control flow graph region to a sequence of single entry and single exit regions 2. Calls static typestate analysis to calculate functional summaries of reachable program regions 3. Within a region, identify candidate safe regions by marking boundaries that cannot be crossed by any safe region 4. Identify safe regions inside candidate safe regions 5. Drop (and if required, add) FSA transitions for safe regions 6. Repeat the steps for all regions that lie outside safe regions

  34. Calculate Functional Summary public void simplifiedTransformData() sc = …open() { SocketChannel sc; sc.connect(…) ByteBuffer buf; sc = SocketChannel.open(); while… 3->3 sc.connect( new InetSocketAddress(…)); while (sc.read(buf) != -1){ if… sc.write(buf); } if (sc != null ) return sc.close(); }

  35. Algorithm Basic Steps 1. Reduces a control flow graph region to a sequence of single entry regions 2. Calls static typestate analysis to calculate functional summaries of reachable program regions 3. Within a region, identify candidate safe regions by marking boundaries that cannot be crossed by any safe region 4. Identify safe regions inside candidate safe regions 5. Drop (and if required, add) FSA transitions for safe regions 6. Repeat the steps for all regions that lie outside safe regions

  36. Identify Candidate Safe Regions err 1 2 3 r1 r2 r3 r4 r5 r6

  37. Identify Candidate Safe Regions err 1 2 3 r1 r2 r3 r4 r5 r6

  38. Identify Candidate Safe Regions r1 err 1 2 3 r1 1->{1,2} 3->{3} r1 r2 r3 r4 r5 r6 Region Matrix

  39. Identify Candidate Safe Regions r1 err 1 2 3 r1 1->{1,2} 3->{3} r1 r2 r3 r4 r5 r6 Region Matrix

  40. Identify Candidate Safe Regions r1 r2 err 1 2 3 1->{1,2} 1->{2} r1 3->{3} 3->{3} r1 1->{2} r2 2->{2} r2 3->{3} r3 r4 r5 r6 Region Matrix

  41. Identify Candidate Safe Regions r1 r2 err 1 2 3 1->{1,2} 1->{2} r1 3->{3} 3->{3} r1 1->{2} r2 2->{2} r2 3->{3} r3 r4 r5 r6 Region Matrix

  42. Identify Candidate Safe Regions r1 r2 err 1 2 3 1->{1,2} 1->{2} r1 3->{3} 3->{3} r1 1->{2} r2 2->{2} r2 3->{3} r3 r4 r5 r6 Region Matrix

  43. Identify Candidate Safe Regions r1 r2 r3 err 1 2 3 1->{1,2} 1->{2} 1->{1,2} r1 3->{3} 3->{3} 3->{3} r1 1->{2} 1->{1,2} r2 2->{2} 2->{1,2} r2 3->{3} 3->{3} r3 2->{1,2} r3 3->{3} r4 r5 r6 Region Matrix

  44. Identify Candidate Safe Regions r1 r2 r3 err 1 2 3 1->{1,2} 1->{2} 1->{1,2} r1 3->{3} 3->{3} 3->{3} r1 1->{2} 1->{1,2} r2 2->{2} 2->{1,2} r2 3->{3} 3->{3} r3 2->{1,2} r3 3->{3} r4 r5 r6 Region Matrix

  45. Identify Candidate Safe Regions r1 r2 r3 r4 err 1 2 3 1->{1,2} 1->{2} 1->{1,2} 1->{1,2} r1 3->{3} 3->{3} 3->{3} 3->{3} r1 1->{2} 1->{1,2} 1->{1,2} r2 2->{2} 2->{1,2} 2->{1,2} r2 3->{3} 3->{3} 3->{3} r3 2->{1,2} 2->{1,2} r3 3->{3} 3->{3} r4 1->{2} 2->{1} r4 r5 3->{3} r6 Region Matrix

  46. Identify Candidate Safe Regions r1 r2 r3 r4 err 1 2 3 1->{1,2} 1->{2} 1->{1,2} 1->{1,2} r1 3->{3} 3->{3} 3->{3} 3->{3} r1 1->{2} 1->{1,2} 1->{1,2} r2 2->{2} 2->{1,2} 2->{1,2} r2 3->{3} 3->{3} 3->{3} r3 2->{1,2} 2->{1,2} r3 3->{3} 3->{3} r4 1->{2} 2->{1} r4 r5 3->{3} r6 Region Matrix

  47. Identify Candidate Safe Regions r1 r2 r3 r4 r5 err 1 2 3 1->{1,2} 1->{2} 1->{1,2} 1->{1,2} 1->{1,2} r1 3->{3} 3->{3} 3->{3} 3->{3} 3->{3} r1 1->{2} 1->{1,2} 1->{1,2} 1->{1,2} r2 2->{2} 2->{1,2} 2->{1,2} 2->{1,2} r2 3->{3} 3->{3} 3->{3} 3->{3} r3 2->{1,2} 2->{1,2} 2->{1,2} r3 3->{3} 3->{3} 3->{3} r4 1->{2} 1->{1} 2->{1} 2->{2} r4 r5 3->{3} 3->{3} 1->{2} r6 Region Matrix r5 2->{1} 3->{3}

  48. Identify Candidate Safe Regions r1 r2 r3 r4 r5 err 1 2 3 1->{1,2} 1->{2} 1->{1,2} 1->{1,2} 1->{1,2} r1 3->{3} 3->{3} 3->{3} 3->{3} 3->{3} r1 1->{2} 1->{1,2} 1->{1,2} 1->{1,2} r2 2->{2} 2->{1,2} 2->{1,2} 2->{1,2} r2 3->{3} 3->{3} 3->{3} 3->{3} r3 2->{1,2} 2->{1,2} 2->{1,2} r3 3->{3} 3->{3} 3->{3} r4 1->{2} 1->{1} 2->{1} 2->{2} r4 r5 3->{3} 3->{3} 1->{2} r6 Region Matrix r5 2->{1} 3->{3}

  49. Identify Candidate Safe Regions r1 r2 r3 r4 r5 err 1 2 3 1->{1,2} 1->{2} 1->{1,2} 1->{1,2} 1->{1,2} r1 3->{3} 3->{3} 3->{3} 3->{3} 3->{3} r1 1->{2} 1->{1,2} 1->{1,2} 1->{1,2} r2 2->{2} 2->{1,2} 2->{1,2} 2->{1,2} r2 3->{3} 3->{3} 3->{3} 3->{3} r3 2->{1,2} 2->{1,2} 2->{1,2} r3 3->{3} 3->{3} 3->{3} r4 1->{2} 1->{1} 2->{1} 2->{2} r4 r5 3->{3} 3->{3} 1->{2} r6 Region Matrix r5 2->{1} 3->{3}

  50. Algorithm Basic Steps 1. Reduces a control flow graph region to a sequence of single entry regions 2. Calls static typestate analysis to calculate functional summaries of reachable program regions 3. Within a region, identify candidate safe regions by marking boundaries that cannot be crossed by any safe region 4. Identify safe regions inside candidate safe regions 5. Drop (and if required, add) FSA transitions for safe regions 6. Repeat the steps for all regions that lie outside safe regions

  51. Identify Safe Regions r1 r2 r3 r4 r5 err 1 2 3 1->{1,2} 1->{2} 1->{1,2} 1->{1,2} 1->{1,2} r1 3->{3} 3->{3} 3->{3} 3->{3} 3->{3} r1 1->{2} 1->{1,2} 1->{1,2} 1->{1,2} r2 2->{2} 2->{1,2} 2->{1,2} 2->{1,2} r2 3->{3} 3->{3} 3->{3} 3->{3} r3 2->{1,2} 2->{1,2} 2->{1,2} r3 3->{3} 3->{3} 3->{3} r4 1->{2} 1->{1} 2->{1} 2->{2} r4 r5 3->{3} 3->{3} 1->{2} r6 Region Matrix r5 2->{1} 3->{3}

  52. Identify Safe Regions r1 r2 r3 r4 r5 err 1 2 3 1->{1,2} 1->{2} 1->{1,2} 1->{1,2} 1->{1,2} r1 3->{3} 3->{3} 3->{3} 3->{3} 3->{3} r1 1->{2} 1->{1,2} 1->{1,2} 1->{1,2} r2 2->{2} 2->{1,2} 2->{1,2} 2->{1,2} r2 3->{3} 3->{3} 3->{3} 3->{3} r3 2->{1,2} 2->{1,2} 2->{1,2} r3 3->{3} 3->{3} 3->{3} r4 1->{2} 1->{1} 2->{1} 2->{2} r4 r5 3->{3} 3->{3} 1->{2} r6 Region Matrix r5 2->{1} 3->{3}

  53. Identify Safe Regions r1 r2 r3 r4 r5 err 1 2 3 1->{1,2} 1->{2} 1->{1,2} 1->{1,2} 1->{1,2} r1 3->{3} 3->{3} 3->{3} 3->{3} 3->{3} r1 1->{2} 1->{1,2} 1->{1,2} 1->{1,2} r2 2->{2} 2->{1,2} 2->{1,2} 2->{1,2} r2 3->{3} 3->{3} 3->{3} 3->{3} r3 2->{1,2} 2->{1,2} 2->{1,2} r3 3->{3} 3->{3} 3->{3} r4 1->{2} 1->{1} 2->{1} 2->{2} r4 r5 3->{3} 3->{3} 1->{2} r6 Region Matrix r5 2->{1} 3->{3}

  54. Identify Safe Regions r1 r2 r3 r4 r5 err 1 2 3 1->{1,2} 1->{2} 1->{1,2} 1->{1,2} 1->{1,2} r1 3->{3} 3->{3} 3->{3} 3->{3} 3->{3} r1 1->{2} 1->{1,2} 1->{1,2} 1->{1,2} r2 2->{2} 2->{1,2} 2->{1,2} 2->{1,2} r2 3->{3} 3->{3} 3->{3} 3->{3} r3 2->{1,2} 2->{1,2} 2->{1,2} r3 3->{3} 3->{3} 3->{3} r4 1->{2} 1->{1} 2->{1} 2->{2} r4 r5 3->{3} 3->{3} 1->{2} r6 Region Matrix r5 2->{1} 3->{3}

  55. Identify Safe Regions r1 r2 r3 r4 r5 err 1 2 3 1->{1,2} 1->{2} 1->{1,2} 1->{1,2} 1->{1,2} r1 3->{3} 3->{3} 3->{3} 3->{3} 3->{3} r1 1->{2} 1->{1,2} 1->{1,2} 1->{1,2} r2 2->{2} 2->{1,2} 2->{1,2} 2->{1,2} r2 3->{3} 3->{3} 3->{3} 3->{3} r3 2->{1,2} 2->{1,2} 2->{1,2} r3 3->{3} 3->{3} 3->{3} r4 1->{2} 1->{1} 2->{1} 2->{2} r4 r5 3->{3} 3->{3} 1->{2} r6 Region Matrix r5 2->{1} 3->{3}

  56. Identify Safe Regions r1 r2 r3 r4 r5 err 1 2 3 1->{1,2} 1->{2} 1->{1,2} 1->{1,2} 1->{1,2} r1 3->{3} 3->{3} 3->{3} 3->{3} 3->{3} r1 1->{2} 1->{1,2} 1->{1,2} 1->{1,2} r2 2->{2} 2->{1,2} 2->{1,2} 2->{1,2} r2 3->{3} 3->{3} 3->{3} 3->{3} r3 2->{1,2} 2->{1,2} 2->{1,2} r3 3->{3} 3->{3} 3->{3} r4 1->{2} 1->{1} 2->{1} 2->{2} r4 r5 3->{3} 3->{3} 1->{2} r6 Region Matrix r5 2->{1} 3->{3}

  57. Identify Safe Regions r1 r2 r3 r4 r5 err 1 2 3 1->{1,2} 1->{2} 1->{1,2} 1->{1,2} 1->{1,2} r1 3->{3} 3->{3} 3->{3} 3->{3} 3->{3} r1 1->{2} 1->{1,2} 1->{1,2} 1->{1,2} r2 2->{2} 2->{1,2} 2->{1,2} 2->{1,2} r2 3->{3} 3->{3} 3->{3} 3->{3} r3 2->{1,2} 2->{1,2} 2->{1,2} r3 3->{3} 3->{3} 3->{3} r4 1->{2} 1->{1} 2->{1} 2->{2} r4 r5 3->{3} 3->{3} 1->{2} r6 Region Matrix r5 2->{1} 3->{3}

  58. Identify Safe Regions r1 r2 r3 r4 r5 err 1 2 3 1->{1,2} 1->{2} 1->{1,2} 1->{1,2} 1->{1,2} r1 3->{3} 3->{3} 3->{3} 3->{3} 3->{3} r1 1->{2} 1->{1,2} 1->{1,2} 1->{1,2} r2 2->{2} 2->{1,2} 2->{1,2} 2->{1,2} r2 3->{3} 3->{3} 3->{3} 3->{3} r3 2->{1,2} 2->{1,2} 2->{1,2} r3 3->{3} 3->{3} 3->{3} r4 1->{2} 1->{1} 2->{1} 2->{2} r4 r5 3->{3} 3->{3} 1->{2} r6 Region Matrix r5 2->{1} 3->{3}

  59. Identify Safe Regions r1 r2 r3 r4 r5 err 1 2 3 1->{1,2} 1->{2} 1->{1,2} 1->{1,2} 1->{1,2} r1 3->{3} 3->{3} 3->{3} 3->{3} 3->{3} r1 1->{2} 1->{1,2} 1->{1,2} 1->{1,2} r2 2->{2} 2->{1,2} 2->{1,2} 2->{1,2} r2 3->{3} 3->{3} 3->{3} 3->{3} r3 2->{1,2} 2->{1,2} 2->{1,2} r3 3->{3} 3->{3} 3->{3} r4 1->{2} 1->{1} 2->{1} 2->{2} r4 r5 3->{3} 3->{3} 1->{2} r6 Region Matrix r5 2->{1} 3->{3}

  60. Identify Safe Regions r1 r2 r3 r4 r5 err 1 2 3 1->{1,2} 1->{2} 1->{1,2} 1->{1,2} 1->{1,2} r1 3->{3} 3->{3} 3->{3} 3->{3} 3->{3} r1 1->{2} 1->{1,2} 1->{1,2} 1->{1,2} r2 2->{2} 2->{1,2} 2->{1,2} 2->{1,2} r2 3->{3} 3->{3} 3->{3} 3->{3} r3 2->{1,2} 2->{1,2} 2->{1,2} r3 3->{3} 3->{3} 3->{3} r4 1->{2} 1->{1} 2->{1} 2->{2} r4 r5 3->{3} 3->{3} 1->{2} r6 Region Matrix r5 2->{1} 3->{3}

  61. Identify Safe Regions r1 r2 r3 r4 r5 err 1 2 3 1->{1,2} 1->{2} 1->{1,2} 1->{1,2} 1->{1,2} r1 3->{3} 3->{3} 3->{3} 3->{3} 3->{3} r1 1->{2} 1->{1,2} 1->{1,2} 1->{1,2} r2 2->{2} 2->{1,2} 2->{1,2} 2->{1,2} r2 3->{3} 3->{3} 3->{3} 3->{3} r3 2->{1,2} 2->{1,2} 2->{1,2} r3 3->{3} 3->{3} 3->{3} r4 1->{2} 1->{1} 2->{1} 2->{2} r4 r5 3->{3} 3->{3} 1->{2} r6 Region Matrix r5 2->{1} 3->{3}

  62. Identify Safe Regions r1 r2 r3 r4 r5 err 1 2 3 1->{1,2} 1->{2} 1->{1,2} 1->{1,2} 1->{1,2} r1 3->{3} 3->{3} 3->{3} 3->{3} 3->{3} r1 1->{2} 1->{1,2} 1->{1,2} 1->{1,2} r2 2->{2} 2->{1,2} 2->{1,2} 2->{1,2} r2 safe 3->{3} 3->{3} 3->{3} 3->{3} r3 2->{1,2} 2->{1,2} 2->{1,2} r3 3->{3} 3->{3} 3->{3} r4 1->{2} 1->{1} 2->{1} 2->{2} r4 identity r5 3->{3} 3->{3} 1->{2} r6 Region Matrix r5 2->{1} 3->{3}

Recommend


More recommend