Mariam Kamkar

An overview and comparative classification of program slicing techniques

Program slicing is a method for decomposing programs into slices. A program slice contains all statements that could have influenced the value of a variable of interest at some program point. The technique of program slicing has up to now been applied within a number of areas, such as software maintenance, program integration, testing, parallel processing distribution and, especially, program debugging. A slice of a program is computed either by use of static information (a static slice) or dynamic information (a dynamic slice). A static slice of a program, although imprecise, contains much broader information, and thus it tends to be much thicker than the corresponding dynamic slice. The reason is that, for a specified variable in a program, the static slice is the collection of all possible computations of values of that variable. On the other hand, a dynamic slice isolates the unique computation of the value of the specified variable for a certain program execution. The current literature on slicing is becoming unwieldy, with many different notions and methods. This article attempts to bring order to disorder by identifying and classifying different notions of program slicing and their applications. A new notion of execution slice and a method for interprocedural dynamic slicing are introduced as well.

Generalized algorithmic debugging and testing

This paper presents a method for semi-automatic bug localization, generalized algorithmic debugging, which has been integrated with the category partition method for functional testing. In this way the efficiency of the algorithmic debugging method for bug localization can be improved by using test specifications and test results. The long-range goal of this work is a semi-automatic debugging and testing system which can be used during large-scale program development of nontrivial programs. The method is generally applicable to procedural langua ges and is not dependent on any ad hoc assumptions regarding the subject program. The original form of algorithmic debugging, introduced by Shapiro, was however limited to small Prolog programs without side-effects, but has later been generalized to concurrent logic programming languages. Another drawback of the original method is the large number of interactions with the user during bug localization. To our knowledge, this is the first method which uses category partition testing to improve the bug localization properties of algorithmic debugging. The method can avoid irrelevant questions to the programmer by categorizing input parameters and then match these against test cases in the test database. Additionally, we use program slicing, a data flow analysis technique, to dynamically compute which parts of the program are relevant for the search, thus further improving bug localization. We believe that this is the first generalization of algorithmic debugging for programs with side-effects written in imperative languages such as Pascal. These improvements together makes it more feasible to debug larger programs. However, additional improvements are needed to make it handle pointer-related side-effects and concurrent Pascal programs. A prototype generalized algorithmic debugger for a Pascal subset without pointer side-effects and a test case generator for application programs in Pascal, C, dBase, and LOTUS have been implemented.

Dynamic slicing of distributed programs

As software applications grow larger and become more complex, program maintenance activities such as adding new functionality, debugging, and testing consume an increasing amount of available resources for software development. This is especially true for distributed systems communicating via message passing. In order to cope with this increased complexity, programmers need effective computer supported methods for decomposition and dependence analysis of programs. Program slicing is one method for such decomposition and dependence analysis. A program slice with respect to a specified variable at some program point consists of those parts of the program which potentially affect the value of that variable at the particular program point. A static slice is valid for all possible executions of a program while a dynamic slice considers only a particular execution of a program. In this paper we present a technique for dynamic slicing of distributed programs which computes accurate slices. We introduce the notion of distributed dynamic dependence graph (DDDG) which represents control, data and communication dependences in a distributed program. This graph is built at run time and used to compute dynamic slices of the program. A distributed dynamic slicer for ANSI-C programming language has been implemented on a parallel MIMD computer of type Parsytec GC/Powerplus with 128 PowerPC processors.

RIPE: runtime intrusion prevention evaluator

Despite the plethora of research done in code injection countermeasures, buffer overflows still plague modern software. In 2003, Wilander and Kamkar published a comparative evaluation on runtime buffer overflow prevention technologies using a testbed of 20 attack forms and demonstrated that the best prevention tool missed 50% of the attack forms. Since then, many new prevention tools have been presented using that testbed to show that they performed better, not missing any of the attack forms. At the same time though, there have been major developments in the ways of buffer overflow exploitation. In this paper we present RIPE, an extension of Wilanders and Kamkars testbed which covers 850 attack forms. The main purpose of RIPE is to provide a standard way of testing the coverage of a defense mechanism against buffer overflows. In order to test RIPE we use it to empirically evaluate some of the newer prevention techniques. Our results show that the most popular, publicly available countermeasures cannot prevent all of RIPEs buffer overflow attack forms. ProPolice misses 60%, LibsafePlus+TIED misses 23%, CRED misses 21%, and Ubuntu 9.10 with nonexecutable memory and stack protection misses 11%.

Interprocedural Dynamic Slicing

This paper presents the first algorithm for interprocedural dynamic slicing. Previous methods for dynamic slicing only considered languages without procedures and procedure calls. This method generates summary information for each procedure call and represents a program as a summary graph of dynamic dependencies. A slice on this graph consists of nodes for all procedure calls of the program that affect the value of a given variable. The size of the information saved by this method is considerably smaller than what is needed by previous methods for dynamic slicing [AH90], since it only depends on the size of the programs execution tree, i.e. the number of executed procedure calls, which is much smaller than the size of a trace of all executed statements. In addition, work space for the temporary graph is needed, proportional to the maximum sum of the sizes of simultaneously active procedures. A program slice can be produced from the interprocedural slice on the graph if a suitable definition of control dependency is used when the summary graph is constructed. The interprocedural dynamic slicing introduced in this paper is being used to improve the bug localization properties of the Generalized Algorithmic Debugging Technique [FGKS91], a method for declarative semi-automatic debugging.

Three approaches to interprocedural dynamic slicing

Abstract The need of maintenance and modification demand that large programs be decomposed into manageable parts. Program slicing is one method for such decomposition. A program slice with respect to a specified variable at some program point consists of those parts of the program that may directly or indirectly affect the value of that variable at the particular program point. This is useful for understanding dependences within programs. A static program slice [Wei84] is computed using static data-and control flow analysis and is valid for all possible executions of the program. Static slices are often impricise, i.e., they contain unnecessarily large parts of the program. Dynamic slices [KL90] [AH90] [however, are precise but are valid only for a single execution of the program. Interprocedural dynamic slices can be computed for programs with procedures. This paper presents the first three techniques for interprocedural dynamic slicing which deal with procedures/ functions at the abstract level. All three methods first generate summary information for each procedure call 9or function application), then represent a program as a summary graph of dynamic dependences. A slice on this graph consists of vertices for all procedure calls of the program that affect the value of a given variable at the specified program point. The amount of information saved by these methods is considerably less than what is needed by previous methods for dynamic slicing [KL90] [AH90], since it only depends on the size of the programs execution tree, i.e., the number of executed procedure calls, which is smaller than a trace of all executed statements. The interprocedural dynamic slicing methods introduced here are applicable in at least two areas, program debugging [SKF90] [KSF90] and data flow testing.

Bug Localization by Algorithmic Debugging and Program Slicing

This paper presents a generalized version of algorithmic debugging, a method for semi-automatic bug localization. The method is generally applicable to procedural languages, and is not dependent on any ad hoc assumptions regarding the subject program. The original form of algorithmic debugging, introduced by Shapiro [Shapiro-83], is however limited to small Prolog programs without side-effects. Another drawback of the original method is the large number of interactions with the user during bug localization.

Semi-automatic bug localization in software maintenance

An algorithmic program debugger for imperative languages is presented, with Pascal as an example case. This debugger extends the power of existing debuggers by providing an interactive debugging facility where errors can be localized semiautomatically. The debugger is activated on demand when the user discovers a symptom of an error as the result of some computation. This symptom presumably denotes a difference between the intended program behavior and the actual behavior. The proposed approach consists of three phases: program transformation, tracing, and debugging. The first phase transforms the source program into an internal representation which is appropriate, according to the Shapiro model, for algorithmic debugging. This phase produces an intermediate program which is free from side effects and loops. The program tracing phase generates trace information which builds an execution tree for the erroneous program. The debugging phase performs bug localization through a number of user interactions. This phase consists of pure algorithmic program debugging and program slicing.<<ETX>>

Application of program slicing in algorithmic debugging

Abstract Debugging has always been a costly part of software development and software maintenance, which makes it important to find methods and tools to support this activity. Algorithmic program debugging is an interactive process where the debugging system acquires knowledge about the intended behavior of the debugged program and uses this knowledge to localize errors semi-automatically. This knowledge is a set of partial specifications collected by the debugging system through a number of questions to the user. Although in theory the specifications about the intended program behavior can be stored in advance, this is still an error-prone task in practice. Thus, knowledge collection during debugging is a necessity. A major drawback of this method is the large number of user interactions during bug localization. An important improvement would be to supply the debugging system with some information which can reduce this number. This is achieved by combining program slicing with algorithmic debugging. Program slicing improves the search method by eliminating many irrelevant questions to the user during bug localization.

Analysis of the constraint solver in UNA based test data generation

In a series of articles Gupta et al. develop a framework for automatic test data generation for computer programs. In general, their approach consists of a branch predicate collector, which derives a system of linear inequalities representing the branch predicates for a given path in the program. This system is solved using a solving technique of theirs called the Unified Numerical Approach (UNA) [5, 7]. In this paper we show that in contrast to traditional optimization methods the UNA is not bounded by the size of the solved system. Instead it depends on how input is composed. That is, even for very simple systems consisting of one variable we can easily get more than a thousand iterations. We will also give a formal proof that UNA does not always find a mixed integer solution when there is one. Finally, we suggest using some traditional optimization method instead, like the simplex method in combination with branch-and-bound and/or a cutting-plane algorithm as a constraint solver.