Mizuhito Ogawa

Make it practical: a generic linear-time algorithm for solving maximum-weightsum problems

In this paper we propose a new method for deriving a practical linear-time algorithm from the specification of a maximum-weightsum problem: From the elements of a data structure x, find a subset which satisfies a certain property p and whose weightsum is maximum. Previously proposed methods for automatically generating linear-time algorithms are theoretically appealing, but the algorithms generated are hardly useful in practice due to a huge constant factor for space and time. The key points of our approach are to express the property p by a recursive boolean function over the structure x rather than a usual logical predicate and to apply program transformation techniques to reduce the constant factor. We present an optimization theorem, give a calculational strategy for applying the theorem, and demonstrate the effectiveness of our approach through several nontrivial examples which would be difficult to deal with when using the methods previously available.

Well-Structured pushdown systems

Pushdown systems (PDSs) model single-thread recursive programs, and well-structured transition systems (WSTSs), such as vector addition systems, are useful to represent non-recursive multi-thread programs. Combining these two ideas, our goal is to investigate well-structured pushdown systems (WSPDSs), pushdown systems with well-quasi-ordered control states and stack alphabet. This paper focuses on subclasses of WSPDSs, in which the coverability becomes decidable. We apply WSTS-like techniques on classical P-automata. A Post*-automata (resp. Pre*-automata) construction is combined with Karp-Miller acceleration (resp. ideal representation) to characterize the set of successors (resp. predecessors) of given configurations. As examples, we show that the coverability is decidable for recursive vector addition system with states, multi-set pushdown systems, and a WSPDS with finite control states and well-quasi-ordered stack alphabet.

Nested timed automata

This paper proposes a new timed model named nested timed automata (NeTAs). A NeTA is a pushdown system whose stack symbols are timed automata (TAs). It either behaves as the top TA in the stack, or switches from one TA to another by pushing, popping, or changing the top TA of the stack. Different from existing component-based context-switch models such as recursive timed automata and timed recursive state machines, when time passage happens, all clocks of TAs in the stack elapse uniformly. We show that the safety property of NeTAs is decidable by encoding NeTAs to the dense timed pushdown automata. NeTAs provide a natural way to analyze the recursive behaviors of component-based timed systems with structure retained. We illustrate this advantage by the deadline analysis of nested interrupts.

Perpetuality and Uniform Normalization in Orthogonal Rewrite Systems

We study perpetuality of reduction steps, as well as perpetuality of redexes, in orthogonal rewrite systems. A perpetual step is a reduction step which retains the possibility of infinite reductions. A perpetual redex is a redex which, when put into an arbitrary context, yields a perpetual step. We generalize and refine existing criteria for the perpetuality of reduction steps and redexes in orthogonal term rewriting systems and the ?-calculus due to Bergstra and Klop and others. We first introduce context-sensitive conditional expression reduction systems (CCERSs) and define a concept of orthogonality (which implies confluence) for them. In particular, several important ?-calculi and their extensions and restrictions can naturally be embedded into orthogonal CCERSs. We then define a perpetual reduction strategy which enables one to construct minimal (w.r.t. Levys permutation ordering on reductions) infinite reductions in orthogonal fully-extended CCERSs. Using the properties of the minimal perpetual strategy, we prove 1.perpetuality of any reduction step that does not erase potentially infinite arguments, which are arguments that may become, via substitution, infinite after a number of outside steps, and 2.perpetuality (in every context) of any safe redex, which is a redex whose substitution instances may discard infinite arguments only when the corresponding contracta remain infinite. We prove both these perpetuality criteria for orthogonal fully-extended CCERSs and then specialize and apply them to restricted ?-calculi, demonstrating their usefulness. In particular, we prove the equivalence of weak and strong normalization (whose equivalence is here called uniform normalization) for various restricted ?-calculi, most of which cannot be derived from previously known perpetuality criteria.

SMT for Polynomial Constraints on Real Numbers

This paper preliminarily reports an SMT for solving polynomial inequalities over real numbers. Our approach is a combination of interval arithmetic (over-approximation, aiming to decide unsatisfiability) and testing (under-approximation, aiming to decide satisfiability) to sandwich precise results. In addition to existing interval arithmetic, such as classical intervals and affine intervals, we newly design Chebyshev Approximation Intervals, focusing on multiplications of the same variables, like Taylor expansions. When testing cannot find a satisfiable instance, this framework is designed to start a refinement loop by splitting input ranges into smaller ones (although this refinement loop implementation is left to future work). Preliminary experiments on small benchmarks from SMT-LIB are also shown.

Obfuscation Code Localization Based on CFG Generation of Malware

This paper presents a tool BE-PUM (Binary Emulator for PUshdown Model generation), which generates a precise control flow graph (CFG), under presence of typical obfuscation techniques of malware, e.g., indirect jump, self-modification, overlapping instructions, and structured exception handler (SEH), which cover packers. Experiments are performed on 2000 real-world malware examples taken from VX Heaven and compare the results of a popular commercial disassembler IDA Pro, a state-of-the-art tool JakStab, and BE-PUM. It shows that BE-PUM correctly traces CFGs, whereas IDA Pro and JakStab fail. By manual inspection on 300 malware examples, we also observe that the starts of these failures exactly locate the entries of obfuscation code.

A Hybrid Approach for Control Flow Graph Construction from Binary Code

Binary code analysis has attracted much attention. The difficulty lies in constructing a Control Flow Graph (CFG), which is dynamically generated and modified, such as mutations. Typical examples are handling dynamic jump instructions, in which destinations may be directly modified by rewriting loaded instructions on memory. In this paper, we describe a PhD project proposal on a hybrid approach that combines static analysis and dynamic testing to construct CFG from binary code. Our aim is to minimize false targets produced when processing indirect jumps during CFG construction. To evaluate the potential of our approach, we preliminarily compare results between our method and Jakstab, a state-of-the-art tool in this field.

Conditional weighted pushdown systems and applications

Pushdown systems are well understood as abstract models of programs with (recursive) procedures. Reps et al. recently extended pushdown systems into weighted pushdown systems, which serve as a generalized framework for solving certain kinds of meet-over-all-path problems in program analysis. In this paper, we extend weighted pushdown systems to conditional weighted pushdown systems, by further specifying conditions under which a pushdown transition rule can be applied, and show that model checking problems on conditional weighted pushdown systems can be reduced to those on weighted pushdown systems. There are wider applications of conditional weighted pushdown systems when analyzing programs with objected-oriented features, for which weighted pushdown systems is not precise enough under a direct application. As an example, we lift a stacking-based points-to analysis for Java designed in the framework of weighted pushdown systems to a more precise counterpart in the framework of conditional weighted pushdown systems. In addition to the fundamental context-sensitivity in terms of valid paths, the lifted points-to analysis algorithm further enjoys context-sensitivity with respect to objected-oriented features, including call graph construction, heap abstraction, and heap access. These context-sensitive properties are shown to be crucial to the analysis precision in practice.

Event-Clock Visibly Pushdown Automata

We introduce the class of event-clock visibly pushdown automata (ECVPAs) as an extension of event-clock automata. The class of ECVPAs, on one hand, can model simple real-time pushdown systems and, on the other hand, is determinizable and closed under Boolean operations. We also show that for a timed visibly pushdown automaton A and an ECVPA B, the inclusion problem L(A) ⊆ L(B) is decidable.

Nested Timed Automata with Frozen Clocks

A nested timed automaton (NeTA) is a pushdown system whose control locations and stack alphabet are timed automata (TAs). A control location describes a working TA, and the stack presents a pile of interrupted TAs. In NeTAs, all local clocks of TAs proceed uniformly also in the stack. This paper extends NeTAs with frozen local clocks (NeTA-Fs). All clocks of a TA in the stack can be either frozen or proceeding when it is pushed. A NeTA-F also allows global clocks adding to local clocks in the working TA, which can be referred and/or updated from the working TA. We investigate the reachability of NeTA-Fs showing that (1) the reachability with a single global clock is decidable, and (2) the reachability with multiple global clocks is undecidable.