From uncertainty to belief: Inferring the specification within

DMCA

From uncertainty to belief: Inferring the specification within (2006)

Cached

Download Links

Other Repositories/Bibliography

DBLP

by Ted Kremenek , Paul Twohey , Godmar Back , Andrew Ng , Dawson Engler

Venue:	In ”Proceedings of the Seventh Symposium on Operating Systems Design and Implemetation
Citations:	82 - 0 self

BibTeX

@INPROCEEDINGS{Kremenek06fromuncertainty,
    author = {Ted Kremenek and Paul Twohey and Godmar Back and Andrew Ng and Dawson Engler},
    title = {From uncertainty to belief: Inferring the specification within},
    booktitle = {In ”Proceedings of the Seventh Symposium on Operating Systems Design and Implemetation},
    year = {2006},
    pages = {161--176},
    publisher = {USENIX Association}
}

OpenURL

Abstract

Automatic tools for finding software errors require a set of specifications before they can check code: if they do not know what to check, they cannot find bugs. This paper presents a novel framework based on factor graphs for automatically inferring specifications directly from programs. The key strength of the approach is that it can incorporate many disparate sources of evidence, allowing us to squeeze significantly more information from our observations than previously published techniques. We illustrate the strengths of our approach by applying it to the problem of inferring what functions in C programs allocate and release resources. We evaluated its effectiveness on five codebases: SDL, OpenSSH, GIMP, and the OS kernels for Linux and Mac OS X (XNU). For each codebase, starting with zero initially provided annotations, we observed an inferred annotation accuracy of 80-90%, with often near perfect accuracy for functions called as little as five times. Many of the inferred allocator and deallocator functions are functions for which we both lack the implementation and are rarely called — in some cases functions with at most one or two callsites. Finally, with the inferred annotations we quickly found both missing and incorrect properties in a specification used by a commercial static bug-finding tool. 1

Keyphrases

release resource perfect accuracy automatic tool inferred annotation incorrect property many disparate source novel framework inferred annotation accuracy inferred allocator deallocator function o kernel mac o key strength factor graph case function commercial static bug-finding tool software error

DMCA