CARET analysis of multithreaded programs Huu-Vu Nguyen 1 , Tayssir - - PowerPoint PPT Presentation

▶
caret analysis of multithreaded programs
SMART_READER_LITE
LIVE PREVIEW

CARET analysis of multithreaded programs Huu-Vu Nguyen 1 , Tayssir - - PowerPoint PPT Presentation

Mar 15, 2024 174 likes •980 views

CARET analysis of multithreaded programs Huu-Vu Nguyen 1 , Tayssir Touili 2 1 University Paris Diderot and LIPN 2 LIPN, CNRS and University Paris 13 Motivation Malware detection is a big challenge. Existing Techniques (not robust)

slide-1
SLIDE 1

CARET analysis of multithreaded programs

Huu-Vu Nguyen1, Tayssir Touili2

1 University Paris Diderot and LIPN 2 LIPN, CNRS and University Paris 13

slide-2
SLIDE 2

Motivation

Malware detection is a big challenge. Existing Techniques (not robust) Signature-matching based technique: can easily be overcome by

  • bfuscation techniques

Code emulation based techniques: limitation in execution time

CARET analysis of multithreaded programs 2 / 42

slide-3
SLIDE 3

Motivation

Malware detection is a big challenge. Existing Techniques (not robust) Signature-matching based technique: can easily be overcome by

  • bfuscation techniques

Code emulation based techniques: limitation in execution time Solution to have a robust technique Model-checking for malware detection allow us to analyse the behaviors (not the syntax) of the program without executing it

CARET analysis of multithreaded programs 2 / 42

slide-4
SLIDE 4

Model-checking for Malware Detection

CARET analysis of multithreaded programs 3 / 42

slide-5
SLIDE 5

Model-checking for Malware Detection

CARET analysis of multithreaded programs 4 / 42

slide-6
SLIDE 6

Model-checking for Malware Detection

CARET analysis of multithreaded programs 5 / 42

slide-7
SLIDE 7

Model-checking for Malware Detection

CARET analysis of multithreaded programs 6 / 42

slide-8
SLIDE 8

Model-checking for Malware Detection

CARET analysis of multithreaded programs 7 / 42

slide-9
SLIDE 9

Model-checking for Malware Detection

CARET analysis of multithreaded programs 8 / 42

slide-10
SLIDE 10

Model-checking for Malware Detection

CARET analysis of multithreaded programs 9 / 42

slide-11
SLIDE 11

Model-checking for Malware Detection

CARET analysis of multithreaded programs 10 / 42

slide-12
SLIDE 12

Model-checking for Malware Detection

CARET analysis of multithreaded programs 11 / 42

slide-13
SLIDE 13

Model-checking for Malware Detection

CARET analysis of multithreaded programs 12 / 42

slide-14
SLIDE 14

Why Pushdown Systems?

Stack of binary codes important for malware detection [Song and Touili 2012, 2013] Pushdown Systems (PDSs) natural model of sequential programs allow taking into account the procedure contexts and stack content in the model

CARET analysis of multithreaded programs 13 / 42

slide-15
SLIDE 15

Why Pushdown Systems?

Stack of binary codes important for malware detection [Song and Touili 2012, 2013] Pushdown Systems (PDSs) natural model of sequential programs allow taking into account the procedure contexts and stack content in the model PDSs for Binary Codes Control locations of PDSs correspond to program points Stack of PDSs correspond to stack of binary programs

CARET analysis of multithreaded programs 13 / 42

slide-16
SLIDE 16

Model-checking for Malware Detection = ⇒ Problem: This can be applied only for sequential programs. However, several malware is concurrent.

CARET analysis of multithreaded programs 14 / 42

slide-17
SLIDE 17

Concurrent Malware Example

The email worm Bagle

is a multithreaded malware: Main thread: register itself into the registry listing: to be started at the boot time Thread 2: listen on port 6777 to receive different commands; allow the attackers to upload new file, ... Thread 3: contacts a list of websites every 10 minutes: to announce the infection

  • f the current machine

Thread 4: is spawn to search on local drives to look for valid email addresses, ...then send itself to these found emails.

CARET analysis of multithreaded programs 15 / 42

slide-18
SLIDE 18

Concurrent Malware Example

The email worm Bagle

is a multithreaded malware: Main thread: register itself into the registry listing: to be started at the boot time Thread 2: listen on port 6777 to receive different commands; allow the attackers to upload new file, ... Thread 3: contacts a list of websites every 10 minutes: to announce the infection

  • f the current machine

Thread 4: is spawn to search on local drives to look for valid email addresses, ...then send itself to these found emails.

How instances of threads are spawn?

Thread 1 dynamically spawn instances of Thread 2,3,4 depending on the needs The number of instances is not fixed, depending on specific executions Instances of threads can be spawn dynamically during executions

CARET analysis of multithreaded programs 15 / 42

slide-19
SLIDE 19

Concurrent Malware Example

The email worm Bagle

is a multithreaded malware: Main thread: register itself into the registry listing: to be started at the boot time Thread 2: listen on port 6777 to receive different commands; allow the attackers to upload new file, ... Thread 3: contacts a list of websites every 10 minutes: to announce the infection

  • f the current machine

Thread 4: is spawn to search on local drives to look for valid email addresses, ...then send itself to these found emails.

How instances of threads are spawn?

Thread 1 dynamically spawn instances of Thread 2,3,4 depending on the needs The number of instances is not fixed, depending on specific executions Instances of threads can be spawn dynamically during executions

= ⇒ Bagle is a multithreaded malware, with dynamic thread creation during its execution. How to model such a concurrent malware?

CARET analysis of multithreaded programs 15 / 42

slide-20
SLIDE 20

How to model such concurrent malware?

Ideas

1 PDS is a natural model for sequential malware. 2 =

⇒ networks of PDSs can model concurrent malware.

3 =

⇒ networks of PDSs with dynamic creation can model concurrent malware with dynamic creations.

4 =

⇒ Dynamic Pushdown Networks [Bouajjani, M¨ uller-Olm and Touili 2005] match our needs.

CARET analysis of multithreaded programs 16 / 42

slide-21
SLIDE 21

How to model such concurrent malware?

Ideas

1 PDS is a natural model for sequential malware. 2 =

⇒ networks of PDSs can model concurrent malware.

3 =

⇒ networks of PDSs with dynamic creation can model concurrent malware with dynamic creations.

4 =

⇒ Dynamic Pushdown Networks [Bouajjani, M¨ uller-Olm and Touili 2005] match our needs. Dynamic Pushdown Networks (DPNs) A DPN: a networks of Dynamic PDSs a Dynamic PDS: is a PDS with the ability to spawn new instances of PDSs during its runs

CARET analysis of multithreaded programs 16 / 42

slide-22
SLIDE 22

Definition of PDSs

A Pushdown System (PDS) P is a tuple (P, Γ, ∆), where P is a finite set of control locations Γ is a finite set of stack alphabet ∆ is the set of transition rules of the following form:

(r1): pγ

call

− − → p1γ1γ2 (r2): pγ

ret

− → p1ǫ (r3): pγ

int

− → p1ω

where p, p1 ∈ P, γ, γ1, γ2 ∈ Γ, ω ∈ Γ∗

CARET analysis of multithreaded programs 17 / 42

slide-23
SLIDE 23

Definition of PDSs

A Pushdown System (PDS) P is a tuple (P, Γ, ∆), where P is a finite set of control locations Γ is a finite set of stack alphabet ∆ is the set of transition rules of the following form:

(r1): pγ

call

− − → p1γ1γ2 (r2): pγ

ret

− → p1ǫ (r3): pγ

int

− → p1ω

where p, p1 ∈ P, γ, γ1, γ2 ∈ Γ, ω ∈ Γ∗ A rule of the form pγ

call

− − → p1γ1γ2 corresponds to a call statement usually models a statement of the form γ

call proc

− − − − − → γ2 γ is the control point of the program where the function call is made, γ1 is the entry point of the called procedure and γ2 is the return point of the call.

CARET analysis of multithreaded programs 17 / 42

slide-24
SLIDE 24

Definition of PDSs

A Pushdown System (PDS) P is a tuple (P, Γ, ∆), where P is a finite set of control locations Γ is a finite set of stack alphabet ∆ is the set of transition rules of the following form:

(r1): pγ

call

− − → p1γ1γ2 (r2): pγ

ret

− → p1ǫ (r3): pγ

int

− → p1ω

where p, p1 ∈ P, γ, γ1, γ2 ∈ Γ, ω ∈ Γ∗ A rule of the form pγ

call

− − → p1γ1γ2 corresponds to a call statement usually models a statement of the form γ

call proc

− − − − − → γ2 γ is the control point of the program where the function call is made, γ1 is the entry point of the called procedure and γ2 is the return point of the call. A configuration: pω where p ∈ P is the current control location, ω ∈ Γ∗ is the current stack content.

CARET analysis of multithreaded programs 17 / 42

slide-25
SLIDE 25

Definition of DPNs

A Dynamic Pushdown Network (DPN) M is a set {P1, ..., Pn} s.t. for every 1 ≤ i ≤ n, Pi = (Pi, Γi, ∆i) is a Dynamic Pushdown System (DPDS) (NonSpawn)(r1) pγ call − − →i p1γ1γ2 (NonSpawn)(r2) pγ ret − →i p1ǫ (NonSpawn)(r3) pγ int − →i p1ω1

CARET analysis of multithreaded programs 18 / 42

slide-26
SLIDE 26

Definition of DPNs

A Dynamic Pushdown Network (DPN) M is a set {P1, ..., Pn} s.t. for every 1 ≤ i ≤ n, Pi = (Pi, Γi, ∆i) is a Dynamic Pushdown System (DPDS) where psωs ∈

1≤j≤n Pj × Γ∗ j

(NonSpawn)(r1) pγ call − − →i p1γ1γ2 (NonSpawn)(r2) pγ ret − →i p1ǫ (NonSpawn)(r3) pγ int − →i p1ω1 (Spawn) (r4) pγ call − − →i p1γ1γ2⊲ psωs (Spawn) (r5) pγ ret − →i p1ǫ⊲ psωs (Spawn) (r6) pγ int − →i p1ω1⊲ psωs

CARET analysis of multithreaded programs 18 / 42

slide-27
SLIDE 27

Model-checking for Malware Detection

CARET analysis of multithreaded programs 19 / 42

slide-28
SLIDE 28

Specification Formalisms for Malware Behaviors

Recent works: extensions of LTL, CTL were used as specifications CTPL [Kinder, Katzenbeisser,Schallhart and Veith 2005] SLTPL, SCTPL [Song and Touili 2012, 2013] However, these are not expressive enough for malicious behaviors

CARET analysis of multithreaded programs 20 / 42

slide-29
SLIDE 29

Malicious Behavior Example

Spyware Behavior search directories for personal information (emails, bank account info, ...)

CARET analysis of multithreaded programs 21 / 42

slide-30
SLIDE 30

Malicious Behavior Example

Spyware Behavior search directories for personal information (emails, bank account info, ...) To do that Firstly, call the API FindFirstFileA = ⇒ return a search handle h After that, call the API FindNextFileA with h as parameter = ⇒ search remaining matching files

CARET analysis of multithreaded programs 21 / 42

slide-31
SLIDE 31

Malicious Behavior Example

Spyware Behavior search directories for personal information (emails, bank account info, ...) To do that Firstly, call the API FindFirstFileA = ⇒ return a search handle h After that, call the API FindNextFileA with h as parameter = ⇒ search remaining matching files Then,.. Cannot be expressed by LTL or CTL since it requires that the return value of the function FindFirstFileA should be used as the input to the function FindNextFileA = ⇒ we need a formalism that can talk about matching calls and returns = ⇒ CARET.

CARET analysis of multithreaded programs 21 / 42

slide-32
SLIDE 32

CARET

linear temporal logic of Calls and Returns [Alur, Etessami and Madhusudan 2004] Interpreted over transition systems where each state is associated with a tag in the set {call, ret, int}

call : a call statement ret : a return statement int : an internal statement (neither call nor return)

CARET analysis of multithreaded programs 22 / 42

slide-33
SLIDE 33

Global Successor

Global Successor(X g): standard successor (X g(si) = si+1) Global Path: standard path like for LTL B C D s0 s1 s2 s3 s4 s5 s6 s7 s8 s9 s10 sk call call ret

CARET analysis of multithreaded programs 23 / 42

slide-34
SLIDE 34

Abstract Successor

Abstract Successor (X a)

The abstract successor of a call is its corresponding return-point

Abstract Path: apply repeatedly the abstract successor B C D s0 s1 s2 s3 s4 s5 s6 s7 s8 s9 s10 sk call call ret

CARET analysis of multithreaded programs 24 / 42

slide-35
SLIDE 35

Abstract Path

Abstract path: From s0: s0s1s2sk.... B C D s0 s1 s2 s3 s4 s5 s6 s7 s8 s9 s10 sk call call ret

CARET analysis of multithreaded programs 25 / 42

slide-36
SLIDE 36

Abstract Path

Abstract path: From s3: s3s4s5s9s10.... B C D s0 s1 s2 s3 s4 s5 s6 s7 s8 s9 s10 sk call call ret

CARET analysis of multithreaded programs 26 / 42

slide-37
SLIDE 37

Caller Successor

Caller Successors (X c)

the caller successor of a point is the caller point of the current procedure

Caller Path: apply repeatedly the caller successor B C D s0 s1 s2 s3 s4 s5 s6 s7 s8 s9 s10 sk call call ret

CARET analysis of multithreaded programs 27 / 42

slide-38
SLIDE 38

CARET successors

B C D s0 s1 s2 s3 s4 s5 s6 s7 s8 s9 s10 sk call call ret global-successor abstract-successor caller-successor

CARET analysis of multithreaded programs 28 / 42

slide-39
SLIDE 39

CARET Definition

Given a finite set of atomic propositions AP. A CARET formula over AP is defined as follows:

ψ := e | {call, ret, int} | ψ ∨ ψ | ¬ψ | X gψ | X aψ | X cψ | ψUaψ | ψUgψ | ψUcψ where e ∈ AP: atomic proposition X g: global successor X a: abstract successor X c: caller successor Ug: until operator on global path Ua: until operator on abstract path Uc: until operator on caller path

CARET analysis of multithreaded programs 29 / 42

slide-40
SLIDE 40

Malicious Behavior Example

Spyware Behavior search directories for personal information (emails, bank account info, ...) To do that Firstly, call the API FindFirstFileA = ⇒ return a search handle h After that, call the API FindNextFileA with h as parameter = ⇒ search remaining matching files

CARET analysis of multithreaded programs 30 / 42

slide-41
SLIDE 41

Malicious Behavior Example

Spyware Behavior search directories for personal information (emails, bank account info, ...) To do that Firstly, call the API FindFirstFileA = ⇒ return a search handle h After that, call the API FindNextFileA with h as parameter = ⇒ search remaining matching files Using CARET to describe ...

ψsf =

d∈D F g(call(FindFirstFileA) ∧ X a(eax = d) ∧ F a(call(FindNextFileA) ∧ dΓ∗))

CARET analysis of multithreaded programs 30 / 42

slide-42
SLIDE 42

Spyware Behavior Formula

Malicious behavior by CARET

ψsf =

  • d∈D

F g(call(FindFirstFileA) ∧ X a(eax = d) ∧ F a(call(FindNextFileA) ∧ dΓ∗))

  • d∈D: disjunction over all possible memory addresses d containing search handles

CARET analysis of multithreaded programs 31 / 42

slide-43
SLIDE 43

Spyware Behavior Formula

Malicious behavior by CARET

ψsf =

d∈D F g( call(FindFirstFileA) ∧ X a(eax = d) ∧ F a(call(FindNextFileA) ∧ dΓ∗))

  • d∈D: disjunction over all possible memory addresses d containing search handles

call(FindFirstFileA) ∧ X a(eax = d)

eax: contain the return value of an API function when the function finish its execution X a of a call is its corresponding return point

→ there is a call to FindFirstFileA and the return value is d

CARET analysis of multithreaded programs 31 / 42

slide-44
SLIDE 44

Spyware Behavior Formula

Malicious behavior by CARET

ψsf =

d∈D F g(call(FindFirstFileA) ∧ X a(eax = d) ∧ F a( call(FindNextFileA) ∧ dΓ∗ ))

  • d∈D: disjunction over all possible memory addresses d containing search handles

call(FindFirstFileA) ∧ X a(eax = d)

eax: contain the return value of an API function when the function finish its execution X a of a call is its corresponding return point

→ there is a call to FindFirstFileA and the return value is d call(FindNextFileA) ∧ dΓ∗

dΓ∗: d is on top of the stack parameters: passed to function by pushing on the stack

→ there is a call to FindNextFileA where d is used as parameter.

CARET analysis of multithreaded programs 31 / 42

slide-45
SLIDE 45

Spyware Behavior Formula

Malicious behavior by CARET

ψsf =

d∈D F g (call(FindFirstFileA) ∧ X a(eax = d) ∧ F a (call(FindNextFileA) ∧ dΓ∗))

  • d∈D: disjunction over all possible memory addresses d containing search handles

call(FindFirstFileA) ∧ X a(eax = d)

eax: contain the return value of an API function when the function finish its execution X a of a call is its corresponding return point

→ there is a call to FindFirstFileA and the return value is d call(FindNextFileA) ∧ dΓ∗

dΓ∗: d is on top of the stack parameters: passed to function by pushing on the stack

→ there is a call to FindNextFileA where d is used as parameter. F g: the standard F operator F a: in the future after call(FindFirstFileA) finishes

CARET analysis of multithreaded programs 31 / 42

slide-46
SLIDE 46

Spyware Behavior Formula

Malicious behavior by CARET

ψsf =

d∈D F g(call(FindFirstFileA) ∧ X a(eax = d) ∧ F a(call(FindNextFileA) ∧ dΓ∗))

  • d∈D: disjunction over all possible memory addresses d containing search handles

call(FindFirstFileA) ∧ X a(eax = d)

eax: contain the return value of an API function when the function finish its execution X a of a call is its corresponding return point

→ there is a call to FindFirstFileA and the return value is d call(FindNextFileA) ∧ dΓ∗

dΓ∗: d is on top of the stack parameters: passed to function by pushing on the stack

→ there is a call to FindNextFileA where d is used as parameter. F g: the standard F operator F a: in the future after call(FindFirstFileA) finishes = ⇒ ψsf : there exists a path s.t there is a call to FindFirstFileA where the return value is d, and after this call finishes, there is a call to FindNextFileA s.t d is used as parameter.

CARET analysis of multithreaded programs 31 / 42

slide-47
SLIDE 47

Model-checking for Malware Detection

CARET analysis of multithreaded programs 32 / 42

slide-48
SLIDE 48

Problem: DPNs CARET??

1 model-checking LTL properties for networks of PDSs is undecidable

[Kahlon and Gupta 2006], e.g., for properties that mix different indices of different threads like F(ai ∧ bj)

CARET analysis of multithreaded programs 33 / 42

slide-49
SLIDE 49

Problem: DPNs CARET??

1 model-checking LTL properties for networks of PDSs is undecidable

[Kahlon and Gupta 2006], e.g., for properties that mix different indices of different threads like F(ai ∧ bj)

2 LTL is a subclass of CARET CARET analysis of multithreaded programs 33 / 42

slide-50
SLIDE 50

Problem: DPNs CARET??

1 model-checking LTL properties for networks of PDSs is undecidable

[Kahlon and Gupta 2006], e.g., for properties that mix different indices of different threads like F(ai ∧ bj)

2 LTL is a subclass of CARET 3 =

⇒ model-checking CARET properties for networks of PDSs is undecidable

CARET analysis of multithreaded programs 33 / 42

slide-51
SLIDE 51

Problem: DPNs CARET??

1 model-checking LTL properties for networks of PDSs is undecidable

[Kahlon and Gupta 2006], e.g., for properties that mix different indices of different threads like F(ai ∧ bj)

2 LTL is a subclass of CARET 3 =

⇒ model-checking CARET properties for networks of PDSs is undecidable

4 =

⇒ We consider: model-checking single-indexed CARET properties for DPNs, where:

CARET analysis of multithreaded programs 33 / 42

slide-52
SLIDE 52

Problem: DPNs CARET??

1 model-checking LTL properties for networks of PDSs is undecidable

[Kahlon and Gupta 2006], e.g., for properties that mix different indices of different threads like F(ai ∧ bj)

2 LTL is a subclass of CARET 3 =

⇒ model-checking CARET properties for networks of PDSs is undecidable

4 =

⇒ We consider: model-checking single-indexed CARET properties for DPNs, where:

single-indexed properties: properties in the form f = f1 ∧ f2... ∧ fn, where fi is the CARET formula corresponding to Pi

CARET analysis of multithreaded programs 33 / 42

slide-53
SLIDE 53

Problem to solve

Given: a DPN M = {P1, P2, ..., Pn} a single-indexed CARET formula f = f1 ∧ f2... ∧ fn Model-checking problem: Does there exist an execution of M s.t. every instance of the DPDS Pi satisfies the corresponding CARET formula fi?

CARET analysis of multithreaded programs 34 / 42

slide-54
SLIDE 54

Single-indexed CARET Model Checking for DPNs

Theorem Single-indexed CARET Model Checking for DPNs is decidable. Intuition: We reduce this problem to the emptiness problem of B¨ uchi Dynamic Pushdown Networks (BDPNs) [Song and Touili 2013, 2016].

CARET analysis of multithreaded programs 35 / 42

slide-55
SLIDE 55

Single-indexed CARET Model Checking for DPNs

Theorem Single-indexed CARET Model Checking for DPNs is decidable. Intuition: We reduce this problem to the emptiness problem of B¨ uchi Dynamic Pushdown Networks (BDPNs) [Song and Touili 2013, 2016].

a BDPN BM is a set {BP1, ..., BPn} where BPi(1 ≤ i ≤ n) is a B¨ uchi Dynamic Pushdown System

CARET analysis of multithreaded programs 35 / 42

slide-56
SLIDE 56

Single-indexed CARET Model Checking for DPNs

Theorem Single-indexed CARET Model Checking for DPNs is decidable. Intuition: We reduce this problem to the emptiness problem of B¨ uchi Dynamic Pushdown Networks (BDPNs) [Song and Touili 2013, 2016].

a BDPN BM is a set {BP1, ..., BPn} where BPi(1 ≤ i ≤ n) is a B¨ uchi Dynamic Pushdown System a B¨ uchi Dynamic Pushdown System BPi = (Pi, Γi, ∆i, Fi) is a PDS with a set of accepting control locations Fi

CARET analysis of multithreaded programs 35 / 42

slide-57
SLIDE 57

Single-indexed CARET Model Checking for DPNs

Theorem Single-indexed CARET Model Checking for DPNs is decidable. Intuition: We reduce this problem to the emptiness problem of B¨ uchi Dynamic Pushdown Networks (BDPNs) [Song and Touili 2013, 2016].

a BDPN BM is a set {BP1, ..., BPn} where BPi(1 ≤ i ≤ n) is a B¨ uchi Dynamic Pushdown System a B¨ uchi Dynamic Pushdown System BPi = (Pi, Γi, ∆i, Fi) is a PDS with a set of accepting control locations Fi

We compute BDPNs BM = {BP1, ..., BPn} such that BPi is a kind

  • f product between Pi and the CARET formula fi which ensures that:

CARET analysis of multithreaded programs 35 / 42

slide-58
SLIDE 58

Single-indexed CARET Model Checking for DPNs

Theorem Single-indexed CARET Model Checking for DPNs is decidable. Intuition: We reduce this problem to the emptiness problem of B¨ uchi Dynamic Pushdown Networks (BDPNs) [Song and Touili 2013, 2016].

a BDPN BM is a set {BP1, ..., BPn} where BPi(1 ≤ i ≤ n) is a B¨ uchi Dynamic Pushdown System a B¨ uchi Dynamic Pushdown System BPi = (Pi, Γi, ∆i, Fi) is a PDS with a set of accepting control locations Fi

We compute BDPNs BM = {BP1, ..., BPn} such that BPi is a kind

  • f product between Pi and the CARET formula fi which ensures that:

The problem of checking whether an instance of Pi starting from pω satisfies fi can be reduced to the membership problem of BPi

CARET analysis of multithreaded programs 35 / 42

slide-59
SLIDE 59

BDPDS Computation - Intuition

At state si, we encode a set of formulas Ai such that for every φ ∈ Ai, φ holds at si B C D s0 s1 s2 s3 s4 s5 s6 s7 s8 s9 s10 A0 A8 Ak A2 call ret

CARET analysis of multithreaded programs 36 / 42

slide-60
SLIDE 60

BDPDS Computation-X Operators-Call statements

call Φ0 ret p0ω0 piωi pi+1ωi+1 pk−1ωk−1 pkωk

CARET analysis of multithreaded programs 37 / 42

slide-61
SLIDE 61

BDPDS Computation-X Operators-Call statements

call Φ0 ret p0ω0 piωi pi+1ωi+1 pk−1ωk−1 pkωk

for piγ

call

− − → pi+1γ′γ′′ in Pi:

CARET analysis of multithreaded programs 37 / 42

slide-62
SLIDE 62

BDPDS Computation-X Operators-Call statements

call Φ0 ret p0ω0 piωi pi+1ωi+1 pk−1ωk−1 pkωk

for piγ

call

− − → pi+1γ′γ′′ in Pi: pi, {X gφ}γ − → pi+1, {φ}γγ′′ in BPi

CARET analysis of multithreaded programs 37 / 42

slide-63
SLIDE 63

BDPDS Computation-X Operators-Call statements

call Φ0 X gφ φ ret p0ω0 piωi pi+1ωi+1 pk−1ωk−1 pkωk

piωi X gφ iff pi+1ωi+1 φ for piγ

call

− − → pi+1γ′γ′′ in Pi: pi, {X gφ}γ − → pi+1, {φ}γγ′′ in BPi

CARET analysis of multithreaded programs 37 / 42

slide-64
SLIDE 64

BDPDS Computation-X Operators-Call statements

call Φ0 φ X aφ ret p0ω0 piωi pi+1ωi+1 pk−1ωk−1 pkωk

piωi X aφ iff pkωk φ for piγ

call

− − → pi+1γ′γ′′ in Pi: pi, {X gφ}γ − → pi+1, {φ}γγ′′ in BPi

CARET analysis of multithreaded programs 37 / 42

slide-65
SLIDE 65

BDPDS Computation-X Operators-Call statements

call Φ0 φ X aφ ret p0ω0 piωi pi+1ωi+1 pk−1ωk−1 pkωk

piωi X aφ iff pkωk φ for piγ

call

− − → pi+1γ′γ′′ in Pi: pi, {X gφ}γ − → pi+1, {φ}γγ′′ in BPi pi, {X aφ}γ − → pi+1γ′ γ′′, {φ} in BPi

CARET analysis of multithreaded programs 37 / 42

slide-66
SLIDE 66

BDPDS Computation-X Operators-Call statements

call Φ0 φ X aφ γ′′, {φ} ret p0ω0 piωi pi+1ωi+1 pk−1ωk−1 pkωk

piωi X aφ iff pkωk φ for piγ

call

− − → pi+1γ′γ′′ in Pi: pi, {X gφ}γ − → pi+1, {φ}γγ′′ in BPi pi, {X aφ}γ − → pi+1γ′ γ′′, {φ} in BPi

CARET analysis of multithreaded programs 37 / 42

slide-67
SLIDE 67

BDPDS Computation-X Operators-Call statements

call Φ0 φ X aφ γ′′, {φ} ret p0ω0 piωi pi+1ωi+1 pk−1ωk−1 pkωk

piωi X aφ iff pkωk φ for piγ

call

− − → pi+1γ′γ′′ in Pi: pi, {X gφ}γ − → pi+1, {φ}γγ′′ in BPi pi, {X aφ}γ − → pi+1γ′ γ′′, {φ} in BPi for pk−1β

ret

− → pkǫ in Pi

CARET analysis of multithreaded programs 37 / 42

slide-68
SLIDE 68

BDPDS Computation-X Operators-Call statements

call Φ0 φ X aφ γ′′, {φ} ret p0ω0 piωi pi+1ωi+1 pk−1ωk−1 pkωk

piωi X aφ iff pkωk φ for piγ

call

− − → pi+1γ′γ′′ in Pi: pi, {X gφ}γ − → pi+1, {φ}γγ′′ in BPi pi, {X aφ}γ − → pi+1γ′ γ′′, {φ} in BPi for pk−1β

ret

− → pkǫ in Pi: pk γ′′, {φ} − → pk, {φ} γ′′

CARET analysis of multithreaded programs 37 / 42

slide-69
SLIDE 69

BDPDS Computation-X Operators- Int statements

call

for piγ

int

− → pi+1ω in Pi:

CARET analysis of multithreaded programs 38 / 42

slide-70
SLIDE 70

BDPDS Computation-X Operators- Int statements

call

for piγ

int

− → pi+1ω in Pi: pi, {X gφ}γ − → pi+1, {φ}ω in BPi

CARET analysis of multithreaded programs 38 / 42

slide-71
SLIDE 71

BDPDS Computation-X Operators- Int statements

call

piωi pi+1ωi+1

X gφ φ

piωi X gφ iff pi+1ωi+1 φ for piγ

int

− → pi+1ω in Pi: pi, {X gφ}γ − → pi+1, {φ}ω in BPi

CARET analysis of multithreaded programs 38 / 42

slide-72
SLIDE 72

BDPDS Computation-X Operators- Int statements

call

for piγ

int

− → pi+1ω in Pi: pi, {X gφ}γ − → pi+1, {φ}ω in BPi pi, {X aφ}γ − → pi+1, {φ}ω in BPi

CARET analysis of multithreaded programs 38 / 42

slide-73
SLIDE 73

BDPDS Computation-X Operators- Int statements

call

φ X aφ

piωi X aφ iff pi+1ωi+1 φ for piγ

int

− → pi+1ω in Pi: pi, {X gφ}γ − → pi+1, {φ}ω in BPi pi, {X aφ}γ − → pi+1, {φ}ω in BPi

CARET analysis of multithreaded programs 38 / 42

slide-74
SLIDE 74

BDPDS Computation-X Operators- Int statements

call

for piγ

int

− → pi+1ω in Pi: pi, {X gφ}γ − → pi+1, {φ}ω in BPi pi, {X aφ}γ − → pi+1, {φ}ω in BPi for piγ

int

− → pi+1ω⊲ psωs in Pi (psωs ∈ Pj ):

CARET analysis of multithreaded programs 38 / 42

slide-75
SLIDE 75

BDPDS Computation-X Operators- Int statements

call

for piγ

int

− → pi+1ω in Pi: pi, {X gφ}γ − → pi+1, {φ}ω in BPi pi, {X aφ}γ − → pi+1, {φ}ω in BPi for piγ

int

− → pi+1ω⊲ psωs in Pi (psωs ∈ Pj ): pi, {X gφ}γ − → pi+1, {φ}ω⊲ ps, fjωs in BPi pi, {X aφ}γ − → pi+1, {φ}ω⊲ ps, fjωs in BPi

CARET analysis of multithreaded programs 38 / 42

slide-76
SLIDE 76

Theorem

Theorem Given a DPN M = {P1, ..., Pn}, a single-indexed CARET formula f = f1 ∧ f2... ∧ fn, we can compute a BDPN BM = {BP1, ..., BPn} such that M f iff BM has an accepting run.

CARET analysis of multithreaded programs 39 / 42

slide-77
SLIDE 77

DPNs communicating via Locks (L-DPNs)

L-DPNs a L-DPN is a DPN where pushdown processes communicate via locks.

CARET analysis of multithreaded programs 40 / 42

slide-78
SLIDE 78

DPNs communicating via Locks (L-DPNs)

L-DPNs a L-DPN is a DPN where pushdown processes communicate via locks. Nested Lock Access a L-DPNs with Nested Lock Access: is a L-DPN s.t. in all executions, the locks are accessed in a well-nested manner, i.e, an execution can only release the latest lock it acquired that is not released yet.

CARET analysis of multithreaded programs 40 / 42

slide-79
SLIDE 79

DPNs communicating via Locks (L-DPNs)

L-DPNs a L-DPN is a DPN where pushdown processes communicate via locks. Nested Lock Access a L-DPNs with Nested Lock Access: is a L-DPN s.t. in all executions, the locks are accessed in a well-nested manner, i.e, an execution can only release the latest lock it acquired that is not released yet. Theorem Single-indexed CARET model-checking for L-DPNs with nested Lock access can be reduced to single-indexed CARET model-checking for DPNs

CARET analysis of multithreaded programs 40 / 42

slide-80
SLIDE 80

Q & A

Thank you for your listening!

CARET analysis of multithreaded programs 41 / 42