Resource-aware Program Analysis via Online Abstraction Coarsening - - PowerPoint PPT Presentation

Resource-aware Program Analysis via Online Abstraction Coarsening

Kihong Heo Hakjoo Oh Hongseok Yang

ICSE 2019

• 1

Motivation

2

Size (LOC)

0M 5M 10M 15M 20M 25M 30M

Linux Kernel Version

1.0 2.0 2.6.16
 (1st LTS) 2.6.34
 (5th LTS) 3.10
 (10th LTS) 4.1
 (15th LTS) 4.19
 (19th LTS) X *https://www.linuxcounter.net

• Deep semantic analysis for large software

Motivation

2

Size (LOC)

0M 5M 10M 15M 20M 25M 30M

Linux Kernel Version

1.0 2.0 2.6.16
 (1st LTS) 2.6.34
 (5th LTS) 3.10
 (10th LTS) 4.1
 (15th LTS) 4.19
 (19th LTS) X *https://www.linuxcounter.net

• Deep semantic analysis for large software

Motivation

2

Size (LOC)

0M 5M 10M 15M 20M 25M 30M

Linux Kernel Version

1.0 2.0 2.6.16
 (1st LTS) 2.6.34
 (5th LTS) 3.10
 (10th LTS) 4.1
 (15th LTS) 4.19
 (19th LTS) X *https://www.linuxcounter.net

• Deep semantic analysis for large software

!

Goal

3

Goal

• Achieving maximum precision within a given resource budget
• e.g., within 128GB of memory

3

Goal

4

X-sensitivity (knob)

• Achieving maximum precision within a given resource budget
• e.g., within 128GB of memory

Goal

4

X-sensitivity (knob) Low Precision Low Utilization

• Achieving maximum precision within a given resource budget
• e.g., within 128GB of memory

Goal

4

X-sensitivity (knob) Out of Resource

• Achieving maximum precision within a given resource budget
• e.g., within 128GB of memory

Goal

4

X-sensitivity (knob)

• Max. Precision
• Max. Utilization
• Achieving maximum precision within a given resource budget
• e.g., within 128GB of memory

Challenges

• Hard to predict the behavior of analyzer in advance
• e.g., partially flow-sensitive interval analysis

5

Challenges

• Hard to predict the behavior of analyzer in advance
• e.g., partially flow-sensitive interval analysis

5

Sensitivity: 0% emacs-26.0.91 (503KLOC) Memory: 18GB

Challenges

• Hard to predict the behavior of analyzer in advance
• e.g., partially flow-sensitive interval analysis

5

Sensitivity: 0% emacs-26.0.91 (503KLOC) Memory: 18GB Sensitivity: 5% emacs-26.0.91 (503KLOC)

<

Challenges

• Hard to predict the behavior of analyzer in advance
• e.g., partially flow-sensitive interval analysis

5

Sensitivity: 0% emacs-26.0.91 (503KLOC) Memory: 18GB Sensitivity: 5% emacs-26.0.91 (503KLOC) Memory: > 128GB

< <<

Challenges

• Hard to predict the behavior of analyzer in advance
• e.g., partially flow-sensitive interval analysis

5

Sensitivity: 0% emacs-26.0.91 (503KLOC) Memory: 18GB Sensitivity: 5% emacs-26.0.91 (503KLOC) Memory: > 128GB Sensitivity: 0% vim60 (227KLOC)

< < <<

Challenges

• Hard to predict the behavior of analyzer in advance
• e.g., partially flow-sensitive interval analysis

5

Sensitivity: 0% emacs-26.0.91 (503KLOC) Memory: 18GB Sensitivity: 5% emacs-26.0.91 (503KLOC) Memory: > 128GB Sensitivity: 0% vim60 (227KLOC) Memory: 51GB

< < > <<

Our Approach

• Online abstraction coarsening by a learned controller

6

Analysis Progress Resource Usage Precision Budget

Our Approach

• Online abstraction coarsening by a learned controller

6

Analysis Progress Resource Usage Precision Budget

Low-sensitivity

Our Approach

• Online abstraction coarsening by a learned controller

6

Analysis Progress Resource Usage Precision Budget

Low-sensitivity High-sensitivity

Our Approach

• Online abstraction coarsening by a learned controller

6

Analysis Progress Resource Usage Precision Budget

Low-sensitivity High-sensitivity Our approach

Our Approach

• Online abstraction coarsening by a learned controller

7

Analysis Progress Resource Usage Precision Budget

Low-sensitivity High-sensitivity Our approach

Offline Approach

(10% flow-sensitivity)

Online Approach

Our Approach

• Online abstraction coarsening by a learned controller

7

Analysis Progress Resource Usage Precision Budget

Low-sensitivity High-sensitivity Our approach

Offline Approach

(10% flow-sensitivity)

Online Approach

• 3/8 run out of memory (128GB)
• 27% of buffer overrun alarms
• 30% of null dereference alarms

Our Approach

• Online abstraction coarsening by a learned controller

7

Analysis Progress Resource Usage Precision Budget

Low-sensitivity High-sensitivity Our approach

Offline Approach

(10% flow-sensitivity)

Online Approach

• 3/8 run out of memory (128GB)
• 27% of buffer overrun alarms
• 30% of null dereference alarms
• 0/8 run out of memory (64 / 128GB)
• 28—32% of buffer overrun alarms
• 33—41% of null dereference alarms

Outline

• Motivation
• Learning Framework
• Experimental Results
• Conclusion

8

Example

9

• Partially flow-sensitive interval analysis (budget: 10 intervals)

1: x = 0; y = 0; z = 1; v = input(); w = input(); 2: x = z; 3: z = z + 1; 4: y = x; 5: assert(y > 0); // Query 1 (hold) 6: assert(z > 0); // Query 2 (hold) 7: assert(v == w); // Query 3 (may fail)

Example

10

1: x = 0; y = 0; z = 1; v = input(); w = input(); 2: x = z; 3: z = z + 1; 4: y = x; 5: assert(y > 0); // Query 1 (hold) 6: assert(z > 0); // Query 2 (hold) 7: assert(v == w); // Query 3 (may fail)

• Partially flow-sensitive interval analysis (budget: 10 intervals)

Line Flow-Sensitive Abstract State 1 {x = [0,0], y = [0,0], z = [1,1], v = ⊤, w = ⊤} 2 {x = [1,1], y = [0,0], z = [1,1], v = ⊤, w = ⊤} 3 {x = [1,1], y = [0,0], z = [2,2], v = ⊤, w = ⊤} 4 {x = [1,1], y = [1,1], z = [2,2], v = ⊤, w = ⊤}

12 Intervals 3 Intervals

Example

11

1: x = 0; y = 0; z = 1; v = input(); w = input(); 2: x = z; 3: z = z + 1; 4: y = x; 5: assert(y > 0); // Query 1 (hold) 6: assert(z > 0); // Query 2 (hold) 7: assert(v == w); // Query 3 (may fail)

• Partially flow-sensitive interval analysis (budget: 10 intervals)

Line Flow-Sensitive Abstract State 1 {x = [0,0], y = [0,0], z = [1,1], v = ⊤, w = ⊤} 2 {x = [1,1], y = [0,0], z = [1,1], v = ⊤, w = ⊤} 3 {x = [1,1], y = [0,0], z = [2,2], v = ⊤, w = ⊤} 4 {x = [1,1], y = [1,1], z = [2,2], v = ⊤, w = ⊤}

6 Intervals

Example

12

1: x = 0; y = 0; z = 1; v = input(); w = input(); 2: x = z; 3: z = z + 1; 4: y = x; 5: assert(y > 0); // Query 1 (hold) 6: assert(z > 0); // Query 2 (hold) 7: assert(v == w); // Query 3 (may fail)

• Partially flow-sensitive interval analysis (budget: 10 intervals)

Line Flow-Sensitive Abstract State 1 {x = [0,0], y = [0,0], z = [1,1], v = ⊤, w = ⊤} 2 {x = [1,1], y = [0,0], z = [1,1], v = ⊤, w = ⊤} 3 {x = [1,1], y = [0,0], z = [2,2], v = ⊤, w = ⊤} 4 {x = [1,1], y = [1,1], z = [2,2], v = ⊤, w = ⊤}

12 Intervals

Example

13

• Partially flow-sensitive interval analysis (budget: 10 intervals)

Line Flow-Insensitive Abstract State * {x = [0,+∞], y = [0,+∞], z = [1,+∞], v = ⊤, w = ⊤}

3 Intervals

1: x = 0; y = 0; z = 1; v = input(); w = input(); 2: x = z; 3: z = z + 1; 4: y = x; 5: assert(y > 0); // Query 1 (hold) 6: assert(z > 0); // Query 2 (hold) 7: assert(v == w); // Query 3 (may fail)

Online Abstraction Coarsening

14

Online Abstraction Coarsening

14

Input Result Analyzer

Online Abstraction Coarsening

14

Input

Transfer Function

Result M0 Analyzer

Online Abstraction Coarsening

14

Input

Transfer Function Fixpoint?

Result M0 Mi Analyzer

Online Abstraction Coarsening

14

Input

Transfer Function

Y

Fixpoint?

Result M0 Mi Analyzer

Online Abstraction Coarsening

14

Model Input

Transfer Function

Y N

Fixpoint? Controller

Result M0 Mi Mi Analyzer

Online Abstraction Coarsening

14

Model Input

Transfer Function

Y N

Fixpoint? Controller

Result M0 Mi Mi+1 Mi Analyzer

Model

15

Model

• Model M : Variable → [0, 1]
• Importance of each variable in terms of flow-sensitivity
• Pre-trained by an off-the-shelf method*

15

*Learning a Strategy for Adapting a Program Analysis via Bayesian Optimisation, OOPSLA’15

Model

• Model M : Variable → [0, 1]
• Importance of each variable in terms of flow-sensitivity
• Pre-trained by an off-the-shelf method*

15

1: x = 0; y = 0; z = 1; v = input(); w = input(); 2: x = z; 3: z = z + 1; 4: y = x; 5: assert(y > 0); // Query 1 (hold) 6: assert(z > 0); // Query 2 (hold) 7: assert(v == w); // Query 3 (may fail)

*Learning a Strategy for Adapting a Program Analysis via Bayesian Optimisation, OOPSLA’15

Model

• Model M : Variable → [0, 1]
• Importance of each variable in terms of flow-sensitivity
• Pre-trained by an off-the-shelf method*

15

1: x = 0; y = 0; z = 1; v = input(); w = input(); 2: x = z; 3: z = z + 1; 4: y = x; 5: assert(y > 0); // Query 1 (hold) 6: assert(z > 0); // Query 2 (hold) 7: assert(v == w); // Query 3 (may fail)

> M(w)

*Learning a Strategy for Adapting a Program Analysis via Bayesian Optimisation, OOPSLA’15

Model

• Model M : Variable → [0, 1]
• Importance of each variable in terms of flow-sensitivity
• Pre-trained by an off-the-shelf method*

15

1: x = 0; y = 0; z = 1; v = input(); w = input(); 2: x = z; 3: z = z + 1; 4: y = x; 5: assert(y > 0); // Query 1 (hold) 6: assert(z > 0); // Query 2 (hold) 7: assert(v == w); // Query 3 (may fail)

M(x) > > M(w)

*Learning a Strategy for Adapting a Program Analysis via Bayesian Optimisation, OOPSLA’15

Model

• Model M : Variable → [0, 1]
• Importance of each variable in terms of flow-sensitivity
• Pre-trained by an off-the-shelf method*

15

1: x = 0; y = 0; z = 1; v = input(); w = input(); 2: x = z; 3: z = z + 1; 4: y = x; 5: assert(y > 0); // Query 1 (hold) 6: assert(z > 0); // Query 2 (hold) 7: assert(v == w); // Query 3 (may fail)

M(x) > > M(w) M(y) > M(z) > M(v)

*Learning a Strategy for Adapting a Program Analysis via Bayesian Optimisation, OOPSLA’15

Controller

16

Controller

• Controller 𝛒 : F → Pr(A) where A = {0, …, 100}

16

Controller

• Controller 𝛒 : F → Pr(A) where A = {0, …, 100}

16

• Input: a feature vector describing current status
• e.g., memory usage, analysis progress, etc

Controller

• Controller 𝛒 : F → Pr(A) where A = {0, …, 100}

16

• Input: a feature vector describing current status
• e.g., memory usage, analysis progress, etc
• Output: probability distribution on % of variables 


that should be treated flow-insensitively

Controller

17

• Partially flow-sensitive interval analysis (budget: 10 intervals)

1: x = 0; y = 0; z = 1; v = input(); w = input(); 2: x = z; 3: z = z + 1; 4: y = x; 5: assert(y > 0); // Query 1 (hold) 6: assert(z > 0); // Query 2 (hold) 7: assert(v == w); // Query 3 (may fail)

Model: M(x) > M(y) > M(z) > M(v) > M(w)

Controller

18

• Partially flow-sensitive interval analysis (budget: 10 intervals)

1: x = 0; y = 0; z = 1; v = input(); w = input(); 2: x = z; 3: z = z + 1; 4: y = x; 5: assert(y > 0); // Query 1 (hold) 6: assert(z > 0); // Query 2 (hold) 7: assert(v == w); // Query 3 (may fail)

6 Intervals

Model: M(x) > M(y) > M(z) > M(v) > M(w)

Line Flow-Sensitive Abstract State 1 {x = [0,0], y = [0,0], z = [1,1], v = ⊤, w = ⊤} 2 {x = [1,1], y = [0,0], z = [1,1], v = ⊤, w = ⊤}

Controller

19

Line Flow-Sensitive Flow-Insensitive 1 {x = [0,0], y = [0,0], z = [1,1], v = ⊤} {w = ⊤} 2 {x = [1,1], y = [0,0], z = [1,1], v = ⊤}

• Partially flow-sensitive interval analysis (budget: 10 intervals)

1: x = 0; y = 0; z = 1; v = input(); w = input(); 2: x = z; 3: z = z + 1; 4: y = x; 5: assert(y > 0); // Query 1 (hold) 6: assert(z > 0); // Query 2 (hold) 7: assert(v == w); // Query 3 (may fail)

6 Intervals

Model: M(x) > M(y) > M(z) > M(v) > M(w)

Controller

20

• Partially flow-sensitive interval analysis (budget: 10 intervals)

1: x = 0; y = 0; z = 1; v = input(); w = input(); 2: x = z; 3: z = z + 1; 4: y = x; 5: assert(y > 0); // Query 1 (hold) 6: assert(z > 0); // Query 2 (hold) 7: assert(v == w); // Query 3 (may fail)

9 Intervals

Model: M(x) > M(y) > M(z) > M(v) > M(w)

Line Flow-Sensitive Flow-Insensitive 1 {x = [0,0], y = [0,0], z = [1,1], v = ⊤} {w = ⊤} 2 {x = [1,1], y = [0,0], z = [1,1], v = ⊤} 3 {x = [1,1], y = [0,0], z = [2,2], v = ⊤}

Controller

21

Line Flow-Sensitive Flow-Insensitive 1 {x = [0,0], y = [0,0]} {z = [1,+∞], v = ⊤, w = ⊤} 2 {x = [1,+∞], y = [0,0]} 3 {x = [1,+∞], y = [0,0]}

• Partially flow-sensitive interval analysis (budget: 10 intervals)

1: x = 0; y = 0; z = 1; v = input(); w = input(); 2: x = z; 3: z = z + 1; 4: y = x; 5: assert(y > 0); // Query 1 (hold) 6: assert(z > 0); // Query 2 (hold) 7: assert(v == w); // Query 3 (may fail)

6 Intervals

Model: M(x) > M(y) > M(z) > M(v) > M(w)

Controller

22

Line Flow-Sensitive Flow-Insensitive 1 {x = [0,0], y = [0,0]} {z = [1,+∞], v = ⊤, w = ⊤} 2 {x = [1,+∞], y = [0,0]} 3 {x = [1,+∞], y = [0,0]} 4 {x = [1,+∞], y = [1,+∞]}

• Partially flow-sensitive interval analysis (budget: 10 intervals)

1: x = 0; y = 0; z = 1; v = input(); w = input(); 2: x = z; 3: z = z + 1; 4: y = x; 5: assert(y > 0); // Query 1 (hold) 6: assert(z > 0); // Query 2 (hold) 7: assert(v == w); // Query 3 (may fail)

8 Intervals

Model: M(x) > M(y) > M(z) > M(v) > M(w)

Learning Controller

• Controller 𝛒 : F → Pr(A) where A = {0, …, 100}

23

• Input: a feature vector describing the current status
• Output: probability distribution on % of variables 


that should be treated flow-insensitively

Learning Controller

• Controller 𝛒 : F → Pr(A) where A = {0, …, 100}

23

• Value function Q : F × A → [0, 1]
• Score to every pair of feature vector and action
• Input: a feature vector describing the current status
• Output: probability distribution on % of variables 


that should be treated flow-insensitively

Learning Controller

• Controller 𝛒 : F → Pr(A) where A = {0, …, 100}

23

• Value function Q : F × A → [0, 1]
• Score to every pair of feature vector and action

Q( f, a) ∑a′∈A Q( f, a′)

• 𝛒Q(f)(a) =
• Input: a feature vector describing the current status
• Output: probability distribution on % of variables 


that should be treated flow-insensitively

Value Function

24

Q : F × A → [0, 1]

Value Function

• Feature abstraction function 𝜷 : State → F where F = [0, 1]4
• 1. The inverse of memory budget
• 2. Current memory consumption divided by the total budget
• 3. Current lattice position divided by the lattice height
• 4. Current workset size divided by the total workset size

24

Q : F × A → [0, 1]

Value Function

• Feature abstraction function 𝜷 : State → F where F = [0, 1]4
• 1. The inverse of memory budget
• 2. Current memory consumption divided by the total budget
• 3. Current lattice position divided by the lattice height
• 4. Current workset size divided by the total workset size

24

• Reward : [0, 1]
• relative #alarms w.r.t. flow-sensitive and insensitive result
• 0 if #alarms == #flow-insensitive alarms
• 1 if #alarms == #flow-sensitive alarms

Q : F × A → [0, 1]

Learning Algorithm

25

Learning Algorithm

25

• SARSA-style algorithm from reinforcement learning
• from a training set (i.e., batch mode)
• with common heuristics (discounted reward, e-greedy search)

Learning Algorithm

25

• SARSA-style algorithm from reinforcement learning
• from a training set (i.e., batch mode)
• with common heuristics (discounted reward, e-greedy search)
• 1. Initialize 𝛒 with a random policy

Learning Algorithm

26

• SARSA-style algorithm from reinforcement learning
• from a training set (i.e., batch mode)
• with common heuristics (discounted reward, e-greedy search)
• 2. Run the analysis with 𝛒

Learning Algorithm

26

s0 s1 s2 s3

R = 0.7 a0 a1 a2

• SARSA-style algorithm from reinforcement learning
• from a training set (i.e., batch mode)
• with common heuristics (discounted reward, e-greedy search)
• 2. Run the analysis with 𝛒

Learning Algorithm

27

s0 s1 s2 s3

R = 0.7 a0 a1 a2

• SARSA-style algorithm from reinforcement learning
• from a training set (i.e., batch mode)
• with common heuristics (discounted reward, e-greedy search)
• 3. Collect all state-action pairs and the reward

D1 = {(<𝜷(s0), a0>, 0.7), (<𝜷(s1), a1>, 0.7), (<𝜷(s2), a2>, 0.7)}

*For brevity heuristics are omitted

Learning Algorithm

28

s0 s1 s2 s3

R = 0.7 a0 a1 a2

• SARSA-style algorithm from reinforcement learning
• from a training set (i.e., batch mode)
• with common heuristics (discounted reward, e-greedy search)
• 4. Learn Q using D1 with a supervised learning algorithm

Q = SupervisedLearning(D1)

Learning Algorithm

29

s0 s1 s2 s3

R = 0.7 a0 a1 a2

• SARSA-style algorithm from reinforcement learning
• from a training set (i.e., batch mode)
• with common heuristics (discounted reward, e-greedy search)
• 5. Refine 𝛒 using Q

Q( f, a) ∑a′∈A Q( f, a′)

𝛒Q(f)(a) =

Learning Algorithm

30

s0 s1 s2 s3

R = 0.7 a0 a1 a2

• SARSA-style algorithm from reinforcement learning
• from a training set (i.e., batch mode)
• with common heuristics (discounted reward, e-greedy search)
• 6. Run the analysis with refined 𝛒

Learning Algorithm

30

s0 s1 s2 s3

R = 0.7 a0 a1 a2

• SARSA-style algorithm from reinforcement learning
• from a training set (i.e., batch mode)
• with common heuristics (discounted reward, e-greedy search)
• 6. Run the analysis with refined 𝛒

s4

R = 1.0 a3

Learning Algorithm

31

D2 = D1 ∪ {(<𝜷(s0), a0>, 1.0), (<𝜷(s4), a4>, 1.0)} s0 s1 s2 s3

R = 0.7

s4

R = 1.0 a0 a1 a2 a3

• SARSA-style algorithm from reinforcement learning
• from a training set (i.e., batch mode)
• with common heuristics (discounted reward, e-greedy search)
• 7. Accumulate data

Learning Algorithm

32

s0 s1 s2 s3

R = 0.7

s4

R = 1.0 a0 a1 a2 a3

• SARSA-style algorithm from reinforcement learning
• from a training set (i.e., batch mode)
• with common heuristics (discounted reward, e-greedy search)
• 8. Refine Q using D2 with a supervised learning algorithm

Q = SupervisedLearning(D2)

Learning Algorithm

33

s0 s1 s2 s3

R = 0.7

s4

R = 1.0 a0 a1 a2 a3

• SARSA-style algorithm from reinforcement learning
• from a training set (i.e., batch mode)
• with common heuristics (discounted reward, e-greedy search)

…

Outline

• Motivation
• Learning Framework
• Experimental Results
• Conclusion

34

Experimental Setup

35

Experimental Setup

• Training with 10 small programs (15—80KLOC)
• with small memory limits

35

Experimental Setup

• Training with 10 small programs (15—80KLOC)
• with small memory limits

35

• Test with 8 large programs (129—503KLOC)
• 64 / 128 GB memory limits

Experimental Setup

• Training with 10 small programs (15—80KLOC)
• with small memory limits

35

• Test with 8 large programs (129—503KLOC)
• 64 / 128 GB memory limits
• Measure buffer-overrun and null-dereference alarms

Experimental Setup

• Training with 10 small programs (15—80KLOC)
• with small memory limits

35

• Test with 8 large programs (129—503KLOC)
• 64 / 128 GB memory limits
• Measure buffer-overrun and null-dereference alarms
• Trigger controller when the OCaml runtime allocates new

memory chunks

Experimental Setup

• Training with 10 small programs (15—80KLOC)
• with small memory limits

35

• Test with 8 large programs (129—503KLOC)
• 64 / 128 GB memory limits
• Measure buffer-overrun and null-dereference alarms
• Trigger controller when the OCaml runtime allocates new

memory chunks

• Compared to partially flow-sensitive analysis
• 10% of variables chosen offline with 128GB of memory

Memory Utilization

36

25 50 75 100 sendmail redis nethack git vim python R emacs

Offline Online (64GB) Online (128GB)

OOM OOM OOM

Memory Utilization

36

25 50 75 100 sendmail redis nethack git vim python R emacs

Offline Online (64GB) Online (128GB)

21% on average (out of memory for 3 programs)

OOM OOM OOM

Memory Utilization

37

25 50 75 100 sendmail redis nethack git vim python R emacs

Offline Online (64GB) Online (128GB)

79% on average

OOM OOM OOM

Memory Utilization

38

25 50 75 100 sendmail redis nethack git vim python R emacs

Offline Online (64GB) Online (128GB)

61% on average

OOM OOM OOM

Analysis Precision

39

25 50 75 100 sendmail redis nethack git vim python R emacs

Flow-insensitive Offline Online (64GB) Online (128GB)

Buffer Overrun Alarms

OOM OOM OOM

Analysis Precision

40

25 50 75 100 sendmail redis nethack git vim python R emacs

Flow-insensitive Offline Online (64GB) Online (128GB)

Buffer Overrun Alarms

OOM OOM OOM

Analysis Precision

40

25 50 75 100 sendmail redis nethack git vim python R emacs

Flow-insensitive Offline Online (64GB) Online (128GB)

Buffer Overrun Alarms

OOM OOM OOM

Reduced 27% of alarms (out of memory for 3 programs)

Analysis Precision

41

25 50 75 100 sendmail redis nethack git vim python R emacs

Flow-insensitive Offline Online (64GB) Online (128GB)

Buffer Overrun Alarms

OOM OOM OOM

28% on average

Analysis Precision

42

25 50 75 100 sendmail redis nethack git vim python R emacs

Flow-insensitive Offline Online (64GB) Online (128GB)

Buffer Overrun Alarms

OOM OOM OOM

32% on average

Analysis Precision

43

25 50 75 100 sendmail redis nethack git vim python R emacs

Flow-insensitive Offline Online (64GB) Online (128GB)

OOM OOM OOM

Null Dereference Alarms

Analysis Precision

43

25 50 75 100 sendmail redis nethack git vim python R emacs

Flow-insensitive Offline Online (64GB) Online (128GB)

OOM OOM OOM

Null Dereference Alarms

Reduced 30% of alarms (out of memory for 3 programs)

Analysis Precision

44

25 50 75 100 sendmail redis nethack git vim python R emacs

Flow-insensitive Offline Online (64GB) Online (128GB)

OOM OOM OOM

Null Dereference Alarms

33% on average

Analysis Precision

45

25 50 75 100 sendmail redis nethack git vim python R emacs

Flow-insensitive Offline Online (64GB) Online (128GB)

OOM OOM OOM

Null Dereference Alarms

41% on average

Conclusion

46

Conclusion

• A systematic framework for resource-aware program analysis
• online abstraction coarsening
• reinforcement learning algorithm for learning controller
• attention to physical resource as well as logical behavior

46

Conclusion

• A systematic framework for resource-aware program analysis
• online abstraction coarsening
• reinforcement learning algorithm for learning controller
• attention to physical resource as well as logical behavior
• Max. Precision
• Max. Utilization

46