Specification In Inference Usin ing Context-Free Language - PowerPoint PPT Presentation

Framework Specifications 1. Double lat = getLatitude(); 2. List list = new List(); 3. list.add(lat); Android Framework 4. Double latAlias = list.get(0); 5. String latStr = latAlias.toString(); Specification 6. sendSMS(latStr); getLatitude() 1. class List: 2. @Alias(arg, this.val) sendSMS (…) 3. void add(Object arg) {} add(…) get(…) toString() 4. @Alias(this.val, return) 5. Object get(Integer index) {} 6. class Double: 7. @Flow(this, return) 8. String toString() {} 9. class LocationManager: 10. @Flow(LOC, return) 11. static String getLatitude() {} Android App 12. c lass SMS: 13. @Flow(text, SMS) 14. static void sendSMS(String text) {}

Framework Specifications • Specification: over-approximates behavior of framework methods • Provided by the user • More precise than automated approaches

Framework Specifications • Alias Specifications: describes aliasing • @Alias(x, y) means “x aliases y” • class List: @Alias(arg, this.val) void add(Object arg) {} @Alias(this.val, return) Object get(Integer index) {}

Framework Specifications • Flow Specifications: describe information flows • @Flow(x, y) means “x tainted ⇒ y tainted” • class Double: @Flow(this, return) String toString() {}

Framework Specifications 1. Double lat = getLatitude(); 2. List list = new List(); 3. list.add(lat); Android Framework 4. Double latAlias = list.get(0); 5. String latStr = latAlias.toString(); Specification 6. sendSMS(latStr); getLatitude() 1. class List: 2. @Alias(arg, this.val) sendSMS (…) 3. void add(Object arg) {} add(…) get(…) toString() 4. @Alias(this.val, return) 5. Object get(Integer index) {} 6. class Double: 7. @Flow(this, return) 8. String toString() {} 9. class LocationManager: 10. @Flow(LOC, return) 11. static String getLatitude() {} Android App 12. c lass SMS: 13. @Flow(text, SMS) 14. static void sendSMS(String text) {}

Missing Specifications • Specifications typically written as needed • ≈ 4,000 framework classes • A given app may use hundreds of classes • For a given app, only a few classes are relevant for finding information flows • Our experience: specifications for ≈ 175 classes over course of a year

Missing Specifications 1. Double lat = getLatitude(); 2. List list = new List(); 3. list.add(lat); Android Framework 4. Double latAlias = list.get(0); 5. String latStr = latAlias.toString(); Specification 6. sendSMS(latStr); getLatitude() 1. class List: 2. @Alias(arg, this.val) sendSMS (…) 3. void add(Object arg) {} add(…) get(…) toString() 4. @Alias(this.val, return) 5. Object get(Integer index) {} 6. class Double: 7. @Flow(this, return) 8. String toString() {} 9. class LocationManager: 10. @Flow(LOC, return) 11. static String getLatitude() {} Android App 12. c lass SMS: 13. @Flow(text, SMS) 14. static void sendSMS(String text) {}

Step 1: Worst-case Analysis 1. Double lat = getLatitude(); 2. List list = new List(); 3. list.add(lat); Android Framework 4. Double latAlias = list.get(0); 5. String latStr = latAlias.toString(); Specification 6. sendSMS(latStr); getLatitude() 1. class List: 2. @Alias(arg, this.val) sendSMS (…) 3. void add(Object arg) {} add(…) get(…) toString() 4. @Alias(this.val, return) 5. Object get(Integer index) {} 6. class Double: 7. @Flow(this, return) 8. String toString() {} 9. class LocationManager: 10. @Flow(LOC, return) 11. static String getLatitude() {} Android App 12. c lass SMS: 13. @Flow(text, SMS) 14. static void sendSMS(String text) {}

Step 2: Specification Inference 1. Double lat = getLatitude(); 2. List list = new List(); 3. list.add(lat); Android Framework 4. Double latAlias = list.get(0); 5. String latStr = latAlias.toString(); Specification 6. sendSMS(latStr); getLatitude() 1. class List: 2. @Alias(arg, this.val) sendSMS (…) 3. void add(Object arg) {} add(…) get(…) toString() 4. @Alias(this.val, return) 5. Object get(Integer index) {} 6. class Double: 7. @Flow(this, return) 8. String toString() {} 9. class LocationManager: 10. @Flow(LOC, return) 11. static String getLatitude() {} Android App 12. c lass SMS: 13. @Flow(text, SMS) 14. static void sendSMS(String text) {}

Step 2: Specification Inference 1. Double lat = getLatitude(); 2. List list = new List(); 3. list.add(lat); Android Framework 4. Double latAlias = list.get(0); 5. String latStr = latAlias.toString(); Specification 6. sendSMS(latStr); getLatitude() 1. class List: 2. @Alias(arg, this.val) sendSMS (…) 3. void add(Object arg) {} add(…) get(…) toString() 4. @Alias(this.val, return) 5. Object get(Integer index) {} 6. class Double: minimal = easier to verify + more likely to be correct 7. @Flow(this, return) 8. String toString() {} 9. class LocationManager: 10. @Flow(LOC, return) 11. static String getLatitude() {} Android App 12. c lass SMS: 13. @Flow(text, SMS) 14. static void sendSMS(String text) {}

Step 2: Specification Inference 1. Double lat = getLatitude(); 2. List list = new List(); 3. list.add(lat); Android Framework 4. Double latAlias = list.get(0); 5. String latStr = latAlias.toString(); Specification 6. sendSMS(latStr); getLatitude() 1. class List: 2. @Alias(arg, this.val) sendSMS (…) 3. void add(Object arg) {} add(…) get(…) toString() 4. @Alias(this.val, return) 5. Object get(Integer index) {} 6. class Double: 7. @Flow(this, return) 8. String toString() {} 9. class LocationManager: 10. @Flow(LOC, return) 11. static String getLatitude() {} Android App 12. c lass SMS: 13. @Flow(text, SMS) 14. static void sendSMS(String text) {}

Interactive Refinement 1. Double lat = getLatitude(); 2. List list = new List(); 3. list.add(lat); Android Framework 4. Double latAlias = list.get(0); 5. String latStr = latAlias.toString(); Specification 6. sendSMS(latStr); getLatitude() 1. class List: 2. @Alias(arg, this.val) sendSMS (…) 3. void add(Object arg) {} add(…) get(…) toString() 4. @Alias(this.val, return) 5. Object get(Integer index) {} 6. class Double: 7. @Flow(this, return) 8. String toString() {} 9. class LocationManager: 10. @Flow(LOC, return) 11. static String getLatitude() {} Android App 12. c lass SMS: 13. @Flow(text, SMS) 14. static void sendSMS(String text) {}

Interactive Refinement • Two problems to solve • Step 1: Worst-case analysis • Step 2: Specification inference

CFL Reachability

CFL Reachability 1. Double lat = getLatitude(); 2. List list = new List(); 3. list.add(lat); 4. Double latAlias = list.get(0); 5. String latStr = latAlias.toString(); 6. sendSMS(latStr);

CFL Reachability: Stage 1 1. Double lat = getLatitude(); 2. List list = new List(); 3. list.add(lat); o lat 4. Double latAlias = list.get(0); o list 5. String latStr = latAlias.toString(); ret getLatitude New 6. sendSMS(latStr); arg add this add Assign list lat ret get this get latAlias this toString latString Assign text sendSMS ret toString

CFL Reachability: Stage 1 1. Double lat = getLatitude(); 2. List list = new List(); 3. list.add(lat); o lat 4. Double latAlias = list.get(0); o list 5. String latStr = latAlias.toString(); ret getLatitude New Put[ val ] 6. sendSMS(latStr); arg add this add Assign list lat Get[ val ] ret get this get 1. class List: 2. @Alias(arg, this.val) latAlias 3. void add(Object arg) {} this toString latString 4. @Alias(this.val, return) Assign 5. Object get(Integer index) {} text sendSMS ret toString

CFL Reachability: Stage 1 1. Double lat = getLatitude(); 2. List list = new List(); 3. list.add(lat); o lat 4. Double latAlias = list.get(0); o list 5. String latStr = latAlias.toString(); ret getLatitude New Put[ val ] 6. sendSMS(latStr); arg add this add Assign list lat Get[ val ] ret get this get 1. class List: 2. @Alias(arg, this.val) latAlias 3. void add(Object arg) {} this toString latString o ret toString 4. @Alias(this.val, return) RefRef Assign 5. Object get(Integer index) {} 6. class Double: text sendSMS ret toString 7. @Flow(this, return) 8. String toString() {}

CFL Reachability: Stage 1 1. Double lat = getLatitude(); 2. List list = new List(); LOC 3. list.add(lat); o lat SrcRef 4. Double latAlias = list.get(0); o list 5. String latStr = latAlias.toString(); ret getLatitude New Put[ val ] 6. sendSMS(latStr); arg add this add Assign list lat Get[ val ] ret get this get 1. class List: 2. @Alias(arg, this.val) latAlias 3. void add(Object arg) {} this toString latString o ret toString 4. @Alias(this.val, return) RefRef Assign 5. Object get(Integer index) {} 6. class Double: text sendSMS ret toString RefSink 7. @Flow(this, return) 8. String toString() {} SMS 9. class LocationManager: 10. @Flow(LOC, return) 11. static String getLatitude() {} 12. c lass SMS: 13. @Flow(text, SMS) 14. static void sendSMS(String text) {}

CFL Reachability: Stage 2 LOC o lat SrcRef o list ret getLatitude New Put[ val ] arg add this add Assign list lat Get[ val ] ret get this get latAlias this toString latString o ret toString RefRef Assign text sendSMS ret toString RefSink SMS

CFL Reachability: Stage 2 LOC o lat SrcRef o list ret getLatitude New Put[ val ] arg add this add Assign list lat Get[ val ] ret get this get latAlias this toString latString o ret toString RefRef Assign text sendSMS ret toString RefSink SMS SrcRef New New Assign Assign Put val Assign New New Assign ∈ 𝑀( ) Get Val Assign Assign RefRef New New Assign Assign RefSink

Missing Specifications 1. Double lat = getLatitude(); 2. List list = new List(); LOC 3. list.add(lat); o lat SrcRef 4. Double latAlias = list.get(0); o list 5. String latStr = latAlias.toString(); ret getLatitude New Put[ val ] 6. sendSMS(latStr); arg add this add Assign list lat Get[ val ] ret get this get 1. class List: 2. @Alias(arg, this.val) latAlias 3. void add(Object arg) {} this toString latString o ret toString 4. @Alias(this.val, return) RefRef Assign 5. Object get(Integer index) {} 6. class Double: text sendSMS ret toString RefSink 7. @Flow(this, return) 8. String toString() {} SMS 9. class LocationManager: 10. @Flow(LOC, return) 11. static String getLatitude() {} 12. c lass SMS: 13. @Flow(text, SMS) 14. static void sendSMS(String text) {}

Missing Specifications 1. Double lat = getLatitude(); 2. List list = new List(); LOC 3. list.add(lat); o lat SrcRef 4. Double latAlias = list.get(0); o list 5. String latStr = latAlias.toString(); ret getLatitude New 6. sendSMS(latStr); arg add this add Assign list lat Get[ val ] ret get this get 1. class List: 2. @Alias(arg, this.val) latAlias 3. void add(Object arg) {} this toString latString o ret toString 4. @Alias(this.val, return) RefRef Assign 5. Object get(Integer index) {} 6. class Double: text sendSMS ret toString RefSink 7. @Flow(this, return) 8. String toString() {} SMS 9. class LocationManager: 10. @Flow(LOC, return) 11. static String getLatitude() {} 12. c lass SMS: 13. @Flow(text, SMS) 14. static void sendSMS(String text) {}

Missing Specifications LOC o lat SrcRef o list ret getLatitude New arg add this add Assign list lat Get[ val ] ret get this get latAlias this toString latString o ret toString RefRef Assign text sendSMS ret toString RefSink SMS

Step 1: Worst-Case Analysis LOC o lat SrcRef o list ret getLatitude New arg add this add Assign list lat Get[ val ] ret get this get latAlias this toString latString o ret toString RefRef Assign text sendSMS ret toString RefSink SMS

Step 1: Worst-Case Analysis LOC o lat SrcRef o list ret getLatitude New Σ ∗ arg add this add Assign list lat Get[ val ] ret get this get latAlias this toString latString o ret toString RefRef Assign text sendSMS ret toString RefSink SMS

Step 1: Worst-Case Analysis LOC o lat SrcRef o list ret getLatitude New Σ ∗ arg add this add Assign list lat Get[ val ] ret get this get latAlias this toString latString o ret toString RefRef Assign text sendSMS ret toString RefSink SMS SrcRef New New Assign Assign Σ ∗ = Put val Assign New New Assign Get Val Assign Assign RefRef New New Assign Assign RefSink ∈ 𝑀( )

Step 1: Worst-Case Analysis • Use “do anything” subgraph: 𝜗 𝜗 𝑢 Σ ∗ = Σ • Finite state automata that accepts Σ ∗

Step 1: Worst-Case Analysis LOC o lat SrcRef o list ret getLatitude New arg add this add Assign list lat Get[ val ] ret get this get latAlias this toString latString o ret toString RefRef Assign text sendSMS ret toString RefSink SMS

Step 1: Worst-Case Analysis LOC o lat SrcRef o list ret getLatitude New 𝜗 𝜗 𝑢 arg add this add Assign Σ list lat Get[ val ] ret get this get latAlias this toString latString o ret toString RefRef Assign text sendSMS ret toString RefSink SMS

Step 1: Worst-Case Analysis LOC o lat SrcRef o list ret getLatitude New 𝜗 𝜗 𝑢 arg add this add Assign Σ list lat Get[ val ] ret get this get latAlias this toString latString o ret toString RefRef Assign text sendSMS ret toString RefSink SMS SrcRef New New Assign Assign 𝜗 Put val 𝜗 Assign New New Assign ∈ 𝑀( ) Get Val Assign Assign RefRef New New Assign Assign RefSink

Specification In Inference Usin ing Context-Free Language - PowerPoint PPT Presentation

Specification In Inference Usin ing Context-Free Language Reachability Osbert Bastani, Saswat Anand, and Alex Aiken Stanford University Specification In Inference Usin ing Context-Free Language Reachability Specification In Inference Usin

Equivalence with context-free grammars I Language context free recognized by pushdown automata

Pushdown Automata Pushdown Automata p.1/25 Rationale CFG are specification

Probabilistic Context-Free Probabilistic Context-Free Grammars (PCFGs) Grammars (PCFGs) Berlin

Probabilistic Context-Free Grammars Probabilistic Context-Free Grammars Berlin Chen Graduate

specification free monitoring CS 119 can we avoid writing specs? specification and programming

CFGs and CFLs Context-Free Grammars Programming language

A More General Specification Language Application of Axiomatic Language to CP Walter W. Wilson

Properties of Context-Free Languages 2IT70 Finite Automata and Process Theory Technische

Declarative Specification of FSM-Inference Algorithms InvariMint Observations Model

context free grammars in JavaMOP CS 119 a property can be seen as a language defined by a

Before We Start Any questions? Context Free Languages PDAs and CFLs Languages Context Free

Natural Language Parsing with Context-Free Grammars SPFLODD

Algorithms for Natural Language Processing Lecture 12: Context-Free Recognition Levels of

Language Independent Probabilistic Context-Free Parsing Bolstered by Machine Learning Michael

JAVA Java vs. Java Java Language Specification

On Language Equations and Grammar Coalgebras for Context-free Languages Jurriaan Rot and Joost

Unrolling Inference: The Recurrent Inference Machine Max Welling University of Amsterdam /

Context and Activity Recognition (aka Sensors + Inference) Varun Manjunatha CMSC 818G

Quartet Inference from SNP Data Under the Coalescent Model Syed Shalan Naqvi Quartet Inference

Algae Biomonitoring and Organic Pollution Septic Summit March 30,2017 Winooski Natural

Paradox of Clarity: Defending the Missing Inference Theory George Bronnikov

3.10 Statistical Inferences for Weaker Students Vikki Clarke - vclarke@westlake.school.nz Jake

S HOULD LIFESTYLE CHOICES INFLUENCE CLINICAL DECISIONS REGARDING SURGERY ? Owen Davis Keele

Croydon residents influence presentation of new Health and Care Plan Press release: 23 rd October