Search NASA⌕ Search

SEARCH · Search NASA

Results for “Static Analysis”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 19 records
All sourcesNASA NTRSDOE OSTI
DOE OSTI2024

LSAFE: a Lightweight Static Analysis Framework for binary Executables

Static analysis is a widely used technique for analyzing various aspects of programs. However, as programs become more complex, static analysis tools require larger resources, such as CPU time and memory, to perform the same tasks. Moreover, the source code of programs may not always be accessible, requiring static analysis to be performed on the binary executable code directly. To overcome these challenges, we propose a lightweight static analysis framework called LSAFE, which constructs control flow graphs (CFGs) and data dependency graphs (DDGs) of target programs with optimized performance in terms of CPU and memory usage. We evaluated the proposed framework using both Spec benchmark programs and real-world industrial applications, and found that it outperformed Angr, an existing state-of-the-art static analysis tool. Additionally, we demonstrate a case study that utilizes the CFG generated by LSAFE to detect memory leaks.

Qu, Guangzhi↗
DOE OSTI2022

MAPredict: Static Analysis Driven Memory Access Prediction Framework for Modern CPUs

Application memory access patterns are crucial in deciding how much traffic is served by the cache and forwarded to the dynamic random-access memory (DRAM). However, predicting such memory traffic is difficult because of the interplay of prefetchers, compilers, parallel execution, and innovations in manufacturer-specific micro-architectures. This research introduced MAPredict, a static analysis-driven framework that addresses these challenges to predict last-level cache (LLC)-DRAM traffic. By exploring and analyzing the behavior of modern Intel processors, MAPredict formulates cache-aware analytical models. MAPredict invokes these models to predict LLC-DRAM traffic by combining the application model, machine model, and user-provided hints to capture dynamic information. MAPredict successfully predicts LLC-DRAM traffic for different regular access patterns and provides the means to combine static and empirical observations for irregular access patterns. Evaluating 130 workloads from six applications on recent Intel micro-architectures, MAPredict yielded an average accuracy of 99% for streaming, 91% for strided, and 92% for stencil patterns. By coupling static and empirical methods, up to 97% average accuracy was obtained for random access patterns on different micro-architectures.

Monil, M. A. H.↗
DOE OSTI2020

Language Independent Static Analysis (LISA)

Software is becoming increasingly important in nearly every aspect of global society and therefore in nearly every aspect of national security as well. While there have been major advancements in recent years in formally proving properties of program source code during development, such approaches are still in the minority among development teams, and the vast majority of code in this software explosion is produced without such properties. In these cases, the source code must be analyzed in order to establish whether the properties of interest hold. Because of the volume of software being produced, automated approaches to software analysis are necessary to meet the need. However, this software boom is not occurring in just one language. There are a wide range of languages of interest in national security spaces, including well-known languages such as C, C++, Python, Java, Javascript, and many more. But recent years have produced a wide range of new languages, including Nim, (2008), Go (2009), Rust (2010), Dart (2011), Kotlin (2011), Elixir (2011), Red (2011), Julia (2012), Typescript (2012), Swift (2014), Hack (2014), Crystal (2014), Ballerina (2017) and more. Historically, automated software analyses are implemented as tools that intermingle both the analysis question at hand with target language dependencies throughout their code, making re-use of components for different analysis questions or different target languages impractical. This project seeks to explore how mission-relevant, static software analyses can be designed and constructed in a language-independent fashion, dramatically increasing the reusability of software analysis investments.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2019

CAASCADE: A System for Static Analysis of HPC Software Application Portfolios

With the increasing complexity of upcoming HPC systems, so-called “co-design” efforts to develop the hardware and applications in concert for these systems also become more challenging. It is currently difficult to gather information about the usage of programming model features, libraries, and data structure considerations in a quantitative way across a variety of applications, and this information is needed to prioritize development efforts in systems software and hardware optimizations. In this paper we propose CAASCADE, a system that can harvest this information in an automatic way in production HPC environments, and we show some early results from a prototype of the system based on GNU compilers and a MySQL database.

Lopez, Graham↗
DOE OSTI2019

Considerations for Canister Design and Drop Testing

This paper discusses some considerations for the proposed design and analysis of canisters used to ship reactor debris from the Fukushima Daiichi nuclear plant. Energy-limited events, such as cask drops and other dynamic impacts, are evaluated much differently than other structures using static analysis. Static analysis of structures makes sense for engineers because static analysis is intuitive and material typically behaves in a linear elastic manner. Dynamic analyses are typically not intuitive because of non-linear material behavior. This is why canister designs need to be evaluated by dynamic finite element analysis and/or laboratory drop tests.

12 MANAGEMENT OF RADIOACTIVE AND NON-RADIOACTIVE W↗
DOE OSTI2021

MoorPy (Quasi-Static Mooring Analysis in Python)

MoorPy is a quasi-static mooring model and a suite of associated functions for mooring system analysis. The core model supports quasi-static analysis of moored floating systems including any arrangement of mooring lines and floating platforms. It solves the distributed position and tension of each mooring line segment using standard catenary equations. Floating platforms can be represented with linear hydrostatic characteristics. MoorPy automatically computes a floating system's equilibrium state and can be queried to identify a mooring system's nonlinear force-displacement relationships. Linearized stiffness matrices are efficiently computed using semi-analytic Jacobians. MoorPy also includes plotting functions and a library of mooring component property and cost coefficients. MoorPy can be used directly from Python scripts to perform mooring design and analysis tasks, or it can be coupled with other tools to compute quasi-static mooring reactions as part of a larger simulation.

Hall, Mathew↗
DOE OSTI2022

Software Verification Toolkit (SVT): Survey on Available Software Verification Tools and Future Direction

Writing software is difficult. However, writing complex, well tested and designed, and functionally correct software is incredibly difficult. An entire field of study is devoted to the validation and verification of software to address this problem, and in this paper we analyze the landscape of currently available third party software. We have divided our analyses into three separate subsections with regards to software validation: formal methods, static analysis, and test generation. Formal verification is the most complex method in which to validate software correctness, but also the most thorough as it truly validates the mathematical validity of the source code. Static analysis generally is relegated to abstract syntax tree traversal techniques to find errors related to faulty software such as memory leaks or stack overflow issues. Automatic test generation is similar in implementation to static analysis, but pushes a bit further in verifying the boundedness of function inputs and outputs with regards to annotated or parsed criteria. The crux of this report is to analyze and describe the software tools that implement these techniques to validate and verify software. Pros and cons related to installation, utilization, and capabilities of the frameworks are described, and reproducible examples are provided with a focus on usability. The initial survey concluded that the most interesting tools of note are Z3, Isabelle/HOL, and TLA+ with regards to formal verification; and Infer, Frama-C, and SonarQube with regards to static analysis. With these tools in mind, a final conjecture is provided that describes future avenues of utilizing these tools for developing a verification framework to assist in validating existing software at Sandia National Laboratories.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2024

Deciphering Discrepancies: A Comparative Analysis of Docker Image Security

As the use of microservices continues to grow and become a foundational approach to architecting software solutions, ensuring the security of microservices is paramount. Docker images have emerged as the predominant solution to containerize microservices–and thus, Docker images are becoming a large attack surface. Thus, reducing vulnerabilities in Docker images will reduce microservice cyberattacks. A common way to find vulnerabilities in Docker images employs static analysis tools like Trivy and Grype. However, these tools frequently generate disparate vulnerability reports when analyzing the same Docker image, thus causing uncertainty in tool selection. We collected 927 Docker images, analyzed them with Trivy and Grype, and compared the vulnerabilities reported in each image. Among the 865 images found to have vulnerabilities, Trivy and Grype disagreed on both the number of vulnerabilities and the vulnerability IDs found therein. Since both tools interface with external vulnerability databases, some discrepancies can be attributed to how the tools interface with these external resources. The external vulnerability databases partially overlap and frequently contradict one another, thereby creating challenges for static analysis tool developers and end users alike. This New Ideas and Emerging Results (NIER) study contains new and critical information that practitioners need for selecting and using static analysis tools–given that increases in the use of Docker technologies means increases in the size of the attack surfaces.

Boles, Brittany [Montana State University]↗
DOE OSTI2024

Analysis of static Wilson line correlators from lattice QCD at finite temperature with T -matrix approach

The thermodynamic T-matrix approach is used to study Wilson line correlators (WLCs) for a static quark-antiquark pair in the quark-gluon plasma (QGP). Selfconsistent results that incorporate constraints from the QGP equation of state can approximately reproduce WLCs computed in 2+1-flavor lattice-QCD (lQCD), provided the input potential exhibits less screening than in previous studies. Utilizing the updated potential to calculate pertinent heavylight T-matrices we evaluate thermal relaxation rates of heavy quarks in the QGP. We find a more pronounced temperature dependence for low-momentum quarks than in our previous results (with larger screening), which turns into a weaker temperature dependence of the (temperature-scaled) spatial diffusion coefficient, in fair agreement with the most recent lQCD data.

73 NUCLEAR PHYSICS AND RADIATION PHYSICS↗
DOE OSTI2024

T -matrix analysis of static Wilson line correlators from lattice QCD at finite temperature

Here, we utilize a previously constructed thermodynamic T -matrix approach to the quark-gluon plasma (QGP) to derive constaints on its input by using results on Wilson line correlators (WLCs) of a static quark-antiquark pair from 2 + 1-flavor lattice-QCD (lQCD) computations with realistic pion mass. The self-consistent T -matrix results, which include previous constraints from the lQCD equation of state in the light-parton sector, can describe the lQCD data for WLCs fairly well once refinements of its driving kernel are applied. In particular, the input potential requires less screening than what has been inferred from previous T-matrix analyses. Pertinent predictions for the spectral and transport properties of the QGP are discussed, including the spatial diffusion coefficient for heavy quarks; the latter turns out to have a rather weak temperature dependence, in approximate agreement with recent unquenched lQCD results.

73 NUCLEAR PHYSICS AND RADIATION PHYSICS↗