Search NASA⌕ Search

SEARCH · Search NASA

Results for “Static Code Analysis”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 19 records
All sourcesNASA NTRSDOE OSTI
DOE OSTI2020

Efficient Binary Static Code Data Flow Analysis Using Unsupervised Learning

The ever increasing need to ensure that code is reliably, efficiently and safely constructed has fueled the evolution of popular static binary code analysis tools. In identifying potential coding flaws in binaries, tools such as IDA Pro are used to disassemble the binaries into an opcode/assembly language format in support of manual static code analysis. Because of the highly manual and resource intensive nature involved with analyzing large binaries, the probability of overlooking potential coding irregularities and inefficiencies is quite high. In this paper, a light-weight data, unsupervised data flow methodology is described which uses highly-correlated data flow graph (CDFGs) to identify coding irregularities such that analysis time and required computing resources are minimized. Such analysis accuracy and efficiency gains are achieved by using a combination of graph analysis and unsupervised machine learning techniques which allows an analyst to focus on the most statistically significant flow patterns while performing binary static code analysis.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2020

GPU-Based Static Data-Flow Analysis for Fast and Scalable Android App Vetting

Many popular vetting tools for Android applications use static code analysis techniques. In particular, Interprocedural Data-Flow Graph (IDFG) construction is the computation at the core of Android static data-flow analysis and consumes most of the analysis time. Many analysis tools use a worklist algorithm, an iterative fixed-point approach, to construct the IDFG. In this paper, we observe that a straightforward GPU parallelization of the worklist algorithm leads to significant underutilization of the GPU resources. We identify four performance bottlenecks, namely, frequent dynamic memory allocations, high branch divergence, workload imbalance, and irregular memory access patterns. Accordingly, we propose GDroid, a GPU-based worklist algorithm implementation with multiple fine-grained optimizations tailored to common characteristics of Android applications. The optimizations considered are: matrix-based data structure, memory access-based node grouping, and worklist merging. Our experimental evaluation, performed on 1000 Android applications, shows that the proposed optimizations are beneficial to performance, and GDroid can achieve up to 128X speedups against a plain GPU implementation.

Android security↗
DOE OSTI2022

Software Verification Toolkit (SVT): Survey on Available Software Verification Tools and Future Direction

Writing software is difficult. However, writing complex, well tested and designed, and functionally correct software is incredibly difficult. An entire field of study is devoted to the validation and verification of software to address this problem, and in this paper we analyze the landscape of currently available third party software. We have divided our analyses into three separate subsections with regards to software validation: formal methods, static analysis, and test generation. Formal verification is the most complex method in which to validate software correctness, but also the most thorough as it truly validates the mathematical validity of the source code. Static analysis generally is relegated to abstract syntax tree traversal techniques to find errors related to faulty software such as memory leaks or stack overflow issues. Automatic test generation is similar in implementation to static analysis, but pushes a bit further in verifying the boundedness of function inputs and outputs with regards to annotated or parsed criteria. The crux of this report is to analyze and describe the software tools that implement these techniques to validate and verify software. Pros and cons related to installation, utilization, and capabilities of the frameworks are described, and reproducible examples are provided with a focus on usability. The initial survey concluded that the most interesting tools of note are Z3, Isabelle/HOL, and TLA+ with regards to formal verification; and Infer, Frama-C, and SonarQube with regards to static analysis. With these tools in mind, a final conjecture is provided that describes future avenues of utilizing these tools for developing a verification framework to assist in validating existing software at Sandia National Laboratories.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2019

Ompparser

ompparser is a standalone and unified OpenMP parser, which is motivated by the facts that: 1) The differences in terms of syntax and semantics of OpenMP constructs between C/C++ and Fortran are minor. 2) Current OpenMP compilers often develop their own parsers, which represent redundant work. The features of ompparser include: 1) ompparser can be used standalone for static source code analysis, e.g. tools for semantics checking or similarity analysis between C/C++ and Fortran programs 2) omppaser can be integrated into an OpenMP compiler implementation can reduce the development efforts, and there is no need to create and maintain two separate parsers for C/C++ and Fortran. 3) ompparser provides a complete reference OpenMP grammar in the Backus-Naur Form that formally describes all the latest OpenMP language constructs. This will help users understand the rules and restriction of the OpenMP standard, which no longer contains a reference grammar in its recent versions.

Wang, Anjia↗
DOE OSTI2024

LSAFE: a Lightweight Static Analysis Framework for binary Executables

Static analysis is a widely used technique for analyzing various aspects of programs. However, as programs become more complex, static analysis tools require larger resources, such as CPU time and memory, to perform the same tasks. Moreover, the source code of programs may not always be accessible, requiring static analysis to be performed on the binary executable code directly. To overcome these challenges, we propose a lightweight static analysis framework called LSAFE, which constructs control flow graphs (CFGs) and data dependency graphs (DDGs) of target programs with optimized performance in terms of CPU and memory usage. We evaluated the proposed framework using both Spec benchmark programs and real-world industrial applications, and found that it outperformed Angr, an existing state-of-the-art static analysis tool. Additionally, we demonstrate a case study that utilizes the CFG generated by LSAFE to detect memory leaks.

Qu, Guangzhi↗
DOE OSTI2020

Safety Risk Reliability Model Library

SR2ML is a software package which contains a set of safety and reliability models designed to be interfaced with the INL developed RAVEN code. These models can be employed to perform both static and dynamic system risk analysis and determine risk importance of specific elements of the considered system. Two classes of reliability models have been developed; the first class includes all classical reliability models (Fault-Trees, Event-Trees, Markov models and Reliability Block Diagrams) which have been extended to deal not only with Boolean logic values but also time dependent values. The second class includes several components aging models. Models of these two classes are designed to be included in a RAVEN ensemble model to perform time dependent system reliability analysis (dynamic analysis). Similarly, these models can be interfaced with system analysis codes to determine failure time of systems and evaluate accident progression (static analysis).

Wang, Congjian↗
DOE OSTI2022

Shifting Left for Machine Learning: An Empirical Study of Security Weaknesses in Supervised Learning-based Projects

Context: Supervised learning-based projects (SLPs), i.e., software projects that use supervised learning algorithms, such as decision trees are useful for performing classification-related tasks. Yet, security weaknesses, such as the use of hard-coded passwords in SLPs, can make SLPs susceptible to security attacks. A characterization of security weaknesses in SLPs can help practitioners understand the security weaknesses that are frequent in SLPs and adopt adequate mitigation strategies. Objective: The goal of this paper is to help practitioners se-curely develop supervised learning-based projects by conducting an empirical study of security weaknesses in supervised learning-based projects. Methodology: We conduct an empirical study by quantifying the frequency of security weaknesses in 278 open source SLPs. Results: We identify 22 types of security weaknesses that occur in SLPs. We observe ‘use of potentially dangerous function’ to be the most frequently occurring security weakness in SLPs. Of the identified 3,964 security weaknesses, 23.79 % and 40.49 % respectively, appear for source code files used to train and test models. We also observe evidence of co-location, e.g., instances of command injection co-locates with instances of potentially dangerous function. Conclusion: Based on our findings, we advocate for a shift left approach for SLP development with security-focused code reviews, and application of security static analysis.

Bhuiyan, Farzana Ahamed↗
DOE OSTI2019

Detecting Data-Races in High-Performance Computing

High-performance computing is susceptible to data-race bugs. Data races occur when sequences of computed events do not happen in the intended order, a significant barrier to the integrity of parallel programs using shared-memory architectures. Many approaches to data-race detection are based on traditional static-analysis techniques that typically execute on a program’s source code or control-flow graph (the graphical representation of all possible orders of events in the execution of a program). Similar to classical data-flow analyses, such tools can produce false alarms that report spurious race conditions on error free programs. We have developed a software verification technique that requires as input only a program’s source code and can automatically detect a data-race bug which definitely exists, determine that a program is definitely data-race free, or report that it cannot determine either of the two cases.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2020

Language Independent Static Analysis (LISA)

Software is becoming increasingly important in nearly every aspect of global society and therefore in nearly every aspect of national security as well. While there have been major advancements in recent years in formally proving properties of program source code during development, such approaches are still in the minority among development teams, and the vast majority of code in this software explosion is produced without such properties. In these cases, the source code must be analyzed in order to establish whether the properties of interest hold. Because of the volume of software being produced, automated approaches to software analysis are necessary to meet the need. However, this software boom is not occurring in just one language. There are a wide range of languages of interest in national security spaces, including well-known languages such as C, C++, Python, Java, Javascript, and many more. But recent years have produced a wide range of new languages, including Nim, (2008), Go (2009), Rust (2010), Dart (2011), Kotlin (2011), Elixir (2011), Red (2011), Julia (2012), Typescript (2012), Swift (2014), Hack (2014), Crystal (2014), Ballerina (2017) and more. Historically, automated software analyses are implemented as tools that intermingle both the analysis question at hand with target language dependencies throughout their code, making re-use of components for different analysis questions or different target languages impractical. This project seeks to explore how mission-relevant, static software analyses can be designed and constructed in a language-independent fashion, dramatically increasing the reusability of software analysis investments.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2020

Saloon

Saloon is a Vim plugin that simplifies Python code linter / fixer configuration and usage. Saloon's menu lets developers toggle which static analysis tools to use and delegates those changes to ALE's (Asynchronous Lint Engine) API. Since prospector (python linter aggregate) already handles multiple tools, and is integrated with ALE, most of the actual linting will initially be handled via prospector calls.

Bloss, DavidK.↗
DOE OSTI2022

Generating and Analyzing Program Call Graphs using Ontology

Call graph or caller-callee relationships have been used for various kinds of static program analysis, performance analysis and profiling, and for program safety or security analysis such as detecting anomalies of program execution or code injection attacks. However, different tools generate call graphs in different formats, which prevents efficient reuse of call graph results. In this paper, we present an approach of using ontology and resource description framework (RDF) to create knowledge graphs for specifying call graphs to facilitate the construction of full-fledged and complex call graphs of computer programs, realizing more interoperable and scalable program analyses than conventional approaches. We create a formal ontology-based specification of call graph information to capture concepts and properties of both static and dynamic call graphs so different tools can collaboratively contribute to more comprehensive analysis results. Our experiments show that ontology enables merging of call graphs generated from different tools and flexible queries using a standard query interface. Index Terms—Callgraph, ontology, knowl

Dorta, E.↗
DOE OSTI2020

PredCom: A Predictive Approach to Collecting Approximated Communication Traces

Communication traces collected from MPI applications are an important source of information for performance optimization as they can help analysts determine communication patterns and identify inefficiencies. However, their collection, especially at scale, is time consuming, since it usually requires running the complete target application on a large number of nodes. In this work, we present PredCom, a tool-chain to generate a predictive communication proxy based on information gathered from a few small scale runs, which allows us to extract approximate communication traces with an accuracy high enough for most analysis goals. For this, we combine LLVM passes on the original source code (to capture static program structure) with parameter prediction (to capture dynamic and scaling behavior). This approach drastically reduces the time needed for collecting the communication traces, even for traces on large numbers of MPI processes. Here, we demonstrate that PredCom generates communication traces of various applications up to 1612x faster with an accuracy loss of 0.11 on average compared to the original large-scale traces, and we show that the generated traces can be used to optimize process placement.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2021

Hydrogen Permeation Analysis Tool

There is a rising need for the measurement and understanding of hydrogen transport properties in materials for the energy and transportation industries. The Hydrogen Permeation Analysis Tool (HyPAT) provides a user friendly interface for batch analysis of dynamic hydrogen permeation data to calculate the transport properties permeability, solubility, and diffusivity. A built in literature database provides an easy comparison to known values. A common method for measuring these hydrogen transport properties is dynamic pressure rise permeation experiments, for example, those done in the Static Gas Absorption and Permeation (SGAP) experiment at INL. Most laboratories develop individual, in-house codes for data analysis. HyPAT provides a platform that can be adopted by other user groups for such experimental analysis and significantly reduce personnel time spent performing data analysis.

Fuerst, ThomasF↗
DOE OSTI2020

Neutronics Analysis of Cold Critical KRUSTY Experiments using MCNP and Serpent

Kilowatt Reactor Using Stirling Technology (KRUSTY) is a prototype designed as a proof of concept for NASA’s Kilo power program, which was funded in order to create a small reactor for various space applications such as providing power for a colony on Mars or the moon and eventually as a possible option for powering rockets on deep space missions. KRUSTY was tested at the National Criticality Experiments Research Center (NCERC) located at the Nevada National Security Site (NNSS) from November 2017, through March 2018. The experimental campaign was conducted in four phases: com ponent critical experiments, cold critical experiments, warm critical runs, and high temperature demonstration. The component critical and cold critical experiments were used to determine the worth of the beryllium oxide (BeO) reflector rings and the boron carbide (B4C) control rod disks under different conditions. These conditions were altered by the addition and subtraction of other components in the assembly. The component critical phase was performed at atmospheric pressure and had four solid support rods spanning the center core; whereas the cold critical phase had the center core placed in a vacuum chamber and eight sodium-filled heat pipes spanning the center core region. This summary discusses the static neutronic analysis completed on the cold critical phase of the campaign using MCNP ® and Serpent. These two codes were used to assess any potential differences or biases in the simulation results. Understanding these potential biases is a key step toward the final goal of being able to fully analyze the transient experiments performed during phases 3 and 4 of the campaign.

21 SPECIFIC NUCLEAR REACTORS AND ASSOCIATED PLANTS↗
DOE OSTI2019

XScan: An Integrated Tool for Understanding Open Source Community-Based Scientific Code

Many scientific communities have adopted community-based models that integrate multiple components to simulate whole system dynamics. The community software projects’ complexity, stems from the integration of multiple individual software components that were developed under different application requirements and various machine architectures, has become a challenge for effective software system understanding and continuous software development. The paper presents an integrated software toolkit called X-ray Software Scanner (in abbreviation, XScan) for a better understanding of large-scale community-based scientific codes. Our software tool provides support to quickly summarize the overall information of scientific codes, including the number of lines of code, programming languages, external library dependencies, as well as architecture-dependent parallel software features. The XScan toolkit also realizes a static software analysis component to collect detailed structural information and provides an interactive visualization and analysis of the functions. We use a large-scale community-based Earth System Model to demonstrate the workflow, functions and visualization of the toolkit. We also discuss the application of advanced graph analytics techniques to assist software modular design and component refactoring.

Zheng, Weijian↗