Symbolic Execution for Vulnerability Analysis: Improving Analyses with Symbolic Procedures [Poster]
Overview of work completed as a summer intern in the CCD.
97 MATHEMATICS AND COMPUTING↗
SEARCH · Search NASA
Results for “Symbolic Execution”
Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.
Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.
Creating Human Readable Path Constraints from Symbolic Execution.
Abstract not provided.
Amon, Tod Tracy↗
Creating Human Readable Path Constraints from Symbolic Execution.
Abstract not provided.
Amon, Tod Tracy↗
Creating Human Readable Path Constraints from Symbolic Execution.
Abstract not provided.
Amon, Tod Tracy↗
Improving Floating Point Symbolic Execution Coverage with Fixed Point Approximations.
Abstract not provided.
Rutledge, Richard↗
Toward Automated Detection of Portability Bugs in Kokkos Parallel Programs
Performance-portable programming frameworks provide abstractions for parallel execution to allow easily porting an application to multiple backend programming models, such as CUDA, HIP, and OpenMP. However, programs may still have portability bugs that manifest only on specific backends. Traditional testing is ineffective in discovering these bugs, as it would require concrete execution on all supported hardware configurations for a potentially infinite set of inputs. To mitigate this issue, we focused on a specific programming framework, Kokkos, and identified several categories of common portability bugs. We then developed Klokkos, a static analysis approach based on symbolic execution that can run on commodity hardware, before execution on supercomputers. As a proof-of-concept, we ran Klokkos on examples encoding the identified bugs. Our results show that Klokkos is effective, efficient, and precise: it detected all the considered bugs, quickly, and without any false positives. Although preliminary, our results motivate further research and development in this direction.
Kale, Vivek↗
Speeding-up fuzzing through directional seeds
Abstract Fuzzing is an automated process for discovering inputs in a program that may trigger unexpected behavior. Today, fuzzing has become a standard practice for the discovery of bugs and security vulnerabilities. However, the main issue with such practices is that the exploration of the input space of programs can often be prohibitively expensive. Therefore, several alternative fuzzing strategies have been introduced during the last few years. Some fuzzing techniques rely on human expertise to provide a plausible set of initial input examples, namely, seeds. However, the process of handcrafting seeds for fuzzing purposes often becomes strenuous for humans as it requires a deeper understanding of the Program-Under-Test (PUT). Also, the use of known inputs to programs often does not trigger vulnerable program behavior or may not reach potentially vulnerable code locations. To address those issues, we propose a seed generation framework that enables Human-In-The-Loop (HITL) directed fuzzing where the human assumes a more active role in the creation of seeds that can penetrate and assess desired locations of the PUT. Our proposed framework uses Symbolic Execution (SE) to generate seeds that exercise paths to target program locations. Moreover, our framework enables the visualization of the explored execution paths in the binary of the PUT for the generated seeds. We evaluated our approach on a set of 12 carefully designed C programs with diverse characteristics that mimic real-world programs. The experimental results show the effectiveness of the proposed approach in improving the performance of standard fuzzing tools such as the American Fuzzy Lop ("Image missing" <#comment/> ). Specifically, our solution can generate seeds that substantially enhance the performance of the fuzzer, achieving speedups ranging from $$1.46\times $$ 1.46 × to $$68.53\times $$ 68.53 × for branch conditions, $$1.39\times $$ 1.39 × to $$254.62\times $$ 254.62 × for branch depths, $$14,879.59\times $$ 14 , 879.59 × to $$30,295.88\times $$ 30 , 295.88 × for branch widths over traditional seeds. Additionally, the speedup increases with the number of target function ranging from $$12,260\times $$ 12 , 260 × to $$22,856.07\times $$ 22 , 856.07 × over traditional seeds while only requiring less than 15 seconds on average for the seed generation step.
97 MATHEMATICS AND COMPUTING↗
Towards Automated Reasoning Chains for Verification of LLM-Generated Scientific Code
With the rise of Large Language Model (LLM) generated code, including in domains like scientific computing, ensuring not only syntactical, but also mathematical correctness, has become a critical task. Traditional formal methods approaches often struggle with the ambiguity of floating-point code, and full symbolic execution is extremely costly and limited. We propose a chain-of-reasoning approach that iteratively lifts basic semantics from code into the SPIRAL system and then establishes numerical equivalency to the desired mathematical operation. Here, we leverage the ample mathematical knowledge already formalized in SPIRAL to enable the system to recognize not just different implementations of the same algorithm but fully separate approaches to solving the given problem. The chain establishes tight error bounds on the output of given code with respect to the true continuous solution it approximates, quantifying all sources of error. We demonstrate this approach by establishing the correctness of a pseudospectral solver for a simple 1-dimensional Poisson problem.
Oschatz, Quentin [Carnegie Mellon University,Pitts↗
Shorter function summaries for finite state machine-based high consequence systems using logic synthesis and tautologies (Final Report LDRD 24-1302)
Computer programs are often viewed as collections of functions – each function has parameters (inputs) and computes a return value, and each has potential side effects that modify program state (outputs). In this research, a Sandia symbolic execution tool designed to support “human-in-the-loop” analysis was modified to automatically create “function summaries,” and a new tool, “diaboolical,” was created to support enhancing readability of the summary using a novel approach to bit-vector simplification that leverages logic synthesis and tautologies. For this effort, students at Auburn University created several finite state machines (FSMs) to serve as exemplars for high-consequence systems. Function summaries for each of the machines were obtained, and then portions of the summaries were simplified using both diaboolical and the simplification procedure of a popular SMT solver. A comparison of the results shows that diaboolical can often produce smaller function summaries, with expression length improvements over the unsimplified function summaries ranging from 0% to 90% for diaboolical and 0% to 65% for the SMT solver, though diaboolical had a significantly greater cost in time. Diaboolical was evaluated against a collection of “arbitrary” C-code as well as FSM exemplars, and for both datasets it achieved an approximately 10% improvement in expression length compared to simplifications that could be obtained using existing techniques. Function summaries can assist assurance efforts that evaluate existing systems and their executable code. A smaller function summary is likely easier for humans to understand and could thus increase the ability and efficacy of assurance practices centered around the analysis of executable artifacts.
97 MATHEMATICS AND COMPUTING↗
Program Verification for Extreme-Scale Applications (Final Scientific/Technical Report)
The project seeks to develop tools and techniques to help software developers verify the correctness and accuracy of their code. The target domain is scientific software of the kind widely used and developed in the Department of Energy research community, with a particular focus on "extreme scale" programs - those that are expected to involve possibly millions of parallel threads of execution. The report covers the University of Delaware contribution to the collaborative project. The project had a number of successful outcomes, especially regarding the development and extension of the CIVL software verification framework. CIVL is a verification tool for C or Fortran programs that use MPI, OpenMP, CUDA, and/or Pthreads for parallelization. CIVL went through vast improvements and extensions, and was successfully applied to a number of challenging codes. It found a subtle bug in the Devito PDE framework. It was able to verify the functional correctness of a conjugate gradient solver using a novel probabilistic technique with vanishingly small chance of error. CIVL was used very successfully in verification competitions, and the CIVL solutions to the competition challenges were presented and published. CIVL was also used successfully by other researchers on a computational chemistry kernel.
97 MATHEMATICS AND COMPUTING↗
Agentic Diagrammatica: Towards Autonomous Symbolic Computation in High Energy Physics
We present Diagrammatica, a symbolic computation extension to the HEPTAPOD agentic framework, which enables LLM agents to plan and execute multi-step theoretical calculations. Symbolic computation poses a distinctive reliability challenge for LLM agents, as correctness is governed by implicit mathematical conventions that are not encoded in a form that can be easily checked in the computational backend. We identify two complementary remedies, tool-constrained computation and targeted knowledge grounding, and pursue the first as the primary architecture. Concretely, we concentrate the agent's action distribution onto tool calls with convention-fixing semantics, in which the agent specifies a compact, human-auditable diagram specification and a trusted backend performs the symbolic or numerical manipulations exactly. The toolkit provides two complementary calculation paths consuming a shared diagram specification: Naive Dimensional Analysis (NDA) for order-of-magnitude rate estimates and Exact Diagrammatic Analysis (EDA) for tree-level symbolic calculations via automatic FeynCalc code generation, both supplemented by automatic Feynman diagram enumeration and a navigable theory knowledge base. The architecture is validated on two benchmarks: (1) an exhaustive catalog of all tree-level, single-vertex $1\to 2$ partial decay widths across scalar, fermion, and vector parents, with complete massless and threshold limits and Standard Model validation; and (2) an NDA sensitivity study of the muon decay multiplicity $μ^+ \to ν_μ\barν_e + n(e^+e^-) + e^-$, determining the maximum observable $n$ at current and planned muon experiments.
Menzo, Tony [Alabama U.; Fermilab] (ORCID:00000002↗
Sandia Cloud Forensics and Incident Response Platform v 1.0
As systems and devices become virtualized and deployed in the cloud, the hypervisor becomes an increasingly appropriate place to collect performance data, system state, system landscape, function calls, transaction traces, and other characteristics. We developed a method by which an introspection application may be coupled with a hypervisor to “reach into” the VM with minimal intrusiveness to collect data critical to the reconstruction of events, files, and operations. Such a capability is required to take advantage of the hypervisor as an instrumentation platform and to integrate that data with more traditional collection mechanisms. The concept of a VM serviced by a lightweight hypervisor is a relatively new paradigm for forensic practitioners. Traditional forensic techniques, based on assumptions that the filesystem was directly interacting with the hardware through an abstraction, afforded the forensic practitioner the assumption that there was nothing controlling the application below the filesystem. This is not the case when using virtualized technologies. Hypervisors can covertly monitor, introspect and interact with the guest in a transparent fashion. The problems of storage and collection of actionable data are exhausting. The current challenge is most hypervisors do not expose a useful application programming interface (API) at a sufficient level to do transparent, fine-grained and customizable introspection. Scalable VM instrumentation and introspection at an in-depth level requires fast handling of events, as well as direct access to VM state. Furthermore, deep introspection benefits greatly from the ability to gather data from the hardware during the VM’s exit to the hypervisor. All of this requires identical access to the system as the hypervisor itself; improper use of this ability could easily cause system instability. It is for this reason we believe that the hypervisor developers have been hesitant to grant this much control through their APIs. However, our approach leverages other means to collect and monitor the guests in a targeted fashion. Virtual machine introspection (VMI) is a technique used to monitor the runtime state of a system-level virtual machine. The runtime state can be may include processor registers, memory, disk, network, and any other hardware-level events A review of research literature and current VMI technologies exposed several limitations and tradeoffs in VMI approaches, including: the use of in-guest agents; kernel to user space transitions (dramatically slowing down processing); VMI tool pre-configuration requirements; hypervisor version lock-in or source code patching; reliance on operating system symbols; limited processor features due to hypervisor (even if the hardware could do more). To address these constraints, a VMI tool was envisioned to provide the cloud forensic capabilities while having as few of these limitations as possible. The Kernel-based Virtual Machine Introspection (KVMi) tool was developed for hypervisors on Intel’s x86-64 architecture. To meet performance, scoping and use-case demands, the follow criteria were applied to KVMi to support live, forensic data collection: • Shall not require in-guest agents. • Shall work with any recent version of modern hypervisors. • Shall introspect upon any guest (VM) running modern versions of Windows, Linux and OS X. • Shall have the ability to find and track operating system artifacts • Shall not require operating system symbol files. • Shall be able to fully handle VM-exits, bypassing execution of the hypervisor if necessary, to facilitate new features the hypervisor may not support. • Shall be compilable/loadable on a running system with standard build tools.
Stout, WilliamM.S.↗
PDQ Users Manual Version 1 for PDQ Code Version 1.12
PDQ is a tool for the management of the input and execution of batch jobs for simulation codes that use a text based input system. It accomplishes this goal by operating at two levels. First, it takes input file templates (commonly known at LANL as input deck templates) and creates multiple instantiations by performing substitutions of data from table files into symbols (variables) found in the template. Second, it provides commands to submit the created files to the SLURM batch system for execution. These two activities taken together produce a whole that is greater than the sum of its parts and provides an elegant way of executing studies across multiple similar simulations while minimizing the risk of typographical errors in the input files.
97 MATHEMATICS AND COMPUTING↗
PDQ Users Manual. Manual Version 2, for PDQ Code Version 1.20
PDQ is a tool for the management of the input and execution of batch jobs for simulation codes that use a text based input system. It accomplishes this goal by operating at two levels. First, it takes input file templates (commonly known at LANL as input deck templates) and creates multiple instantiations by performing substitutions of data from table files into symbols (variables) found in the template. Second, it provides commands to submit the created files to the SLURM batch system for execution. These two activities taken together produce a whole that is greater than the sum of its parts and provides an elegant way of executing studies across multiple similar simulations while minimizing the risk of typographical errors in the input files. PDQ was originally developed as a job management system called XVS by Jeff McAninch while he was at LANL. Besides the capabilities described here, XVS had many other features specific for interactions with particular simulation codes. After Jeff’s departure, maintenance of XVS was taken over by Rendell Carver; he added some new features as well as kept it functioning as the batch system at LANL was changed from LSF to MOAB to SLURM. In 2017, Rob Pelak decided to develop a different version that removed the additional features (many of which were rendered obsolete with the retirement of the simulation code or batch system that they supported) and produced a cleaner “bare bones” version of XVS. A few other behaviors of XVS that Rob found irksome were altered. Rob gave the resulting code a new name: PDQ. In 2022 Danielle McDermott developed a version that runs under Python 3.X. As suggested by Rob, she used the python2to3 utility to identify most changes. Given that PDQ continues to operate with Python version 2.7 we have advanced the version number to 1.20.
97 MATHEMATICS AND COMPUTING↗
Camellia: A Rapid Development Framework for Finite Element Solvers
We report the discontinuous Petrov–Galerkin (DPG) methodology of Demkowicz and Gopalakrishnan guarantees the optimality of the finite element solution in a user-controllable energy norm, and provides several features supporting adaptive schemes. The approach provides stability automatically; there is no need for carefully derived numerical fluxes (as in DG schemes) or for mesh-dependent stabilization terms (as in stabilized methods). In this paper, we focus on features of Camellia that facilitate implementation of new DPG formulations; chief among these is a rich set of features in support of symbolic manipulation, which allow, e.g., bilinear formulations in the code to appear much as they would on paper. Many of these features are general in the sense that they can also be used in the implementation of other finite element formulations. In fact, because DPG’s requirements are essentially a superset of those of other finite element methods, Camellia provides built-in support for most common methods. We believe, however, that the combination of an essentially “hands-free” finite element methodology as found in DPG with the rapid development features of Camellia are particularly winsome, so we focus on use cases in this class. In addition to the symbolic manipulation features mentioned above, Camellia offers support for one-irregular adaptive meshes in 1D, 2D, 3D, and space-time. It provides a geometric multigrid preconditioner particularly suited for DPG problems, and supports distributed parallel execution using MPI. For its load balancing and distributed data structures, Camellia relies on packages from the Trilinos project, which simplifies interfacing with other computational science packages. Camellia also allows loading of standard mesh formats through an interface with the MOAB package. Camellia includes support for static condensation to eliminate element-interior degrees of freedom locally, usually resulting in substantial reduction of the cost of the global problem. Finally, we include a discussion of the variational formulations built into Camellia, with references to those formulations in the literature, as well as an MPI performance study.
97 MATHEMATICS AND COMPUTING↗
Altered amplitude of low‐frequency fluctuation in basal ganglia correlates to pulmonary ventilation function in COPD patients: A resting‐state fMRI study
Abstract Introduction Patients under chronic obstructive pulmonary disease (COPD) has been reported to be associated with a higher prevalence of cognitive impairment (CI). However, it is still largely unknown whether the aberrant resting‐state spontaneous neuronal activity pattern reflected by the amplitude of low‐frequency fluctuation (ALFF) analysis will be associated with the CI in COPD patients. Materials A total of 28 COPD patients and 26 healthy controls were enrolled in this study. Of all the subjects, structural and functional MRI data, spirometry tests performance and neuropsychological assessments of different cognitive domains were collected. Voxel‐based two‐sample t tests were used to detect brain regions showing differences in the ALFF value between COPD patients and healthy controls. An additional fMRI runs with supplementary oxygen delivery were employed to explore the impact of elevated partial pressure of oxygen (PaO 2 ) or moderate hyperoxia on ALFF in COPD patients and healthy controls respectively. Results More extensive white matter lesion was detected in COPD patients. COPD patients exhibit decreased ALFF value in bilateral basal ganglia areas and right thalamus, and aberrant ALFF value is correlated with PaO 2 and pulmonary ventilation function (FEV1%pred). COPD patients performed worse in the Digit Span Test (reverse), Digit Symbol Substitution Test, Trail‐making test (A and B) than controls. After supplementary oxygen inhalation, the ALFF value of basal ganglia and right thalamus significantly increased in the controls, but not in the COPD patients. Conclusions COPD patients mainly exhibit impaired executive function but not long‐term memory in cognitive function assessment. Aberrant ALFF alteration in the deep brain may be directly related to lower PaO 2 in COPD patients.
Lu, Chun‐Qiang↗
Integrated Methane Monitoring Platform Extension, Volume I: Final Technical Report
The IMMPE project, DE-FE0032284, was to enhance methane monitoring technologies and their applications across various natural gas asset classes. The scope included deploying advanced methane detection and monitoring technologies to identify and mitigate fugitive methane emissions, measuring emission rates, and assessing impacts. The findings included the successful mitigation of identified emissions and quantification of emission rates. A key outcome was the development of a comprehensive template and summary of recommendations for methane emissions monitoring, which is replicable for both upstream and downstream applications. Furthermore, the project emphasized the importance of education by providing training opportunities for technicians and regulators, thereby fostering awareness and promoting the adoption of cost-effective methane emissions monitoring and management techniques.
02 PETROLEUM↗
Revisiting Huffman Coding: Toward Extreme Performance on Modern GPU Architectures
Today's high-performance computing (HPC) applications are producing vast volumes of data, which are challenging to store and transfer efficiently during the execution, such that data compression is becoming a critical technique to mitigate the storage burden and data movement cost. Huffman coding is arguably the most efficient Entropy coding algorithm in information theory, such that it could be found as a fundamental step in many modern compression algorithms such as DEFLATE. On the other hand, today's HPC applications are more and more relying on the accelerators such as GPU on supercomputers, while Huffman encoding suffers from low throughput on GPUs, resulting in a significant bottleneck in the entire data processing. In this paper, we propose and implement an efficient Huffman encoding approach based on modern GPU architectures, which addresses two key challenges: (1) how to parallelize the entire Huffman encoding algorithm, including codebook construction, and (2) how to fully utilize the high memory-bandwidth feature of modern GPU architectures. The detailed contribution is fourfold. (1) We develop an efficient parallel codebook construction on GPUs that scales effectively with the number of input symbols. (2) We propose a novel reduction based encoding scheme that can efficiently merge the codewords on GPUs. (3) We optimize the overall GPU performance by leveraging the state-of-the-art CUDA APIs such as Cooperative Groups. (4) We evaluate our Huffman encoder thoroughly using six real-world application datasets on two advanced GPUs and compare with our implemented multi-threaded Huffman encoder. Experiments show that our solution can improve the encoding throughput by up to 5.0x and 6.8x on NVIDIA RTX 5000 and V100, respectively, over the state-of-the-art GPU Huffman encoder, and by up to 3.3x over the multi-thread encoder on two 28-core Xeon Platinum 8280 CPUs.
Tian, Jiannan↗