Program Analysis using Machine Learning

1
Program Analysis using Machine Learning

• David Yu Chen
• dychen_at_stanford.edu

2
Background

• MC Bugs as Deviant Behavior
• Static Analysis
• Combine May Beliefs
• Deal with noise
• 3-month project
• Demonstrate effectiveness of machine learning

3
Supervised Machine Learning

• Techniques
• Logistical Regression
• Support Vector Machines
• Bayesian Networks
• Applications
• Error Paths
• Function Pairs
• Array Bounds

4
Machine Learning Algorithm

• Specify the evidence and model.
• Construct a training set and evaluation set.
• Initialize the parameters.
• Update the parameters using Maximum Likelihood
  Estimation (MLE)
• Evaluate using the evaluation set.

5
Logistical Regression

• Y p0 p1 X1 p2 X2
• P exp(Y) / (1 exp(Y))

6
Support Vector Machines

• General learning method that solves
• Y p0 p1 X1 p2 X2
• Problem-specific kernel function
• Maps the features into linear space
• linear, polynomial, gaussian, sigmoid

7
Bayes Nets

• Directed acyclic graph encodes probability
  distributions
• Each node contains a probability table for
  P(selfparents)

8
Error Paths

• 1 int maybe_copy(int condition, int to)
• 2 int mem malloc(10)
• 3 int flag OK
• 4 if (condition)
• 5 free(mem)
• 6 flag BAD
• 7 goto exit
• 8
• 9 to mem
• 10 exit
• 11 return flag
• 12

9
Error Path Features

• Classify Gotos and Returns
• Functions on Basic Blocks
• Assignments on Basic Blocks
• Known values

10
Function Pairs

• Classify A B
• Locks
• Allocators and Deallocators
• Initializers and Finalizers
• Sequences of functions for pointer variables
• intra- and inter-procedural paths

11
Function Pair Features

• Intra- or inter-procedural
• Error path
• AB pair appearance
• A/B only appearance
• Pair defined in the same file
• Pair contains a prefix or suffix

12
Array Bounds

• For each array
• Does there exist an explicit bound?
• Variable or constant?
• Size in bytes or entries?

13
Array Bounds Features

• Code
• array func(bound)
• func (array, bound)
• if/while (i lt bound) arrayi
• if/while (i lt bound) func (array, i)
• Array/bound in same structure
• Array/bound contains a prefix or suffix

14
Questions?