恶意网络程序的危害性及对策研究

恶意网络程序因其对计算机网络系统的巨大破坏作用而引起了人们的广泛关注。研究了恶意网络程序的本质特征,给出了恶意网络程序的定义。分别从功能特征和行为特征两个方面对网络恶意程序进行了分类研究。对恶意网络程序的危害性及其度量评估方法进行了深入分析研究。讨论了防范恶意网络程序的整体解决方案所需要考虑的因素,并提出了应对恶意网络程序的一般性原则。     

Software Reusability through Versions

In this paper a new approach for modelling program variants (versions) is proposed, which is focused on increasing the level of software reuse, rather than on enriching data model. In this approach, a program is composed of a program body and a set of logically independent program contexts. The program body contains global functions and global data structures. Each program context contains exactly one variant of every class defined in the program and one variant of every non-global function, called a context function. Variants of the same class/function belonging to different contexts need not be different. During the program execution only one context is active. It may, however, be changed dynamically at program run-time. Thus, at a particular moment of time the program is viewed as a sum of the program body and exactly one program context.     

C/C++程序缺陷自动修复与确认方法

在计算机软件中,程序缺陷不可避免且极有可能造成重大损失.因此,尽早发现并排除程序中潜在的缺陷,是学术界和工业界的普遍共识.目前的程序缺陷自动修复方法大都遵循缺陷定位、修复候选项生成、选择及验证的流程,但在修复实际程序时存在修复率低、无法保证修复结果的正确性等问题.提出了一种基于程序合成的C/C++程序缺陷自动修复方法.首先,从满足相同规约的程序集中,通过人工整理的方式总结错误模式及其对应的修复方法,使用重写规则表达错误模式,在此基础上实现了基于重写规则和基于程序频谱的缺陷定位方法,得到程序中可能的缺陷位置;其次,基于重写规则,使用修复选项生成方法得到缺陷的修复选项,同时,通过深度学习的方式学习正确程序的书写结构,帮助预测错误程序错误点应有的语句结构,通过这两种方式提高候选项质量,进而提高修复率;最后,在选择验证过程中,使用程序合成的方法将样例程序作为约束,保证合成后代码的正确性.基于上述方法实现了原型工具AutoGrader,并在容易出错、缺陷典型的学生作业程序上进行了实验,结果显示,该方法对学生作业程序中的缺陷有着较高的修复率,同时也能保证修复后代码的正确性.     

Formal derivation of rule-based programs

It is shown that a combination of specification and program refinement may be applied to deriving efficient concurrent rule-based programs. Specification refinement is used to generate an initial rule-based program that is refined into a program which is highly concurrent and efficient. This program derivation strategy is divided into two major tasks. The first task relies on specification refinement. Techniques similar to those employed in the derivation of UNITY programs are used to produce a correct rule-based program having a static knowledge base. The second task involves program refinement and is specific to the development of concurrent rule-based programs. It relies heavily on the availability of a computational model, such as Swarm, that has the ability to dynamically restructure the knowledge base. The ways in which a Swarm program can be translated to OPS5 specifically, given some restrictions, while maintaining the correctness criteria are discussed     

基于抽象解释的函数内联过程间分析优化方法

分析实际程序时往往需要分析程序中函数的调用, 一般使用过程间分析来实现全程序分析.函数内联是一种最为精确、易于实现的过程间分析方法.通过函数内联, 可以使得已有过程内分析方法和工具支持包含函数调用的程序的分析.但是, 函数内联后代码的规模急剧增加, 同时将产生大量中间变量, 增加程序分析的变量维度, 导致程序分析过程时空开销大大增加.本文考虑基于抽象解释框架下函数内联过程间分析的一些不足, 并提出相应优化方法.基于抽象解释的程序分析关注自动推导程序变量之间的不变式约束关系, 因此程序变量构成的程序环境大小(即各程序点处须考虑的相关变量集合)对分析的时空开销具有重要影响.为了减少函数内联后程序分析的开销, 本文提出了面向内联函数块的程序环境降维优化方法.该方法针对内联函数后的程序代码, 分析确定不同程序点处需维护的程序环境(即相关变量集合), 而不是所有程序点共享同一全局程序环境, 从而实现程序状态的降维.详细描述了基于该方法所实现的工具DRIP (Dimension Reduction for analyzing function Inlined Program) 的架构、模块及算法细节.并在WCET Benchmarks测试集开展了分析实验, 实验结果表明: DRIP在变量消除上取得的效果良好, 甚至在某些测试集上能减少一半以上的变量, 并在一定程度上降低了分析过程的时空开销.     

一种用于软件测试的程序结构划分方法

软件测试中的结构性测试是以程序的结构为基础生成测试用例，以测试准则为判定测试的充分性，由于程序结构的复杂性，难于保证对程序进行充分而高效的测试，本文提出了一种基于程序依赖图的程序结构划分的测试方法，即程序块划分法。该方法难过对程序进行结构划分，将复杂的程序分解为若干程序块，并通过程序块间的数据依赖关系导出各程序块的语义，从而使测试可以在程序块的级别的基础上独立进行。     

一种Java程序Chopping方法

程序Chopping对于程序理解、分析、调试、测试等具有重要的意义。已有的Chopping方法主要基于相互连接的系统依赖图(SDG),对于大程序这种SDG描述通常非常复杂,易导致程序Chopping结果不准确。针对这一问题,基于带标签的Java程序描述方法,提出一种Java程序Chopping方法。该方法利用这种描述附带的程序依赖信息,分析参数依赖关系,并在此基础上给出Chopping算法。此程序Chopping方法能把Java程序方法间的程序Chopping问题转换到Java程序方法内进行分析,程序依赖图具有结点少、可重用、可并发构造等优点。最后通过实例和实验给出程序Chopping方法的实施过程及有效性。     

A data-directed approach to program construction

The present paper discusses a method of program construction based on the specification of the data types. The input and output data types and the mapping between them are specified at a high level of abstraction and this non-procedural specification is used to develop a program schema. The data type and mapping specifications are modified to include a concrete representation of the data and these are used to expand the program schema into a program. A graphical representation for data and program specifications is also introduced and it is shown how this can simplify the techniques and be very useful in program construction. The method is illustrated by developing two programs—the line justifier program described by Gries and the bubblesort.     

提升小波变换的通用和可扩展编程实现

提升方案是小波研究的新热点,该文给出一个实现提升小波变换的通用和可扩展程序.首先从小波变换的计算讨论了提升方案的基本步骤,分析了用提升格式构造已有小波和设计新小波的方法,并以面向对象的编程手段实现了提升小波变换;该程序以提升方案的基本过程为核心并加以抽象,设计提升小波变换的基类,提供缺省的Lazy变换和反变换过程,模板的应用使程序支持抽象数据类型,虚函数使程序能通过派生新类方便地实现特定的提升小波;该程序具有可重用、可扩展、易理解、易使用等优点;将该程序应用到一幅通过用中子辐射照相技术获得的图像进行测试分析,实验结果显示了它的高效性,其计算速度明显优于Mallat算法,能满足在线处理的需要.     

面向方面自监控软件的行为正确性验证

嵌入监控代码方法一般是在原程序中嵌入监控代码后生成自监控软件,实现安全策略对软件行为的约束,受自监控软件实现方式等具体研究方法限制,目前验证自监控软件行为符合目标安全策略的方法验证能力有限。提出一种灵活的基于面向方面编程的自监控软件实现方式,并设计了相应更全面的自监控软件行为正确性验证方法。该方法基于交替转换系统描述自监控软件的行为,使用时间交替时序逻辑定义软件行为正确的性质公式,通过给定算法在模型上检测性质公式满足与否,从而验证软件行为是否符合"安全性"、"活性"等类型监控策略,并可以分析监控代码对原程序的影响。     

A design for a text editor

This paper describes a program for editing text on the Titan (prototype ICL Atlas II) computer at Cambridge University The program is an essential part of the multiple-access system that is in operation on that computer, although it is also used non-interactively through the more conventional job-shop system. The program, EDIT, has also been implemented on an IBM 1130 and an IBM 360/65 Among the facilities provided by this program are the basic operations of text replacement, insertion and deletion Editing operations may be specified either by line number or by reference to a particular context The program is a compromise between a low cost, high-speed system and the flexible multi-function editor that is demanded by users from all departments of the University.     

一种新的软件测试数据的进化生成方法

测试数据自动生成对降低软件开发成本是非常重要的.本文首先提出了基于程序结构和程序规范相结合来设计适应度函数的新方法：分别设计基于程序结构和基于程序规范的适值函数,再将二者结合作为最终的适应度函数值;然后,在采用上述适应度函数定义的基础上,构造了一种软件测试数据的进化生成方法.     

基于编译技术的程序可视化

程序可视化的目的是使程序的内部结构以及行为可视化更容易被理解。程序可视化工具有助于程序员理解程序的实际行为和其开发的深层的系统，以及调试程序或者测试程序所用资源。特别是对于正在学习初级编程的人，程序可视化工具能帮助他们学习一个程序是如何被编译和执行的。因此,有必要进行关于程序执行可视化的研究。介绍了一种以编译技术，主要是以词法分析和语法分析为基础的开发程序可视化工具的方法，并给出了C语言程序执行可视化工具的实例，以说明该方法的实用性。该工具是在程序执行特征测试工具的基础上，将其词法分析器和词法分析器加以修改而实现的。     

Using recorded values for bounding the minimum completion time inmultiprocessors

The way the processes in a parallel program are scheduled on the processors of a multiprocessor system affects the performance significantly. Finding a schedule of processes to processors which results in minimum completion time is NP-hard. Therefore, one has to resort to heuristic schedules. However, it is often difficult to determine if a specific schedule is close to the optimal case or if it is worthwhile to look for other schedules. Based on information from previous executions of the parallel program, we present a formula for an upper bound on the minimum completion time of the program. The bound is a function of a set of parameters. Some of these parameters are obtained from the previous executions of the program and the others describe the target multiprocessor architecture for which we want to bound the minimum completion time. The bound is optimal when it is based on information from one previous execution. Using these results, we are able to decide if a certain schedule is close to optimal or if it is worthwhile to look for other schedules. This is demonstrated by evaluating the completion time of a specific schedule of a particular program. The proofs used for obtaining the bound are based on program transformations and combinatorial mathematics     

基于合约的程序不变量动态检测模型研究

讨论了程序不变量的内涵,研究并建立了程序不变量动态生成系统的理论模型.主要描述基于合约的似然程序不变量发现的基本理论模型,以及程序不变量发现的主体过程,并结合Java程序设计语言进一步阐明函数依赖程序不变量动态发现的一种方法.通过程序不变量动态生成技术,可以分析程序内部的关联属性,从而有助于设计高质量的程序代码以及规范化的程序架构.     

基于静态模拟的二进制控制流恢复算法

恢复完整的程序控制流图是软件逆向分析的关键,但传统恢复算法依赖于程序结构和编译器信息,不具通用性,无法满足无结构的二进制程序控制流恢复的需要.针对该问题,在传统控制流恢复算法的基础上,提出一种基于静态模拟策略的通用二进制程序控制流恢复算法,并与传统控制流恢复算法、基于切片技术的控制流恢复算法和动态控制流恢复算法在性能上...     

Design program for multi-story structures

An efficient and short computer program, STFRD, has been developed to facilitate the structural engineer who is involved in multi-story building design. The program consists of three basic parts. The first part of the program performs a preliminary analysis of a frame section of a building using approximate methods to determine forces due to the loads. The loads will consist of uniform dead, live and wind loads. The second part of the program utilizes an iterative process, using the allowable stresses given by the AISC building specifications, to determine member sizes. The third part of the program consists of a matrix analysis of the frame section to determine actual forces on the members, due to the loads. This analysis is used in conjunction with the AISC building codes to verify the adequacy of the member sizes chosen. The program also has a redesign capability which is used if the preliminary member sizes are not adequate. The entire procedure has been programmed for use on a UNIVAC 1108 computer, FORTRAN IV language. The program may be obtained from the author.     

Facility Layout Program

The Facility Layout (FACLO) program is an interactive micro-computer program based on the Computerized Relative Allocation of Facilities Technique (CRAFT). The program uses heuristics to determine the best relative location of areas and obtain a high level layout. A user interface creates the data file required to run the program, eliminating the need for intimate knowledge of program and database structure. The program is written in Turbo Pascal and provides print, plot, and screen output.     

Semantics guided regression test cost reduction

Software maintainers are faced with the task of regression testing: retesting a modified program on an often large number of test cases. The cost of regression testing can be reduced if the size of the program is reduced and if old test cases and results can be reused. Two complimentary algorithms for reducing the cost of regression testing are presented. The first produces a program called Differences that captures the semantic change between Certified, a previously tested program, and Modified, a changed version of Certified. It is more efficient to test Differences, because it omits unchanged computations. The program Differences is computed using a combination of program slices. The second algorithm identifies test cases for which Certified and Modified produce the same output and existing test cases that test new components in Modified. The algorithm is based on the notion of common execution patterns. Program components with common execution patterns have the same execution pattern during some call to their procedure. They are computed using a calling context slice. Whereas an interprocedural slice includes the program components necessary to capture all possible executions of a statement, a calling context slice includes only those program components necessary to capture the execution of a statement in a particular calling context. Together with Differences, it is possible to test Modified by running Differences on a smaller number of test cases. This is more efficient than running Modified on a large number of test cases. A prototype implementation has been built to examine and illustrate these algorithms     

基于Petri网的FMS物流系统建模与仿真

在建立FMS物流系统Petri网模型的基础上,采用“映射”思想,将Petri网模型转化为物流系统的仿真程序,提出了库所映射为程序数据、变迁映射为程序函数、系统子网映射为FMS系统基本类的映射方法,通过实例仿真验证了软件程序与模型的一致性。