Fast and precise points-to analysis

Many software engineering applications require points-to analysis. These client applications range from optimizing compilers to integrated program development environments (IDEs) and from testing environments to reverse-engineering tools. Moreover, software engineering applications used in an edit-compile cycle need points-to analysis to be fast and precise.In this article, we present a new context- and flow-sensitive approach to points-to analysis where calling contexts are distinguished by the points-to sets analyzed for their call target expressions. Compared to other well-known context-sensitive techniques it is faster in practice, on average, twice as fast as the call string approach and by an order of magnitude faster than the object-sensitive technique. In fact, it shows to be only marginally slower than a context-insensitive baseline analysis. At the same time, it provides higher precision than the call string technique and is similar in precision to the object-sensitive technique. We confirm these statements with experiments using a number of abstract precision metrics and a concrete client application: escape analysis.     

源代码分析技术的理论与实践发展

源代码分析技术对于软件安全缺陷分析是一项非常重要的手段.分析了软件源代码分析工具的技术手段和发展过程,最后对源代码分析的理论和实践进行了分析总结.     

C语言的别名分析方法研究

别名分析对于数据流分析、程序优化和分析工具的实现非常重要.文章提出了一种需求驱动,流非敏感的分析算法来解决指针别名问题.通过构造程序表达式图(PEG)把指针别名问题转化成判断两个指针节点是否是联通的问题,它不同于传统的别名分析方法,它不需要构造别名集合和对其求交集,所以提高了分析指针别名的效率.     

The use of protocol analysis for determining ability requirements for personnel selection on a computer-based task

Abstract

The role of cognitively oriented tasks in the workplace continues to increase as automation of physical task components advances. Difficulties in automating the operator's cognitive processes have placed a renewed emphasis on the human component in advanced manufacturing systems. While traditional task analysis techniques have made significant contributions to improving productivity when important task elements are visually observable, their focus on manual task procedures make them less effective for cognitively oriented activities. This research has made a first attempt at integrating techniques from several disciplines to develop a cognitive task analysis methodology. The utility of this combined approach is examined for a new system being tested in the United States Postal Service. This task requires operators to encode, via a keyboard, addresses presented on a video display terminal. Results support the hypothesis that, for cognitively oriented tasks, a consensus based analysis technique (the Position Analysis Questionnaire) can be significantly improved by including data from task analysis provided the methodology is suitable for identifying non-physical task components.     

A system to assist survey analysts

The researcher who knows little about computers but wants to conduct a survey and analyse the results by computer can land himself in some difficulty if he does not appreciate some of the problems of computerization. This paper describes a system which is designed to aid such a person by providing assistance with the design of the questionnaire, the capturing of the data and the final analyses.     

A novel analysis space for pointer analysis and its application for bug finding

The size of today’s programs continues to grow, as does the number of bugs they contain. Testing alone is rarely able to flush out all bugs, and many lurk in difficult-to-test corner cases. An important alternative is static analysis, in which correctness properties of a program are checked without running it. While it cannot catch all errors, static analysis can catch many subtle problems that testing would miss.We propose a new space of abstractions for pointer analysis—an important component of static analysis for C and similar languages. We identify two main components of any abstraction—how to model statement order and how to model conditionals, then present a new model of programs that enables us to explore different abstractions in this space. Our assign-fetch graph represents reads and writes to memory instead of traditional points-to relations and leads to concise function summaries that can be used in any context. Its flexibility supports many new analysis techniques with different trade-offs between precision and speed.We present the details of our abstraction space, explain where existing algorithms fit, describe a variety of new analysis algorithms based on our assign-fetch graphs, and finally present experimental results that show our flow-aware abstraction for statement ordering both runs faster and produces more precise results than traditional flow-insensitive analysis.     

基于因子分析法和聚类分析法的副省级城市宜居情况聚类评价

重点选取了15个副省级城市的第一产业比重、人口密度、人均绿地、园林面积、医院数目,市政建设面积、地方财政税收等42个指标,使用SPSS作为计算工具,使用因子分析方法简化评价指标,计算相关系数矩阵,判别因子分析可行性,利用主成分分析法求因子载荷,将因子进行旋转得出更有实际意义的因子解释,并计算因子得分,利用该结果计算Mi...     

Cost analysis of object-oriented bytecode programs

Cost analysis statically approximates the cost of programs in terms of their input data size. This paper presents, to the best of our knowledge, the first approach to the automatic cost analysis of object-oriented bytecode programs. In languages such as Java and C#, analyzing bytecode has a much wider application area than analyzing source code since the latter is often not available. Cost analysis in this context has to consider, among others, dynamic dispatch, jumps, the operand stack, and the heap. Our method takes a bytecode program and a cost model specifying the resource of interest, and generates cost relations which approximate the execution cost of the program with respect to such resource. We report on COSTA, an implementation for Java bytecode which can obtain upper bounds on cost for a large class of programs and complexity classes. Our basic techniques can be directly applied to infer cost relations for other object-oriented imperative languages, not necessarily in bytecode form.     

数据分析需求与实现

数据分析是从海量数据中发现隐含信息或知识的过程。基于一个公安破案辅助数据分析系统,深入研究数据分析任务的需求与实现,提出首先规划分析思路、细化分析功能,然后用多视角数据透视和智能分析两种手段,从微观与宏观、定量与定性等不同角度互为补充地使系统具有完备的分析功能。该研究对如何开发具有实用价值的数据分析系统有普遍的指导意义。     

代谢组学数据处理研究的进展

代谢组学是继基因组学和蛋白质组学之后,于上世纪90年代新近发展起来的一个新的科学研究热点.代谢组学数据往往非常复杂,因此数据处理已经成为代谢组学研究中的关键技术和瓶颈之一.本文按照代谢组学数据预处理一代谢物靶标分析和代谢轮廓分析中的数据处理-代谢指纹分析中的数据处理的线索,评述国内外在代谢组学数据处理方面的最新进展,并介绍代谢组学数据处理软件.     

Subroutine Inlining and Bytecode Abstraction to Simplify Static and Dynamic Analysis

In Java bytecode, intra-method subroutines are employed to represent code in “finally” blocks. The use of such polymorphic subroutines within a method makes bytecode analysis very difficult. Fortunately, such subroutines can be eliminated through recompilation or inlining. Inlining is the obvious choice since it does not require changing compilers or access to the source code. It also allows transformation of legacy bytecode. However, the combination of nested, non-contiguous subroutines with overlapping exception handlers poses a difficult challenge. This paper presents an algorithm that successfully solves all these problems without producing superfluous instructions. Furthermore, inlining can be combined with bytecode simplification, using abstract bytecode. We show how this abstration is extended to the full set of instructions and how it simplifies static and dynamic analysis.     

VCG-CARD心电向量图图形自动分析识别系统

一、概述心电向量图(简称VCG)是在人体表面检测心电活动信号而构成的一种图形,是一种二维的正交心电图.对VCG检查已成为一种心脏的常规辅助诊断手段.由于VCG数据人工测量较麻烦,有些参数,如各瞬间向量、面积等甚至不能用人工方法获得.为此研制了VCG自动分析诊断系统VCG-CARD,它是一个实时的自动系统.主要硬件包括日本VA3G型向量图仪、VCG接口电路和IBM-PC.设计中充分利用了VA3G内部的6K字节存贮器,将这6K字节心电信号通过接口电路转存到PC指定内存区,节省了A/D变换的软硬件开销. 本文着重阐述该系统的图形分析识别算法.有关诊断模型方面问题见文献[1].     

动态指令流差分分析在恶意软件分析中的应用*

针对静态分析方法已不能满足安全分析的需求,而传统的动态分析技术不能快速定位关键信息,且分析效率不高,提出了一种动态指令流差分分析技术,描述了差分分析模型和分析方法。该分析技术能够高速有效地分析恶意软件的关键数据,识别加密算法,分析混淆代码的功能模块和数据扩散情况。通过实验对其可行性和高效性进行了验证。     

功耗分析仿真软件设计与实现

设计并自主开发一个功耗分析仿真软件,完成对硬件描述语言实现的密码算法IP核进行功耗仿真分析。用软件仿真功耗分析攻击,可以在嵌入式加密芯片的设计阶段评估设计方案和抗功耗分析攻击的性能,提高工作效率,降低开发时间和成本,具有很高的实用价值。该软件已经实现了几种常用密码算法及其改进后加密算法的一阶功耗分析和高阶功耗分析功能。经测试得到的仿真结果与理论分析出来的攻击结果相符合,实现了本软件的设计目标。     

犯罪情报分析中的数据挖掘应用

本文基于公安业务中的治安防控原理,构建了面向情报分析和决策指挥的犯罪情报数据挖掘框架.首先,对案事件数据库进行预处理和空间编码的基础上得到标准化的案件信息数据,随后,利用聚类分析、关联分析和分类分析中的相关方法可得到治安案件的时空风险、重点人特征和作案手段特征等信息.通过对北京市实际盗窃案件数据进行挖掘,证明了数据挖掘技术能够很好的应用于犯罪情报的分析.     

一种面向向量化的动态指针别名分析框架

指针别名分析是数据流分析中的关键性技术,其分析结果是编译优化和程序变换的基础.在向量化方法和动态指针别名分析相关研究的基础上,设计了一种面向向量化的动态指针别名分析框架.该框架通过动态插桩和试运行提取指针别名信息,并反馈到向量化阶段指导向量化代码生成.从提取候选别名分析集、插桩及试运行和反馈优化3个方面对整体框架进行分析和研究.该框架基于Open64实现,并以通用测试集GCC-VECT和典型应用进行了实验评估,结果表明,该框架相比静态指针别名分析具有更精确的别名分析结果,该结果能够有效改进向量化程序的加速比.     

基于静态分析技术的源代码安全检测模型*

介绍了当前主流的静态代码分析技术,在分析讨论其优缺点的基础上提出了一种新的静态代码检测模型。该模型结合了当前成熟的静态分析技术,并借鉴了编译器中数据流和控制流分析的思想,获取上下文关联的数据信息,从而更加准确地分析代码中存在的安全问题。     

一种改进的基于在线解耦的轻量级动态污点分析方法

在针对二进制程序的实际分析场景中,动态分析方法因具有更高的准确性而得到更为广泛的关注和运用.但是以动态污点分析为代表的细粒度分析方法通常会产生较高的性能和资源开销.为缓解这些问题,本文提出一种改进的轻量级在线解耦的动态污点分析方法,其主要思想是在线解耦程序执行和指令分析,同步构建分析代码并完成分析.该方法能够进一步降低对目标程序运行时的性能影响,并易将分析过程迁移至其它上下文环境中,从而可进一步减小对目标程序运行环境的干扰.本文通过采用多种实际程序进行实验,结果表明该方法能够比传统在线污点分析具有更高的分析性能,并具有较低的系统资源消耗,易于在实际环境中进行部署和应用.     

Exploratory factor analysis revisited: How robust methods support the detection of hidden multivariate data structures in IS research

Exploratory factor analysis is commonly used in IS research to detect multivariate data structures. Frequently, the method is blindly applied without checking if the data fulfill the requirements of the method. We investigated the influence of sample size, data transformation, factor extraction method, rotation, and number of factors on the outcome. We compared classical exploratory factor analysis with a robust counterpart which is less influenced by data outliers and data heterogeneities. Our analyses revealed that robust exploratory factor analysis is more stable than the classical method.