Checking secure information flow in Java bytecode by code transformation and standard bytecode verification

A method is presented for checking secure information flow in Java bytecode, assuming a multilevel security policy that assigns security levels to the objects. The method exploits the type‐level abstract interpretation of standard bytecode verification to detect illegal information flows. We define an algorithm transforming the original code into another code in such a way that a typing error detected by the Verifier on the transformed code corresponds to a possible illicit information flow in the original code. We present a prototype tool that implements the method and we show an example of application. Copyright © 2004 John Wiley & Sons, Ltd.     

Mediator模型的SystemC代码自动生成

Mediator是一种基于组件的建模语言,该语言主要通过自动机和系统对模型进行描述。将Mediator语言描述的模型自动生成为可执行代码,可以避免编码过程中由于人为疏忽而造成的错误,从而提高编码的可靠性,同时缩短模型开发周期。介绍一种从Mediator模型到SystemC代码的自动生成工具,该工具旨在将基于特定平台的模型转换为能直接仿真运行的代码。首先对Mediator语言的语法语义进行分析,选择合适的SystemC代码组织形式,然后针对Mediator模型的每一个组成部分 设计生成规则,其中重点对类型生成、状态转移语句生成、同步语句的生成进行分析。最后,通过一个机器掉电检测系统说明该工具运行结果的正确性。     

Lightweight extraction of object models from bytecode

A program's object model captures the essence of its design. For some programs, no object model was developed during design; for others, an object model exists but may be out-of-sync with the code. This paper describes a tool that automatically extracts an object model from the class-files of a Java program. Unlike existing tools, it handles container classes by inferring the types of elements stored in a container and eliding the container itself. This feature is crucial for obtaining models that show the structure of the abstract state and bear some relation to conceptual models. Although the tool performs only a simple, heuristic analysis that is almost entirely local, the resulting object model is surprisingly accurate. The paper explains what object models are and why they are useful; describes the analysis, its assumptions, and limitations; evaluates the tool for accuracy, and illustrates its use on a suite of sample programs     

Polymorphic bytecode instrumentation

Bytecode instrumentation is a widely used technique to implement aspect weaving and dynamic analyses in virtual machines such as the Java virtual machine. Aspect weavers and other instrumentations are usually developed independently and combining them often requires significant engineering effort, if at all possible. In this article, we present polymorphic bytecode instrumentation(PBI), a simple but effective technique that allows dynamic dispatch amongst several, possibly independent instrumentations. PBI enables complete bytecode coverage, that is, any method with a bytecode representation can be instrumented. We illustrate further benefits of PBI with three case studies. First, we describe how PBI can be used to implement a comprehensive profiler of inter‐procedural and intra‐procedural control flow. Second, we provide an implementation of execution levels for AspectJ, which avoids infinite regression and unwanted interference between aspects. Third, we present a framework for adaptive dynamic analysis, where the analysis to be performed can be changed at runtime by the user. We assess the overhead introduced by PBI and provide thorough performance evaluations of PBI in all three case studies. We show that pure Java profilers like JP2 can, thanks to PBI, produce accurate execution profiles by covering all code, including the core Java libraries. We then demonstrate that PBI‐based execution levels are much faster than control flow pointcuts to avoid interference between aspects and that their efficient integration in a practical aspect language is possible. Finally, we report that PBI enables adaptive dynamic analysis tools that are more reactive to user inputs than existing tools that rely on dynamic aspect‐oriented programming with runtime weaving. These experiments position PBI as a widely applicable and practical approach for combining bytecode instrumentations. © 2015 The Authors. Software: Practice and Experience Published by John Wiley & Sons Ltd.     

Template-based AADL automatic code generation

Embedded real-time systems employ a variety of operating system platforms. Consequently, for automatic code generation, considerable redevelopment is needed when the platform changes. This results in major challenges with respect to the automatic code generation process of the architecture analysis and design language (AADL). In this paper, we propose a method of template-based automatic code generation to address this issue. Templates are used as carriers of automatic code generation rules from AADL to the object platform. These templates can be easily modified for different platforms. Automatic code generation for different platforms can be accomplished by formulating the corresponding generation rules and transformation templates. We design a set of code generation templates from AADL to the object platform and develop an automatic code generation tool. Finally, we take a typical data processing unit (DPU) system as a case study to test the tool. It is demonstrated that the autogenerated codes can be compiled and executed successfully on the object platform.     

Automatically propagating changes from reference implementations to code generation templates

ContextCode generators can automatically perform some tedious and error-prone implementation tasks, increasing productivity and quality in the software development process. Most code generators are based on templates, which are fundamentally composed of text expansion statements. To build templates, the code of an existing, tested and validated implementation may serve as reference, in a process known as templatization. With the dynamics of software evolution/maintenance and the need for performing changes in the code generation templates, there is a loss of synchronism between the templates and this reference code. Additional effort is required to keep them synchronized.ObjectiveThis paper proposes automation as a way to reduce the extra effort needed to keep templates and reference code synchronized.MethodA mechanism was developed to semi-automatically detect and propagate changes from reference code to templates, keeping them synchronized with less effort. The mechanism was also submitted to an empirical evaluation to analyze its effects in terms of effort reduction during maintenance/evolution templatization.ResultsIt was observed that the developed mechanism can lead to a 50% reduction in the effort needed to perform maintenance/evolution templatization, when compared to a manual approach. It was also observed that this effect depends on the nature of the evolution/maintenance task, since for one of the tasks there was no observable advantage in using the mechanism. However, further studies are needed to better characterize these tasks.ConclusionAlthough there is still room for improvement, the results indicate that automation can be used to reduce effort and cost in the maintenance and evolution of a template-based code generation infrastructure.     

Relational bytecode correlations

We present a calculus for tracking equality relationships between values through pairs of bytecode programs. The calculus may serve as a certification mechanism for non-interference, a well-known program property in the field of language-based security, and code transformations. Contrary to previous type systems for non-interference, no restrictions are imposed on the control flow structure of programs. Objects, static and virtual methods are included, and heap-local reasoning is supported by frame rules. In combination with polyvariance, the latter enable the modular verification of programs over heap-allocated data structures, which we illustrate by verifying and comparing different implementations of list copying. The material is based on a complete formalisation in Isabelle/HOL.     

Personalised code generation from large schema sets for geospatial mobile applications

XML and XML Schema are used in the geospatial domain for the definition of standards that enhance the interoperability between producers and consumers of spatial data. The size and complexity of these geospatial standards and their associated schemas have been growing with time reaching levels of complexity that make it difficult to build systems based on them in a timely and cost-effective manner. The problem of producing XML processing code based on large schemas has been traditionally solved by using XML data binding generators. Unfortunately, this solution is not always effective when code is generated for resource-constrained devices, such as mobile phones. Large and complex schemas often result in the production of code with a large size and a complicated structure that might not fit the device limitations. In this article we present the instance-based XML data binding approach to produce more compact application-specific XML processing code for geospatial applications targeted to mobile devices. The approach tries to reduce the size and complexity of the generated code by using information about how schemas are used by individual applications. Our experimental results suggest a significant simplification of XML Schema sets to the real needs of client applications accompanied by a substantial reduction of size of the generated code.     

A systematic review of code generation proposals from state machine specifications

ContextModel Driven Development (MDD) encourages the use of models for developing complex software systems. Following a MDD approach, modelling languages are used to diagrammatically model the structure and behaviour of object-oriented software, among which state-based languages (including UML state machines, finite state machines and Harel statecharts) constitute the most widely used to specify the dynamic behaviour of a system. However, generating code from state machine models as part of the final system constitutes one of the most challenging tasks due to its dynamic nature and because many state machine concepts are not supported by the object-oriented programming languages. Therefore, it is not surprising that such code generation has received great attention over the years.ObjectiveThe overall objective of this paper is to plot the landscape of published proposals in the field of object oriented code generation from state machine specifications, restricting the search neither to a specific context nor to a particular programming language.MethodWe perform a systematic, accurate literature review of published studies focusing on the object oriented implementation of state machine specifications.ResultsThe systematic review is based on a comprehensive set of 53 resources in all, which we have classified into two groups: pattern-based and not pattern-based. For each proposal, we have analysed both the state machine specification elements they support and the means the authors propose for their implementation. Additionally, the review investigates which proposals take into account desirable features to be considered in software development such as maintenance or reusability.ConclusionsOne of the conclusions drawn from the review is that most of the analysed works are based on a software design pattern. Another key finding is that many papers neither support several of the main components of the expressive richness of state machine specifications nor provide an implementation strategy that considers relevant qualitative aspects in software development.     

Integrating code generation and peephole optimization

Summary Peephole optimization when integrated with automatic code generation into a uniform framework has significant advantages in the specification and implementation of efficient compiler back-ends. Attribute grammars provide a framework for expression of machine-specific code optimizations. We present a grammar-driven peephole optimization algorithm that is particularly well suited to attributed-parsing code generators. Integration via semantic attributes corrects interrelated phase-ordering problems and produces a faster and smaller compiler back-end.     

代码注释自动生成研究进展

代码注释作为软件中的重要组成部分,在软件维护、复用等领域中发挥着重要作用。代码注释自动生成技术旨在减轻人工编写注释的工作量,从而提高软件开发效率。现有的注释自动生成方法分为基于规则、文本摘要、数据驱动、主题模型、深度学习等层次。综述了代码注释自动生成的相关概念,对比总结各类代码注释自动生成方法,对近年来代码注释自动生成相关应用进行了梳理和总结,最后对注释自动生成所面临的挑战进行了分析,展望了该领域未来的研究。     

Network generation using the prufer code

This paper describes the development and implementation of an interactive program for generation of generalized (e.g. maximum flow, minimum cost flow, shortest path), tripartite (i.e. transshipment) and bipartite (i.e. transportation and assignment) network problems. The generator is based on the Prufer code which is a numeric code that uniquely characterizes a tree. It has been implemented in BASIC on the IBM PC and makes extensive use of data structures and subroutines in order to promote modularity.     

Integrating code generation and peephole optimization

Summary Peephole optimization when integrated with automatic code generation into a uniform framework has significant advantages in the specification and implementation of efficient compiler back-ends. Attribute grammars provide a framework for expression of machine-specific code optimizations. We present a grammar-driven peephole optimization algorithm that is particularly well suited to attributed-parsing code generators. Integration via semantic attributes corrects interrelated phase-ordering problems and produces a faster and smaller compiler back-end.     

Cost analysis of object-oriented bytecode programs

Cost analysis statically approximates the cost of programs in terms of their input data size. This paper presents, to the best of our knowledge, the first approach to the automatic cost analysis of object-oriented bytecode programs. In languages such as Java and C#, analyzing bytecode has a much wider application area than analyzing source code since the latter is often not available. Cost analysis in this context has to consider, among others, dynamic dispatch, jumps, the operand stack, and the heap. Our method takes a bytecode program and a cost model specifying the resource of interest, and generates cost relations which approximate the execution cost of the program with respect to such resource. We report on COSTA, an implementation for Java bytecode which can obtain upper bounds on cost for a large class of programs and complexity classes. Our basic techniques can be directly applied to infer cost relations for other object-oriented imperative languages, not necessarily in bytecode form.     

A space-efficient code generation scheme for BCPL

This paper presents a methodology in generating space-efficient code for BCPL and BCPL-like programming languages. An intermediate language called ICE was designed which, while preserving those program features salient to translation, also tries to minimize the number of instructions generated. This internal representation is then realized as an actual machine. The encoding scheme (called ES0) is based on usage frequencies of instructions and other real world constraints on machines such as word size and addressing space. Using a large sample of BCPL programs, it is shown that BCODE, which is a realization of OCODE (the intermediate language currently used for BCPL program translation), takes up an average of 32 per cent more space as compared to ICE/ES0.     

Optimising code generation with haggies

This article describes haggies, a program for the generation of optimised programs for the efficient numerical evaluation of mathematical expressions. It uses a multivariate Horner-scheme and Common Subexpression Elimination to reduce the overall number of operations.The package can serve as a back-end for virtually any general purpose computer algebra program. Built-in type inference that allows to deal with non-standard data types in strongly typed languages and a very flexible, pattern-based output specification ensure that haggies can produce code for a large variety of programming languages.We currently use haggies as part of an automated package for the calculation of one-loop scattering amplitudes in quantum field theories. The examples in this articles, however, demonstrate that its use is not restricted to the field of high energy physics.

Program summary

Program title: haggiesCatalogue identifier: AEGF_v1_0Program summary: URL: http://cpc.cs.qub.ac.uk/summaries/AEGF_v1_0.htmlProgram obtainable from: CPC Program Library, Queen's University, Belfast, N. IrelandLicensing provisions: GNU GPL v3No. of lines in distributed program, including test data, etc.: 56 220No. of bytes in distributed program, including test data, etc.: 579 010Distribution format: tar.gzProgramming language: Java, JavaCCComputer: Any system that runs the Java Virtual MachineOperating system: Any system that runs the Java Virtual MachineRAM: Determined by the size of the problemClassification: 4.14, 5, 6.2, 6.5, 11.1Nature of problem: Generation of optimised programs for the evaluation of possibly large algebraic expressionsSolution method: Java implementationRunning time: Determined by the size of the problem     

Malware phylogeny generation using permutations of code

Malicious programs, such as viruses and worms, are frequently related to previous programs through evolutionary relationships. Discovering those relationships and constructing a phylogeny model is expected to be helpful for analyzing new malware and for establishing a principled naming scheme. Matching permutations of code may help build better models in cases where malware evolution does not keep things in the same order. We describe methods for constructing phylogeny models that uses features called n-perms to match possibly permuted codes. An experiment was performed to compare the relative effectiveness of vector similarity measures using n-perms and n-grams when comparing permuted variants of programs. The similarity measures using n-perms maintained a greater separation between the similarity scores of permuted families of specimens versus unrelated specimens. A subsequent study using a tree generated through n-perms suggests that phylogeny models based on n-perms may help forensic analysts investigate new specimens, and assist in reconciling malware naming inconsistencies