Self-optimizing Static Program Analysis
Abstract:
Software systems pervade our personal and professional lives, yet their insecurity threaten our society. To assure that software systems are dependable and secure, one must reason about their code. Static program analysis enables such reasoning. It can be applied to individual software components, and it can show not only the presence but also prove the absence of bugs and vulnerabilities. Yet, to be useful to software developers, static analyses must be adapted to the context in which they are used. Studies show that poorly adapted analyses slow down rather than assist development. They report large sets of false warnings that distract developers from actual bugs, which the analyses often miss. They often run so long that results are reported when they are already outdated.
In this talk I report on my ERC Advanced Grant on Self-optimizing Static Program Analysis (SOSA). Its research hypothesis is that one can generate precise and efficient static analyses of software systems by making static analysis self-aware and self-optimizing. With SOSA, a static analysis conducts analyses and optimizations not just of programs but of itself. The first ingredient to self-optimization in SOSA is a novel intermediate representation (IR) - not of the analyzed program - but the analysis of that program. Optimization potential for the analysis can be pinpointed directly on the level of this “Abstract IR”, and analysis optimizations are easily expressed as rewrites on the level of this Abstract IR. This mechanism, akin to JIT optimizations in general-purpose virtual machines, allows for instantaneous, online optimizations. The second ingredient becomes important in situation where the analysis struggles analyzing a given program for reasons unknown. In this case, we use Sequential Model-based Optimizations (SMO) to learn configurations of the analysis that will likely do better, at least in subsequent analysis runs.
In this talk I will report on a first design of our Abstract IR “FAIR”, which supports different kinds of analyses of Java programs, and on initial experiments with SMO applied to the off-the-shelve static analyzer FlowDroid.
Bio:
Eric Bodden is one of the leading experts on secure software engineering, with a specialty in building highly precise tools for automated program analysis. He is Professor for Secure Software Engineering at Paderborn University and director for Software Engineering and IT-Security at Fraunhofer IEM, where he is collaborating with the leading national and international software development companies. Bodden is a co-founder of CodeShield, a member of Acatech, der German National Academy of Science and Engineering, as well as a member of the review board on Software Engineering and Programming Languages of the German Science Foundation (DFG).
Prof. Bodden's research has been awarded numerous times. For instance, in 2024 he received an ERC Advanced Grant, and in 2019, Bodden was named ACM Distinguished Member. At the German IT-Security Price, his group scored 1st place in 2016 and 2nd place in 2014. In 2014, the DFG awarded Bodden the Heinz Maier-Leibnitz-Preis, Germany's highest honour for young scientists. Prof. Bodden's research has received six ACM Distinguished Paper Awards and two Most Influential Paper Awards in different communities. In 2020, Bodden was elected to the Working Group 2.4 Software Implementation Technology of the International Federation for Information Processing (IFIP).