Context-sensitivity is essential for achieving good precision in inter-procedural static
analysis. To be context-sensitive, top-down analysis needs to fully inline all the statements in …

An important, but often neglected, goal of static analysis for detecting bugs is the ability to
show defects to the programmer quickly. Unfortunately, existing static analysis tools scale …

Sophisticated static analysis techniques often have complicated implementations, much of
which provides logic for tuning and scaling rather than basic analysis functionalities. This …

Interprocedural static analyses are broadly classified into top-down and bottom-up,
depending upon how they compute, instantiate, and reuse procedure summaries. Both kinds …

In this paper we present the design and implementation of a distributed, whole-program
static analysis framework that is designed to scale with the size of the input. Our approach is …

As software development teams adopt DevSecOps practices, application security is
increasingly the responsibility of development teams, who are required to set up their own …

In the past years, the CWE-190 integer overflow led to many vulnerabilities. Program
verification techniques such as Abstract Interpretation can show that no such bug is present …

静态程序分析发展至今, 已在多个方面取得了长足的进步, 应用于软件开发的众多方面.
但对现代大规模复杂软件系统 (如千万行代码规模的 Linux 操作系统, 分布式大数据处理系统 …

Bottom-up program analysis has been traditionally easy to parallelize because functions
without caller-callee relations can be analyzed independently. However, such function-level …

There is more than a decade-long history of using static analysis to find bugs in systems
such as Linux. Most of the existing static analyses developed for these systems are simple …