Extending logical attack graphs for efficient vulnerability analysis
Proceedings of the 15th ACM conference on Computer and communications security
ANDROMEDA: accurate and scalable security analysis of web applications
FASE'13 Proceedings of the 16th international conference on Fundamental Approaches to Software Engineering
| Hi-index | 0.00 |
Tabled logic programming has emerged as an important evaluation technique of logic programs. Tabling has enabled us to construct many practical applications—program analysis and verification systems in particular—by encoding them as high-level logic programs. Tabled resolution based systems evaluate programs by memoizing subgoals (referred to as calls) and their provable instances (answers). In this thesis we address the problem of efficiently updating the memoized information in tables with respect to the changes in programs due to addition/deletion of facts/rules. Such capability of incremental maintenance of memoized information facilitates the use of tabled logic programming for scalable program analysis, where the analysis information can be updated efficiently in response to small changes to the analyzed program.Tabled resolution based systems process the addition of facts in semi-naive fashion and thus incremental by nature. We address the problem of maintaining tables for definite logic programs in response to deletion of facts/rules by maintaining an auxiliary and-or data structure called support graph. Each support in a support graph represents an immediate reason for derivation of an answer. Support graph thus maintains the dependency between answers and facts, and can be used to propagate the effect of deletion of facts/rules. We developed heuristics to reduce the over-approximation performed by existing algorithms for handling deletion.Support graph based algorithms update tables extremely fast but impose considerable space overhead for large applications. Our general solution to space-overhead problem is based on a data structure called Partial Support Graph (PSG) which keeps bounded number of supports for every answer. For a special class of programs we present a more efficient algorithm than PSG, based on a compact data structure called Symbolic Support Graph which exploits the commonality between supports.We also present an efficient algorithm for handling updates to the facts by carefully interleaving the insertion and deletion operations generated by updates. We present an incremental tabled maintenance algorithm for handling programs with negation, cuts, and aggregation operators. We demonstrate the efficiency of incremental computation to various problems such as pointer analysis, data-flow analysis, push-down model checking, parsing, dynamic programming, and XML validation.