Sip4J: Statically Inferring Access Permission Contracts for Parallelising Sequential Java Programs
Tue 12 Nov 2019 17:30 - 17:40 at Hillcrest - Security Chair(s): Julia Rubin
This paper presents Sip4J, a fully automated, scalable and effective tool to automatically generate access permission contracts for a sequential Java program. The access permission contracts, which represent the dependency of code blocks, have been frequently used to enable concurrent execution of sequential programs. Those permission contracts, unfortunately, need to be manually created by programmers, which is known to be time- consuming, laborious and error-prone. To mitigate those manual efforts, Sip4J performs inter-procedural static analysis of Java source code to automatically extract the implicit dependencies in the program and subsequently leverages them to automatically generate access permission contracts, following the Design by Contract principle. The inferred specifications are then used to identify the concurrent (immutable) methods in the program. Experimental results further show that Sip4J is useful and effective towards generating access permission contracts for sequential Java programs.
Tue 12 Nov
16:00 - 16:20 Talk | Performance-Boosting Sparsification of the IFDS Algorithm with Applications to Taint AnalysisACM SIGSOFT Distinguished Paper Award Dongjie HeUniversity of New South Wales; Institute of Computing Technology, CAS; University of Chinese Academy of Sciences, Haofeng LiInstitute of Computing Technology, CAS; University of Chinese Academy of Sciences, Lei WangInstitute of Computing Technology, Chinese Academy of Science, Haining MengInstitute of Computing Technology, CAS; University of Chinese Academy of Sciences, Hengjie ZhengInstitute of Computing Technology, CAS; University of Chinese Academy of Sciences, Jie LiuUniversity of New South Wales, Shuangwei Huvivo AI Lab, Lian LiInstitute of Computing Technology at Chinese Academy of Sciences, China, Jingling XueUNSW Sydney | |||||||||||||||||||||||||||||||||||||||||
16:20 - 16:40 Talk | Characterizing Android App Signing Issues Haoyu WangBeijing University of Posts and Telecommunications, China, Hongxuan LiuPeking University, Xusheng XiaoCase Western Reserve University, Guozhu MengInstitute of Information Engineering, Chinese Academy of Sciences, Yao GuoPeking University | |||||||||||||||||||||||||||||||||||||||||
16:40 - 17:00 Talk | OAuthLint: An Empirical Study on OAuth Bugs in Android Applications Tamjid Al RahatUniversity of Virginia, Yu FengUniversity of California, Santa Barbara, Yuan TianUniversity of Virginia Pre-print | |||||||||||||||||||||||||||||||||||||||||
17:00 - 17:20 Talk | Are Free Android App Security Analysis Tools Effective in Detecting Known Vulnerabilities? Link to publication DOI Pre-print Media Attached | |||||||||||||||||||||||||||||||||||||||||
17:20 - 17:30 Demonstration | SWAN_ASSIST: Semi-Automated Detection of Code-Specific, Security-Relevant Methods Goran PiskachevFraunhofer IEM, Lisa Nguyen Quang DoGoogle, Oshando JohnsonFraunhofer IEM, Eric BoddenHeinz Nixdorf Institut, Paderborn University and Fraunhofer IEM Pre-print Media Attached File Attached | |||||||||||||||||||||||||||||||||||||||||
17:30 - 17:40 Demonstration | Sip4J: Statically Inferring Access Permission Contracts for Parallelising Sequential Java Programs Ayesha SadiqMonash University, Li LiMonash University, Australia, Yuan-Fang LiMonash University, Ijaz AhmedUniversity of Lahore, Sea LingMonash University |
Thu 14 Nov
10:00 - 10:40 Demonstration | PraPR: Practical Program Repair via Bytecode Mutation | |||||||||||||||||||||||||||||||||||||||||
10:00 - 10:40 Demonstration | Kotless: a Serverless Framework for Kotlin Vladislav TankovJetBrains, ITMO University, Yaroslav GolubevJetBrains Research, ITMO University, Timofey BryksinJetBrains Research, Saint-Petersburg State University | |||||||||||||||||||||||||||||||||||||||||
10:00 - 10:40 Demonstration | PeASS: A Tool for Identifying Performance Changes at Code Level David Georg ReicheltUniversität Leipzig, Stefan KühneUniversität Leipzig, Wilhelm HasselbringKiel University Pre-print Media Attached File Attached | |||||||||||||||||||||||||||||||||||||||||
10:00 - 10:40 Demonstration | MutAPK: Source-Codeless Mutant Generation for Android Apps Camilo Escobar-VelásquezUniversidad de los Andes, Michael Osorio-RiañoUniversidad de los Andes, Mario Linares-VásquezSystems and Computing Engineering Department , Universidad de los Andes , Bogotá, Colombia | |||||||||||||||||||||||||||||||||||||||||
10:00 - 10:40 Demonstration | CocoQa: Question Answering for Coding Conventions over Knowledge Graphs Tianjiao DuShanghai JiaoTong University, Junming CaoShanghai JiaoTong University, Qinyue WuShanghai JiaoTong University, Wei LiShanghai JiaoTong University, Beijun ShenSchool of Electronic Information and Electrical Engineering, Shanghai Jiao Tong University, Yuting ChenShanghai Jiao Tong University | |||||||||||||||||||||||||||||||||||||||||
10:00 - 10:03 Demonstration | Humanoid: A Deep Learning-based Approach to Automated Black-box Android App Testing Yuanchun LiPeking University, Ziyue YangPeking University, Yao GuoPeking University, Xiangqun ChenPeking University | |||||||||||||||||||||||||||||||||||||||||
10:00 - 10:40 Demonstration | Developer Reputation Estimator (DRE) Sadika AmreenUniversity of Tennessee Knoxville, Andrey KarnauchUniversity of Tennessee Knoxville, Audris MockusUniversity of Tennessee - Knoxville | |||||||||||||||||||||||||||||||||||||||||
10:00 - 10:40 Demonstration | NeuralVis: Visualizing and Interpreting Deep Learning Models Xufan ZhangState Key Laboratory for Novel Software Technology Nanjing University, Nanjing, China, Ziyue YinState Key Laboratory for Novel Software Technology Nanjing University, Nanjing, China, Yang FengUniversity of California, Irvine, Qingkai ShiHong Kong University of Science and Technology, Jia LiuState Key Laboratory for Novel Software Technology Nanjing University, Nanjing, China, Zhenyu ChenNanjing University | |||||||||||||||||||||||||||||||||||||||||
10:00 - 10:40 Demonstration | Visual Analytics for Concurrent Java Executions Cyrille ArthoKTH Royal Institute of Technology, Sweden, Monali PandeKTH Royal Institute of Technology, Qiyi TangUniversity of Oxford | |||||||||||||||||||||||||||||||||||||||||
10:00 - 10:40 Demonstration | Sip4J: Statically Inferring Access Permission Contracts for Parallelising Sequential Java Programs Ayesha SadiqMonash University, Li LiMonash University, Australia, Yuan-Fang LiMonash University, Ijaz AhmedUniversity of Lahore, Sea LingMonash University | |||||||||||||||||||||||||||||||||||||||||
10:00 - 10:40 Demonstration | SWAN_ASSIST: Semi-Automated Detection of Code-Specific, Security-Relevant Methods Goran PiskachevFraunhofer IEM, Lisa Nguyen Quang DoGoogle, Oshando JohnsonFraunhofer IEM, Eric BoddenHeinz Nixdorf Institut, Paderborn University and Fraunhofer IEM Pre-print Media Attached File Attached | |||||||||||||||||||||||||||||||||||||||||
10:00 - 10:40 Demonstration | VisFuzz: Understanding and Intervening Fuzzing with Interactive Visualization Chijin ZhouTsinghua University, Mingzhe WangTsinghua University, Jie LiangTsinghua University, Zhe LiuNanjing University of Aeronautics and Astronautics, Chengnian SunWaterloo University, Yu JiangTsinghua University |