The Computer Journal Advance Access published online on April 27, 2009
The Computer Journal, doi:10.1093/comjnl/bxp033
Program Analysis Probably Counts
1 Department of Computer Science, University of Verona, Ca Vignal 2 - Strada le Grazie 15, I-37134 Verona, Italy
2 Department of Computing, Imperial College London, 180 Queen's Gate, London SW7 2AZ, UK
* Corresponding author: clh{at}doc.ic.ac.uk
Received 9 March 2009; revised 9 March 2009
Semantics-based program analysis uses an abstract semantics of programs/systems to statically determine run-time properties. Classic examples from compiler technology include analyses to support constant propagation and constant folding transformations and estimation of pointer values to prevent buffer overruns. More recent examples include the estimation of information flows (to enforce security constraints) and estimation of non-functional properties such as timing (to determine worst case execution times in hard real-time applications). The classical approaches are based on semantics involving discrete mathematics. Paralleling trends in model-checking, there have been recent moves towards using probabilistic and quantitative methods in program analysis. In this paper we start by reviewing both classical and probabilistic/quantitative approaches to program analysis. We shall provide a comparison of the two approaches. We shall use a simple information flow analysis to exemplify the classical approach. The existence of covert information flows through timing channels are difficult to detect using classical techniques; we show how such problems can be addressed using probabilistic techniques.
Key Words: program analysis semantics abstract interpretation