Cloning-based context-sensitive pointer alias analysis using binary decision diagrams

By John Whaley, Monica S. Lam. ACM-SIGPLAN Symposium on Programming Language Design and Implementation, 2004

662 citations recorded by the source corpus.

Subfields: Artificial Intelligence, Computational Theory and Mathematics, Software

View Paper: https://www.semanticscholar.org/paper/6df5140b9ba8e109132166a35ec850d811190c14

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computational Theory and Mathematics

In Software

Citations in the corpus

Declarative networking: language, execution and optimization (2006, background): “There are other contemporary examples from outside the traditional database “market”, including software analysis [37], trust management [6] and diagnosis of distributed systems [2].”
Refinement-based context-sensitive points-to analysis for Java (2006, neutral): “, [9, 43]), increasing scalability at the cost of precision.”
TAJ: effective taint analysis of web applications (2009, methodology): “Their analysis requires prior computation of Whaley and Lam’s flow-insensitive, contextsensitive may-points-to analysis, based on Binary Decision Diagrams (BDDs) [40].”
Software model checking (2009, neutral): “the precision-scalability spectrum [Andersen 1994; Steensgard 1996; Hind 2001; Whaley and Lam 2004; Hardekopf and Lin 2007].”
Sound and precise analysis of web applications for injection vulnerabilities (2007, background): “Livshits and Lam [17] used a precise points-to analysis for Java [30] and queries specified in PQL [16] to find paths in Java programs that allow “raw” input to flow into SQL queries.”
Static Detection of Security Vulnerabilities in Scripting Languages (2006, methodology): “The algorithm uses a BDDbased context-sensitive pointer analysis [ 19 ] to find potential flow from untrusted sources (e.g., user input) to trusting sinks (e.g., SQL queries).”
Finding application errors and security flaws using PQL: a program query language (2005, neutral): “[60] J. Whaley, M. Martin, and M. S. Lam.”
The essence of command injection attacks in web applications (2006, methodology): “In pa rticular, there are two recent techniques using static analysis to tra ck he flow of untrusted input through a program: one based on a type system [15] (similar to CQual [10]) and one based on a pointsto analysis [24] (using a precise points-to analysis for Jav a [43] and policies specified in”
Static detection of cross-site scripting vulnerabilities (2008, background): “Livshits and Lam [17] used a precise points-to analysis for Java [26] and queries specified in PQL [16] to find paths in Java programs that allow “raw” input to flow into HTML output, file paths, and SQL queries.”
A user-guided approach to program analysis (2015, methodology): “Datalog has been shown to suﬃce for expressing a variety of analyses, including pointer and call-graph analyses [7,40,41,44], concurrency analyses [30,31], security analyses [11,27], and reﬂection analysis [25].”
Saner: Composing Static and Dynamic Analysis to Validate Sanitization in Web Applications (2008, background): “Their analysis is based on binary decision diagrams, and was used by Livshits and Lam [22] for the detection of taint-style vulnerabilities.”
Semantic code search via equational reasoning (2020, methodology): “There are also several Datalog-based program analysis tools whose query engines may be used for code search [46, 83, 87].”
Strictly declarative specification of sophisticated points-to analyses (2009, methodology): “We discussed the relation to Whaley s work on context-sensitive pointer analysis using Datalog and BDDs [29] throughout this paper.”
Pixy: a static analysis tool for detecting Web application vulnerabilities (2006, methodology): “Livshits and Lam [15] applied an analysis supported by binary decision diagrams presented in [24] for finding security vulnerabilities in Java applications.”
Pick your contexts well: understanding object-sensitivity (2011, methodology): “Additionally, Doop employs an explicit representation of relations, listing all the elements of tuples of related elements explicitly, as opposed to employing Binary Decision Diagrams (BDDs), which have often been used in points-to analysis [7, 8, 22, 23 ].”