Nec Laboratories America, Inc.

Nec Corporation

Google Inc.

Franjo Ivancic

Aarti Gupta

Sriram Sankaranarayanan

Malay K Ganai

Gogul Balakrishnan

Naoto Maeda

Zijiang Yang

Domagoj Babic

László Szekeres

Guofei Jiang

Pranav N Ashar

Khalil Ghorbal

Ilya Shlyakhter

Omer Tripp

Hui Joyce Zhang

Wei Wang

Junghwan Rhee

Nipun Arora

Srihari Cadambi

Vineet Kahlon

Chao Wang

Nishant Sinha

William Robert Harris

Behnaz Arzani

Stefan Bucur

Timothy King

Markus Kusano

Sam Kerner

Himanshu Jain

Aleksandr Zaks

Truong X Nghiem

Sicun Gao

Jing Yang

Prakash Prabhu

Parasara Sridhar Duggirala

Richard Chang

Hui Zhang

Aspects of the disclosure provide for automatically generating patches for security violations. For example, a plurality of inputs may be generated for code. The code may be executed using the plurality of inputs to obtain execution states at a plurality of code locations. The execution states may include at least one security violation for at least some of the plurality of inputs. Using the execution states, one or more patch conditions causing the at least one security violation may be determined. Using the execution states, one or more corresponding patch locations may be determined based on a code location of the plurality of code locations where the at least one security violation each of the one or more patch conditions occurred. At least one candidate patch for the at least one security violation may be automatically generated. The at least one candidate patch may include one of the patch conditions and one of the corresponding patch locations.

Automatic generation of patches for security violations

A system and method are provided for testing the performance of applications. By way of example only, the method may include training a neural network with documents containing text elements that are arranged in accordance with a defined format and using the neural network to determine the predictability of the value of individual text elements within a test document. When the neural network indicates that the value of a text element is unlikely, the value may be modified and the modified document may be used to test an application that processes documents in accordance with the defined format.

Testing applications with a defined input format

Methods and systems for finding a packet's routing path in a network includes intercepting control messages sent by a controller to one or more switches in a software defined network (SDN). A state of the SDN at a requested time is emulated and one or more possible routing paths through the emulated SDN is identified by replaying the intercepted control messages to one or more emulated switches in the emulated SDN. The one or more possible routing paths correspond to a requested packet injected into the SDN at the requested time.

Offline queries in software defined networks

A system and method for analyzing a computer program includes performing a static analysis on a program to determine property correctness. Test cases are generated and conducted to provide test output data. Hypotheses about aspects of execution of the program are produced to classify paths for test cases to determine whether the test cases have been encountered or otherwise. In accordance with the hypothesis, new test cases are generated to cause the program to exercise behavior which is outside of the encountered test cases.

Software testing using machine learning

Systems and methods for model checking of live systems are shown that include learning an interval discrete-time Markov chain (IDTMC) model of a deployed system from system logs; and checking the IDTMC model with a processor to determine a probability of violating one or more probabilistic safety properties. Checking the IDTMC model includes calculating a linear part exactly using affine arithmetic; and over-approximating a non-linear part using interval arithmetic.

Probabilistic model checking of systems with ranged probabilities

A computer implemented program analysis method employing a set of new abstract domains applicable to non-convex invarients. The method analyzes programs statically using abstract interpretation while advantageously considering non-convex structures and in particular those situations in which an internal region of an unreachable state exists within a larger region of reachable states. The method employs a new set of non-convex domains (donut domains) based upon the notion of an outer convex region of reachable states (Domain D) and an inner region of unreachable states (Domain D) which advantageously permits capture of non-convex properties by using convex regions and operations.

Donut domains&#x2014;efficient non-convex domains for abstract interpretation

An interprocedural exception analysis and transformation framework for computer programming languages such as C++ that (1) captures the control-flow induced by exceptions precisely, and (2) transforms the given computer program into an exception-free program that is amenable for precise static analysis, verification, and optimizations.

Interprocedural exception method

A scalable, computer implemented method for finding subtle flaws in software programs. The method advantageously employs 1) scope bounding which limits the size of a generated model by excluding deeply-nested function calls, where the scope bounding vector is chosen non-monotonically, and 2) automatic specification inference which generates constraints for functions through the effect of a light-weight and scalable global analysis. Advantageously, scalable software model checking is achieved while at the same time finding more bugs.

Scope bounding with automated specification inference for scalable software model checking

A model is provided for transforming a program with a priori given class hierarchy that is induced by inheritance. An inheritance remover is configured to remove inheritance from a given program to produce an analysis-friendly program which does not include virtual-function pointer tables and runtime libraries associated with inheritance-related operations. The analysis-friendly program preserves the semantics of the given program with respect to a given class hierarchy. A clarifier is configured to identify implicit expressions and function calls and transform the given program into at least one intermediate program having explicit expressions and function calls.

Embedding class hierarchy into object models for multiple class inheritance

A system and method for solving a decision problem having Boolean combinations of linear and non-linear operations includes translating the non-linear real operations using a COordinate Rotation DIgital Computer (CORDIC) method programmed on a computer device into linear operations maintaining a given accuracy. Linear and translated linear operations are combined into a formula. Satisfiability of the formula is solved using a decision procedure for Boolean combinations of linear operations over integers and reals.

Efficient decision method for real non-linear arithmetic constraints

A system and method for deciding the satisfiability of a non-linear real decision problem is disclosed. Linear and non-linear constraints associated with the problem are separated. The feasibility of the linear constraints is determined using a linear solver. The feasibility of the non-linear constraints is determined using a non-linear solver which employs interval constraint propagation. The interval solutions obtained from the non-linear solver are validated using the linear solver. If the solutions cannot be validated, linear constraints are learned to refine a search space associated with the problem. The learned constraints and the non-linear constraints are iteratively solved using the non-linear solver until either a feasible solution is obtained or no solution is possible.

Integrating interval constraint propagation with nonlinear real arithmetic

Methods and systems for verifying the precision of a program that utilizes floating point operations are disclosed. Interval and affine arithmetic can be employed to build a model of the program including floating point operations and variables that are expressed as reals and integers, thereby permitting accurate determination of precision loss using a model checker. Abstract interpretation can be also employed to simplify the model. In addition, counterexample-guided abstraction refinement can be used to refine the values of parametric error constants introduced in the model.

Systems and methods for model checking the precision of programs employing floating-point operations

Systems and methods are disclosed to verify a program by symbolically enumerating path programs; verifying each path program to determine if the path program is correct or leads to a violation of a correctness property; determining a conflict set from the path program if the path program is proved correct; using the conflict set to avoid enumerating other related path programs that are also correct.

Program verification through symbolic enumeration of control path programs

A system and method for generating test vectors includes generating traces of a system model or program stored in memory using a simulation engine. Simulated inputs are globally optimized using a fitness objective computed using a computer processing device. The simulation inputs are adjusted in accordance with feedback from the traces and fitness objective values by computing a distance between the fitness objective value and a reachability objective. Test input vectors are output based upon optimized fitness objective values associated with the simulated inputs to test the system model or program stored in memory.

Growing community of inventors

Princeton, NJ, United States of America

Franjo Ivancic