Lecture: deviant behavior

Bugs as Deviant Behavior: A General Approach to Inferring Errors in Systems Code, SOSP 2001

Discussion lead: Ellis Michael

Questions

• What two methods for bug finding do the authors present? That is, what is the difference between a MUST and MAY belief?

• Briefly describe how statistical analysis works. What are the possible downsides to this approach?

• Pick one of the templates the authors present and describe it. What manual annotation is required? What does a representative bug look like?

• Provide a list of questions you want to discuss in class.

Overview

• bug finding
  • popular topic in systems, PL, SE, security
  • from Exokernel, metacompiler, to follow up work (machine learning, model checking, etc.)
  • impact
    • e.g., Coverity, sparse
    • annotations: e.g., Linux
  • key question: what’s the heuristics/groud truth/invariant and why
• terminology
  • static/dynamic analysis
  • false positive/negative, sound/complete
  • flow/context/path sensitivity
    • summary-based vs. clone based