We introduce abstract interpretation frameworks which are variations on the archetypal framework using Galois connections between concrete and abstract semantics, widenings and narrowings and are obtained by relaxation of the original hypotheses. We consider various ways of establishing

Dedicated to Zohar Manna, for his 2 6 th birthday. Abstract. Abstract interpretation theory formalizes the idea of abstraction of mathematical structures, in particular those involved in the specification of properties and proof methods of computer systems. Verification by abstract interpretation

Abstract interpretation is a theory of semantics approximation which is usedfor the construction of semantics-basedprogram analysis algorithms (sometimes called“data flow analysis”), the comparison of formal semantics (e.g., construction of a denotational semantics from an operational one

The Problem. A malware is a program with a malicious behaviour, that is designed to replicate with no user consent and to damage software and/or data on infected machines. Malwares are generally classified according to their goals and propagation methods into viruses, worms, backdoors, Trojans, etc. A malware detector is a system that attempts to verify whether a program presents a malicious behaviour or not. The design of efficient malware detectors is crucial for preventing serious damages caused by malware infection. Current malware detectors (e.g. commercial virus scanners) in general rely on static signature matching and, more recently, on dynamic analyses [9]. The dynamic approach executes the potentially infected program in a controlled environment (sandbox) thus performing a run-time verification of malicious behaviours. However, smart malwares may foil a dynamic analysis by modifying their behaviour when executed in a sandbox. Static signature matching classifies a program P as infected by a malware M when an instruction sequence of P matches the characteristic instruction sequence of M. Malware writers frequently use obfuscation to prevent signature matching detection. Code obfuscation [3] consists in syntactically transforming a program while maintaining

The Problem. A malware is a program with a malicious behaviour, that is designed to replicate with no user consent and to damage software and/or data on infected machines. Malware are generally classified according to their goals and propagation methods into viruses, worms, backdoors, Trojans, etc. A malware detector is a system that attempts to verify whether a program presents a malicious behaviour or not. The design of efficient malware detectors is crucial for preventing serious damages caused by malware infection. Current malware detectors (e.g. commercial virus scanners) in general rely on static signature matching and, more recently, on dynamic analyses [9]. The dynamic approach executes the potentially infected program in a controlled environment (sandbox) thus performing a run-time verification of malicious behaviours. However, smart malware may foil a dynamic analysis by modifying their behaviour when executed in a sandbox. Static signature matching classifies a program P as infected by a malware M when an instruction sequence of P matches the characteristic instruction sequence of M. Malware writers frequently use obfuscation to prevent signature matching detection. Code obfuscation [3] consists in syntactically transforming a program while maintaining

We present a logical framework in which abstract interpretations can be naturally specified and then verified. Our approach is based on membership equational logic which extends equational logics by membership axioms, asserting that a term has a certain sort. We represent an abstract interpretation

interpreters over given lattices to construct an abstract interpreter for the combination of those lattices. This lends modularity to the process of design and implementation of abstract interpreters. We define the notion of logical product of lattices. This kind of combination is more precise than

Abstract. Abstract interpretation techniques prove properties of programs by computing abstract fixpoints. All such analyses suffer from the possibility of false errors. We present three techniques to automatically refine such abstract interpretations to reduce false errors: (1) a new operator

We study the abstract interpretation of temporal calculi and logics in a general syntax, semantics and abstraction independent setting. This is applied to the z-calculus, a generalization of the ~-calculus with new reversal and abstraction modalities as well as a new time-symmetric trace

A brief introduction to the theory of Abstract Interpretation, examplified by constructing a hierarchy of partial traces, reflexive transitive closure, reachable states and intervals abstract semantics of transition systems.