We describe a new technique for finding potential buffer overrun vulnerabilities in security-critical C code. The key to success is to use static analysis: we formulate detection of buffer overruns as an integer range analysis problem. One major advantage of static analysis is that security bugs can be eliminated before code is deployed. We have implemented our design and used our prototype to find new remotely-exploitable vulnerabilities in a large, widely deployed software package. An earlier hand audit missed these bugs. 1.

Temporal events are regarded here as intervals on a time line. This paper deals with problems in reasoning about such intervals when the precise topological relationship between them is unknown or only partially specified. This work unifies notions of interval algebras in artificial intelligence with those of interval orders and interval graphs in combinatorics. The satisfiability, minimal labeling, all solutions and all realizations problems are considered for temporal (interval) data. Several versions are investigated by restricting the possible interval relationships yielding different complexity results. We show that even when the temporal data comprises of subsets of relations based on intersection and precedence only, the satisfiability question is NP-complete. On the positive side, we give efficient algorithms for several restrictions of the problem. In the process, the interval graph sandwich problem is introduced, and is shown to be NP-complete. This problem is als...

Local consistency has proven to be an important concept in the theory and practice of constraint networks. In this paper, we present a new definition of local consistency, called relational consistency. The new definition is relation-based, in contrast with the previous definition of local consistency, which we characterize as variable-based. We show the conceptual power of the new definition by showing how it unifies known elimination operators such as resolution in theorem proving, joins in relational databases, and variable elimination for solving linear inequalities. Algorithms for enforcing various levels of relational consistency are introduced and analyzed. We also show the usefulness of the new definition in characterizing relationships between properties of constraint networks and the level of local consistency needed to ensure global consistency.

We present here 2-approximation algorithms for several node deletion and edge deletion biclique problems and for an edge deletion clique problem. The biclique problem is to find a node induced subgraph which is bipartite and complete. The objective is to minimize the total weight of nodes or edges deleted so that the remaining subgraph is bipartite complete. Several variants of the biclique problem are studied here where the problem is defined on bipartite graph or on general graphs with or without the requirement that each side of the bipartition forms an independent set. The maximum clique problem is formulated as maximizing the number (or weight) of edges in the complete subgraph. A 2-approximation algorithm is given for the minimum edge deletion version of this problem. The approximation algorithms given here are derived as a special case of an approximation technique devised for a class of formulations introduced by Hochbaum [Hoc96]. All approximation algorithms described (and the...

. The problem of integer programming in bounded variables, over constraints with no more than two variables in each constraint is NP-complete, even when all variables are binary. This paper deals with integer linear minimization problems in n variables subject to m linear constraints with at most two variables per inequality, and with all variables bounded between 0 and U . For such systems, a 2\Gammaapproximation algorithm is presented that runs in time O(mnU 2 log(Un 2 =m)), so it is polynomial in the input size if the upper bound U is polynomially bounded. The algorithm works by finding first a super-optimal feasible solution that consists of integer multiples of 1 2 . That solution gives a tight bound on the value of the minimum. It further more has an identifiable subset of integer components that retain their value in an integer optimal solution of the problem. These properties are a generalization of the properties of the vertex cover problem. The algorithm described is, ...

Abstract not found

. Constraint query languages are natural extensions of relational database query languages. A framework for their declarative specification (constraint calculi) and efficient implementation (low data complexity and secondary storage indexing) was presented in Kanellakis et al., 1995. Constraint query algebras form a procedural language layer between high-level declarative calculi and low-level indexing methods. Just like the relational algebra, this intermediate layer can be very useful for program optimization. In this paper, we study properties of constraint query algebras, which we present through three concrete examples. The dense order constraint algebra illustrates how the appropriate canonical form can simplify expensive operations, such as projection, and facilitate interaction with updates. The monotone two-variable linear constraint algebra illustrates the concept of strongly polynomial operations. Finally, the lazy evaluation of (non)linear constraint algebras illustrates ho...

One of the problems with the traditional finite domains approach to solving integer problems in a constraint logic programming context is that all variables require explicit bounds. If no explicit bounds are available then the finite domain solver can be very inefficient on certain classes of problem. We present an alternative approach to solving integer constraints based on a polynomial-time solver for a restricted class of integer constraints. This approach does not require bounds information, avoids bad behaviour for a larger class of problems, and is competitive with bounds propagation for the types of problem examined. We give a detailed description of the implementation of the core solver, discuss how it can be used to as the basis of a more general solver, and present some computational results. 1 Introduction Integer constraints are an important class used to represent many forms of problems of practical interest. For example scheduling, resource allocation and route plannin...

We present fast and simple fully...

We propose the first combinatorial solution to one of the most classic problems in combinatorial optimization: the generalized minimum cost flow problem (flow with losses and gains). Despite a rich history dating back to Kantorovich and Dantzig, until now, the only known way to solve the problem in polynomial-time was via general purpose linear programming techniques. Polynomial combinatorial algorithms were previously known only for the version of our problem without costs. We design the first such algorithms for the version with costs. Our algorithms also find provably good solutions faster than optimal ones, providing the first strongly polynomial approximation schemes for the problem. Our techniques extend to optimize linear programs with two variables per inequality. Polynomial combinatorial algorithms were previously developed for testing the feasibility of such linear programs. Until now, no such methods were known for the optimization version. 1 Introduction In the ...