A number of effective error detection tools have been built in recent years to check if a program conforms to certain design rules. An important class of design rules deals with sequences of events associated with a set of related objects. This paper presents a language called PQL (Program Query Language) that allows programmers to express such questions easily in an application-specific context. A query looks like a code excerpt corresponding to the shortest amount of code that would violate a design rule. Details of the target application's precise implementation are abstracted away. The programmer may also specify actions to perform when a match is found, such as recording relevant information or even correcting an erroneous execution on the fly.

A number of effective error detection tools have been built in recent years to check if a program conforms to certain design rules. An important class of design rules deals with sequences of events associated with a set of related objects. This paper presents a language called PQL (Program Query Language) that allows programmers to express such questions easily in an application-specific context. A query looks like a code excerpt corresponding to the shortest amount of code that would violate a design rule. Details of the target application’s precise implementation are abstracted away. The programmer may also specify actions to perform when a match is found, such as recording relevant information or even correcting an erroneous execution on the fly. We have developed both static and dynamic techniques to find solutions to PQL queries. Our static analyzer finds all potential matches conservatively using a context-sensitive, flow-insensitive, inclusionbased pointer alias analysis. While the results may not be precise for certain queries, they are useful in optimizing the dynamic analysis. Our dynamic analyzer instruments the source program to catch all violations precisely as the program runs and to perform the specified actions if such are provided. We have implemented the proposed techniques and used them successfully to find severe breaches of security and important resource leaks in 6 large real-world open-source Java applications containing a total of more than 62,000 classes using a combination of static and dynamic analysis. 1

SQL injection and cross-site scripting are two of the most common security vulnerabilities that plague web applications today. These and many others result from having unchecked data input reach security-sensitive operations. This paper describes a language called PQL (Program Query Language) that allows users to declare to specify information flow patterns succinctly and declaratively. We have developed a static context-sensitive, but flow-insensitive information flow tracking analysis that can be used to find all the vulnerabilities in a program. In the event that the analysis generates too many warnings, the result can be used to drive a modelchecking system to analyze more precisely. Model checking is also used to automatically generate the input vectors that expose the vulnerability. Any remaining behavior these static analyses have not isolated may be checked dynamically. The results of the static analyses may be used to optimize these dynamic checks. Our experimental results indicate the language is expressive enough for describing a large number of vulnerabilities succinctly. We have analyzed over nine applications, detecting 30 serious security vulnerabilities. We were also able to automatically recover from attacks as they occurred using the dynamic checker.

Abstract. This paper presents a powerful language for querying complex graphs and a method for generating efficient implementations that can answer queries with complexity guarantees. The graphs may have edge labels that may have parameters, and easily and naturally capture complex interrelated objects in object-oriented systems and XML data. The language is built on extended regular path expressions with variables and scoping, and can express queries more easily and clearly than previous query languages. The method for implementation first transforms queries into Datalog with limited extensions. It then extends a previous method to generate specialized algorithms and complexity formulas from Datalog with these extensions. 1

This reports presents a runtime solution to a range of Web application security vulnerabilities. The solution we proposes called SecuriFly consists of instrumenting the application to precisely track the flow of data. When a potential vulnerability is observed, the application is either terminated to prevent the vulnerability from being exploited or special recovery code is executed and the application is allowed to continue on running. We have used SecuriFly to harden and experiment with a range of large opensource benchmarks written in Java. Protection provided by SecuriFly was sufficient to protect against all exploits we were able to generate. Chapter 1

Tuple pattern based retrieval is a language construct that matches a tuple pattern against a set of tuples to retrieve components of those tuples. This high-level abstraction allows programs to be written more easily and clearly than otherwise. This paper describes a clean and automatic method for transforming tuple pattern based retrievals into efficient implementations. The paper also presents two systems that implement the method, and describes successful experience and experiments in generating efficient implementations for graph algorithms, program analysis, security, and other applications. 1.

Abstract not found

Abstract. Many complex analysis problems can be most clearly and easily specified as logic rules and queries, where rules specify how given facts can be combined to infer new facts, and queries select facts of interest to the analysis problem at hand. However, it has been extremely challenging to obtain efficient implementations from logic rules and to understand their time and space complexities, especially for on-demand analysis driven by queries. This paper describes a powerful method for generating specialized rules and programs for demand-driven analysis from Datalog rules and queries, and further for providing time and space complexity guarantees. The method combines recursion conversion with specialization of rules and then uses a method for program generation and complexity calculation from rules. We compare carefully with the best prior methods by examining many variants of rules and queries for the same graph reachability problems, and show the application of our method in implementing graph query languages in general. 1

Component middleware frameworks such as the CORBA Component Model (CCM) and Enterprise Java Beans (EJB) are increasingly being applied to address challenges involved in building large-scale distributed systems. We seek to provide foundations and tools for modeldriven development of such systems in which architectural models serve as highly leveragable abstractions that form a substrate into which a variety of forms of essential behavioral properties are woven. Our vision emphasizes a synergistic integration of analysis and analysis clients at multiple levels of abstraction in a system including both the architectural model (component interfaces and connections) level and the source code (component implementation) level. Dependence and flow properties have proven to be useful behavioral abstractions that can be leveraged in a variety of ways at both the architectural model level and code level. However, previous works provide no mechanism for connecting architectural-level dependences to codelevel dependences, e. g., for the purpose of guaranteeing soundness of model-level specifications by checking that dependences present in implementations conform to model-level specifications – a task that is especially challenging when working with sophisticated component frameworks

This paper describes the use of a powerful graph query language for querying programs, and a novel combination of transformations for generating efficient implementations of the queries. The language supports graph path expressions that allow convenient use of both vertices and edges of arbitrary kinds as well as additional global and local parameters in graph paths. Our implementation method combines transformation to Datalog, recursion conversion, demand transformation, and specialization, and finally generates efficient analysis programs with precise complexity guarantees. This combination improves an O(V E) time complexity factor using previous methods to O(E), where V and E are the numbers of graph vertices and edges, respectively. We also describe implementations and experiments that confirm the analyzed complexities. Categories and Subject Descriptors D.3.2 [Programming Languages]: Language Classifications—Constraint and logic languages, Very high level languages; D.3.3 [Programming Languages]: Language Constructs and Features—Patterns; D.3.4