In the realm of software systems and quality assurance, vulnerability identification has become a critical concern in today’s connected world. Vulnerabilities not only make systems less effective, but they also pose significant risks to user privacy and data integrity. Although automated vulnerability detection has seen considerable progress, existing approaches frequently struggle to accurately model syntactic and semantic code relationships. This deficiency leads to undetected vulnerabilities and false positives, thereby undermining the efficacy of software security protocols. To overcome these limitations, we propose a new vulnerability detection technique called CodeGATNet (Code-Gated Attention using Convolutional Features). Our deep learning model is designed to handle static vulnerability detection in source code to enable batch-level examination of codebases. CodeGATNet operates in two phases: Static Code Embedding Generation (SCEG) and Convolutional Attention Network for Feature Refinement (CAN-FR). SCEG utilizes fine-tuned CodeBERT embeddings (a pretrained transformer model for programming languages), which are task-specifically optimized to improve the pretrained model’s capacity to capture application-relevant semantic patterns while maintaining its general code comprehension capabilities. CAN-FR uses a hybrid architecture for feature extraction and refinement combining a gated attention mechanism with one-Dimensional Convolutional Neural Network (1D-CNN). This hybrid approach helps the model to efficiently capture present global contextual relationships in the source code as well as local structural patterns. Extensive experimental evaluations on three large-scale (C/C++) real-world datasets and the results show that CodeGATNet considerably outperforms leading models, obtaining accuracy enhancements of 18.05%, 28.14%, and 13.06%, alongside F1-score improvements of 7.83%, 18.28%, and 13.0%.

The rapid development of the internet of things (IoT) prompts organizations and developers to seek innovative approaches for future IoT device development and research. Leveraging advanced artificial intelligence (AI) models such as ChatGPT holds promise in reshaping the conceptualization, development, and commercialization of IoT devices. Through real‐world data utilization, AI enhances the effectiveness, adaptability, and intelligence of IoT devices and wearables, expediting their production process from ideation to deployment and customer assistance. However, integrating ChatGPT into IoT–based devices and wearables poses ethical concerns including data ownership, security, privacy, accessibility, bias, accountability, cost, design, quality, storage, model training, explainability, consistency, fairness, safety, transparency, trust, and generalizability. Addressing these ethical principles necessitates a comprehensive review of the literature to identify and classify relevant principles. The author identified 14 ethical principles from the literature using a systematic literature review (SLR) with a criteria of frequency ≥ 50% based on similarities. Four categories emerge based on the identified ethical principles, culminating in the application of Fuzzy‐TOPSIS for analyzing, categorizing, ranking, and prioritizing these ethical principles. From the Fuzzy‐TOPSIS technique results, the principle of data security and privacy is the highly ranked ethical principle for IoT–based software wearable devices with the ranking value of “0.925” as a consistency coefficient index. This method, well‐established in computer science, effectively navigates fuzzy and uncertain decision‐making scenarios. The pioneer outcomes of this study provide a taxonomy‐based valuable insight for software manufacturers, facilitating the analysis, ranking, categorization, and prioritization of ethical principles amid the integration of ChatGPT in IoT–based devices and wearables’ research and development.

Detecting atomicity violations effectively in interrupt-driven programs is difficult due to the asymmetric concurrency interleaving of interrupts. Current approaches face two main challenges: (1) A large number of false positives are generated by efficient static analysis techniques. (2) Loops with large or unknown bounds in these programs limit the scalability of the bounded verification techniques. To address these challenges, we present NIChecker, a new bounded verification tool designed to detect atomicity violations in interrupt-driven programs. The key ideas are: (1) Transforming an interrupt-driven program into a bounded sequential C program through lazy sequentialization technique. This sequential program accurately models interrupt masking and nested interrupt execution. (2) Combining a refined loop abstraction technique with our sequentialization to enhance the efficiency of detecting programs with intractable loops. (3) Integrating slicing and an interleaving path reduction technique known as preemption point reduction in NIChecker to shrink the explored state space. We prove the bounded correctness of our translation and discuss the impact of our optimizations. We evaluate NIChecker on 31 academic benchmark programs and 18 real-world interrupt-driven programs. Our results show that NIChecker achieves better precision, a lower false positive rate, and a significant verification speed-up than related state-of-the-art tools.

In the robustness verification of neural networks, formal methods have been used to give deterministic guarantees for neural networks. However, recent studies have found that the verification method of single-neuron relaxation in this field has an inherent convex barrier that affects its verification capability. To address this problem, we propose a new verification method by combining dual-neuron relaxation and linear programming. This method captures the dependencies between different neurons in the same hidden layer by adding a two-neuron joint constraint to the linear programming model, thus overcoming the convex barrier problem caused by relaxation for only a single neuron. Our method avoids the combination of exponential inequality constraints and can be computed in polynomial time. Experimental results show that we can obtain tighter bounds and achieve more accurate verification than single-neuron relaxation methods.

The verification techniques based on formal methods can provide deterministic guarantees for the robustness of Deep Neural Networks(DNNS). However, the enormous scale of DNNS makes the application of such methods in this field a huge challenge. To address this problem, this study proposes a single-sample sub-network pruning method, which can identify redundant nodes by combining neuron coverage and the symbolic interval propagation method to reduce the network verification scale. In addition, to solve the problem of too many sub-networks to be pruned, according to the similarity of neuron coverage between samples, we propose a corresponding clustering algorithm to establish sub-networks for different categories of samples to improve the verification efficiency. We combine the MIPverify verification tool to validate the above method. Experiments show that the sub-networks can give the same robust validation results and similar robustness bounds as the original network, while greatly reducing the validation time and network size.

Real-time embedded systems are increasingly applied in safety-critical areas, so guaranteeing the correctness of such systems by means of formal methods becomes particularly important. In this paper, we propose an optimized bounded model checking (BMC)-based formal verification approach for the verification of safety for synchronous-reactive (SR) models, which are often used to design systems with complicated control logic, especially the real-time embedded control systems. This method is based on the tackling of a series of challenging problems including the management of the logical clock, encoding of the contained ports, representation of the data types of ports, descriptions of behaviors of various components in a considered model, and formal consideration of the fixed-point semantics. We have implemented this proposed method in the prototype Ptolemy-Z3, and integrated this tool into the Ptolemy II environment. In addition, the experimental evaluation on 22 SR models has shown that our method performs better than the existing automatic verification method in Ptolemy II.

Ptolemy II is an open-source modeling and simulation tool supporting the design of the concurrent, real-time and embedded systems, particularly those involving heterogeneous mixtures of models of computation. In this paper, we present a bounded model checking (BMC) and k-induction based formal verification approach to Ptolemy II, especially its synchronous reactive (SR) models which are commonly used to design systems with complicated control logic. Compared to the verification of common finite-state based systems, the challenges include the relationship between the “tick in SR models and the step in BMC method, simultaneous actor reaction to an input signal and instantaneous communication between actors through sending messages via ports, and fixed-point semantics associated with tick execution, etc. In addition to tackle these challenges, we also present a BMC encoding approach to most common NonFSMActors in SR, which can be used as a library for similar work such as Lingua Franca. We have implemented a prototype (named as Ptolemy-Z3) and integrated it into the Ptolemy II tool. Experimental results show that Ptolemy-Z3 outperforms the existing tool Ptolemy-NuSMV significantly in formal conversion and verification capability of different types of SR models.

Ptolemy II is an open-source modeling and simulation tool for concurrent, real-time and embedded systems, particularly those involving hierarchical heterogeneity. Synchronous- reactive (SR) model of computation which has been implemented in Ptolemy II is commonly used to design safety-critical systems with complicated control logic. Formally verifying the correctness of hierarchical SR models is of great importance and also challenging due to the formalization of a series of specific features including, e.g., instantaneous communication between actors across the level of hierarchy, the combination of SR’s fixed-point semantic with hierarchical structure, and multiple clocks proceeding at different rates in multiclock SR models. In this paper, we tackle such challenges and propose a bounded model checking (BMC) approach to typical actors commonly used in hierarchical SR models. In addition, we implement the proposed BMC approach to hierarchical SR models in a prototype tool called Ptolemy-Z3, which has been integrated into the Ptolemy II environment. Experimental results show that Ptolemy-Z3 outperforms significantly Ptolemy-NuSMV (a verification tool provided by the Ptolemy II environment) in the verification capability of hierarchical SR models.

Compiler testing is the most widely used way to assure compiler quality. However, since compilers require a large number of sophisticated test programs as inputs, the existing approaches in compiler testing still have a limited capability in generating both syntactically valid and diverse test programs. In this paper, we propose DeepGen, a deep learning-based approach to support compiler testing through the inference of a generative model for compiler inputs. First, DeepGen trains a Transformer-XL model based on a large corpus of seed programs, and uses the trained model to generate syntactically valid programs. Then, DeepGen adopts a sampling strategy in the inference phase to generate diverse test programs. Finally, DeepGen leverages differential testing on the generated programs to discover compiler bugs. We have evaluated DeepGen over two popular C++ compilers GCC and LLVM, and the results confirm the effectiveness of our approach. DeepGen detects 35.29%, 53.33%, and 187.50% more bugs than three existing approaches, i.e. DeepSmith, DeepFuzz, and Csmith, respectively. In addition, 30.43% bugs detected by DeepGen are not detected by other approaches. Furthermore, DeepGen has successfully detected 38 bugs in the latest development versions of GCC and LLVM; 21 of them have been confirmed/fixed by the developers.

Compiler diagnostic warnings help developers identify potential programming mistakes during program compilation. However, these warnings could be erroneous due to the defects of compiler warning diagnostics. Although the existing technique (i.e., Epiphron) can automatically generate test programs for compiler warning defect detection, the effectiveness of Epiphron on defect-finding is still limited, due to the limitation for generating warning-sensitive test program structures. Therefore, in this paper, we propose a DIversity-guided PROgram Mutation approach, called DIPROM, to construct diverse warning-sensitive programs for effective compiler warning defect detection. Given a seed test program, DIPROM first removes its dead code to reduce false positive warning defects. Then, the abstract syntax tree (AST) of the test program is constructed; DIPROM iteratively mutates the structures of the AST to generate warning-sensitive program variants. To effectively construct diverse warning-sensitive structures, DIPROM applies a novel diversity-guided strategy to generate program variants in each iteration. With the generated program variants, differential testing is conducted to detect warning defects in different compilers. In the experiments, we evaluate DIPROM with two popular C compilers (i.e., GCC and Clang). Experimental results show that DIPROM significantly outperforms three state-of-the-art approaches (i.e., HiCOND, Epiphron, and Hermes) by up to 18.93%$\sim$76.74% in terms of the bug-finding capability on average. Meanwhile, DIPROM is efficient, which spends less time on finding the same average number of warning defects. We at last applied DIPROM to the latest development versions of GCC and Clang. After two months’ running, we reported 8 new warning defects; 5 of them have been confirmed/fixed by developers.

Abstract Self-driving cars over the last decade have achieved significant progress like driving millions of miles without any human intervention. However, behavioral safety in applying deep-neural-network-based (DNN based) systems for self-driving cars could not be guaranteed. Several real-world accidents involving self-driving cars have already happened, some of which have led to fatal collisions. In this paper, we present a novel and automated technique for verifying steering angle safety for self-driving cars. The technique is based on deep learning verification (DLV), which is an automated verification framework for safety of image classification neural networks. We extend DLV by leveraging neuron coverage and slack relationship to solve the judgement problem of predicted behaviors, and thus, to achieve verification of steering angle safety for self-driving cars. We evaluate our technique on the NVIDIA’s end-to-end self-driving architecture, which is a crucial ingredient in many modern self-driving cars. Experimental results show that our technique can successfully find adversarial misclassifications (i.e., incorrect steering decisions) within given regions if they exist. Therefore, we can achieve safety verification (if no misclassification is found for all DNN layers, in which case the network can be said to be stable or reliable w.r.t. steering decisions) or falsification (in which case the adversarial examples can be used to fine-tune the network).

With the increasing popularity of smartphones, the mobile security issues have become serious, and more and more malware has been found. Android applications are often used to handle sensitive information, thus they have become the main targets of malware attacks. In order to efficiently detect Android malware, in this paper, we present a multi-strategy combination framework. We use five types of static features to characterize Android applications from multiple aspects. To improve the classification accuracy and reduce the overfitting of the framework, we use three filter-based feature selection methods to identify the most informative top-k features. Then we input the applications represented by the feature subsets into five classification algorithms to build classifiers. Finally, we predict the classification results by hard voting or soft voting. We have performed many experiments in a well-marked dataset consisting of 41,155 samples. The experimental results show that our approach can achieve over 98% in accuracy, precision, recall and F-score. Compared with other existing methods, our approach has the best malware detection rate of 98.75%.

The real-time interaction between embedded software and its external environment is conducted through the interrupt mechanism. Since the interrupt request is random and responds according to priority, the execution of embedded software is non-sequential, which leads to the non-deterministic software behaviors. If these non-deterministic behaviors can be quantitatively pre-analyzed during the software design phase, the reliability of embedded software can be improved effectively. In this paper, we first provide an embedded software behavior model based on extended deterministic and stochastic Petri nets (EDSPN). Through EDSPN, the interrupt behavior of embedded software can be effectively modeled. Then we put forward a probabilistic model checking method of Continuous Stochastic Logic (CSL) for EDSPN to analyze embedded software behavior. For alleviating the state explosion problem, the above method uses the bounded model checking (BMC) technique. We present the model checking methods and the probability metric calculation methods for CSL operators under bounded semantics. Finally, by analyzing the EDSPN model of embedded software with multiple interrupts, we compare the analytical capabilities of BMC method and non-BMC method. The experiment shows that when the state space of EDSPN is large and is hard to calculate, the bounded checking algorithm can be used to approximate the software behavior. The conclusions obtained are helpful to understand the properties to be verified.

Craig interpolation has emerged as an effective approximation method and can be widely applied in hardware and software model checking. Since the quality of interpolants can critically affect the success and failure, or convergence and divergence of model checking, researchers have put forward a novel and flexible interpolation abstraction-based technique to guide the computation of promising interpolants. In this technique, abstraction lattice is constructed to arrange families of interpolation abstraction for improving the quality of resulting interpolants. However, the original search strategy to explore an abstraction lattice is not efficient when abstraction lattice enlarges and the elapsed time to perform multiple search on the same abstraction lattice is obviously distinct for many problems. In this paper, in order to alleviate these problems, we propose a top-down search space pruning-based algorithm to search the abstraction lattice and implement this algorithm in the well-known model checker Eldarica. We conduct experiments on 179 benchmarks to compare our algorithm respectively against the original search algorithm in Eldarica and the state-of-the-art SMT solver Z3. The experimental results show that our algorithm performs much better in the sense that it is more efficient than Eldarica for most of the benchmarks and it can solve much more benchmarks than Z3.

When implementing unfamiliar programming tasks, developers commonly search code examples and learn usage patterns of APIs from the code examples or reuse them by copy-pasting and modifying. For providing high-quality code examples, previous studies present several methods to recommend code snippets mainly based on information retrieval. In this paper, to provide better recommendation results, we propose ROSF, Recommending code Snippets with multi-aspect Features, a novel method combining both information retrieval and supervised learning. In our method, we recommend Top-K code snippets for a given free-form query based on two stages, i.e., coarse-grained searching and fine-grained re-ranking. First, we generate a code snippet candidate set by searching a code snippet corpus using an information retrieval method. Second, we predict probability values of the code snippets for different relevance scores in the candidate set by the learned prediction model from a training set, re-rank these candidate code snippets according to the probability values, and recommend the final results to developers. We conduct several experiments to evaluate our method in a large-scale corpus containing 921,713 real-world code snippets. The results show that ROSF is an effective method for code snippets recommendation and outperforms the-state-of-the-art methods by 20-41percent in Precision and 13-33 percent in NDCG.

Bounded Model Checking (BMC) converts a verification problem within a user-specified bound into satisfiability checks of propositional formulas. As the bound deepens, the formulas become larger in size and harder to solve. In this paper, we propose a hybrid approach in which stateless explicit-state exploration (SESE) is integrated into the BMC process to improve the scalability and performance of BMC for the verification of properties expressed in Linear Temporal Logic (LTL). Specifically, SESE is utilized to traverse, under the constraints of Bounded-Context Switching (BCS), the state space of a system design and memorize legal execution paths. These paths are classified according to heuristic state predicates into path clusters, which are then encoded into propositional formulas representing, together with the encoded formula for an LTL property, independent BMC instances. Such BMC instances are solved with SMT solvers running on mutilcores in parallel. Once a counterexample is found for one of the instances, the entire model checking (SESE as well as BMC) terminates. This hybrid checking procedure progresses in an incremental fashion until either a counterexample is found or the user-specified bound is reached. We have implemented this proposed hybrid approach in a tool called Garakabu2 with Yices 2 as its back-end solver. The experimental results show that Garakabu2 outperforms significantly the state-of-the-art BMC methods implemented in SAL for both safety and liveness properties.

Abstract The extended hierarchical state transition matrices (EHSTMs) are a table-based modelling language frequently used in industry for specifying behaviours of systems. However, assuring correctness, i.e., having a design satisfy certain desired properties, is a non-trivial task. To address this problem, a model checker dedicated to EHSTMs called Garakabu2 has been developed. However, there is no formal justification for Garakabu2, since its semantics has never been fully formalised. In this paper, we give a formal semantics to EHSTMs by translating them into CSP, Communicating Sequential Processes. Among the variants of CSP, we use CSP#, which is the modelling language used by PAT model checker, as a target of translation. Our semantics covers most of the features supported by Garakabu2. We manually translate the small examples of EHSTMs to CSP#, and verify them by PAT. We also verify the examples directly using Garakabu2 and show that the results are same. The experiments also indicate that verification using our translation and PAT is much faster than that of Garakabu2 in some cases.

We propose a hybrid approach to improving the verification performance of SMT-based bounded model checking for LTL properties. In this approach, stateless explicit-state exploration is utilized to traverse, under the constraints of bounded context switches, the state space of a system design and memorize legal execution paths. These paths are classified according to certain predicates into path clusters, which are then encoded into propositional formulas representing, together with the encoded formula for an LTL property, independent BMC instances. Such BMC instances are solved with SMT solvers running on mutilcores in parallel. Once a counterexample is found for one of the instances, the entire model checking terminates. This hybrid checking procedure progresses in an incremental fashion until either a counterexample is found or the user-specified bound is reached. We have implemented this proposed hybrid approach in a tool called Garakabu2 with CVC4 as its backend solver. The experimental results show that Garakabu2 often outperforms the state-of-the-art pure BMC methods implemented in SAL infinite bounded model checker for both safety and liveness properties.

Hierarchical State Transition Matrix (HSTM) is a table-based modeling language for developing designs of software systems. We have proposed a Satisfiability Modulo Theory (SMT) based Bounded Model Checking (BMC) approach in [1] to provide formal verification supports for conducting rigorous and automatic analysis to improve reliability of HSTM designs. In this paper, we continue that work by developing and evaluating approaches to accelerating BMC of HSTM designs. The approaches center around an unrolled Bounded Reach ability Tree (BRT) of a HSTM design that is built with stateless explicit state exploration. Specifically, reach ability of invalid cells (representing undesired states) of a HSTM design, which occurs within the bound concerned, could be discovered during construction of the BRT, and furthermore, if no such occurrence, the constructed BRT could be utilized to rule out unnecessary subformulas of a BMC instance for verification of LTL properties. We have implemented these approaches in a tool called Garakabu2 with the state-of-the-art SMT solver CVC3 as its back-ended solver. Our preliminary experiments show that verification could be accelerated substantially.

In this paper, we propose a dynamic channel assignment method that utilizes location information of mobile terminals to calculate the optimal channel scheme in indoor WLAN positioning systems. Our method could achieve two goals: (a) the optimal channel scheme can guarantee a maximum throughput of overall wireless network. (b) terminals can communicate and be located simultaneously in our system. By taking advantage of positioning system, we can know the location of terminals, and such location information can be used to optimize network capacity through assigning appropriate channels. Assigning different channel to neighbouring APs is not only for optimizing network capacity, but also for improving the positioning accuracy due to that it can immigrate the interference among APs and receive accurate signal strength. To confirm its effectiveness, we evaluate our approach by simulation. We compare our method with the single, random, and static methods and the LCCS method. The results illustrate that the throughput of our channel assignment method is higher than other methods.

Hierarchical State Transition Matrix (HSTM) is a table-based modeling language for developing designs of software systems. Although widely used and adopted by (particularly Japanese) software industry, there is still lack of mechanized formal verification supports for conducting rigorous and automatic analysis to improve reliability of HSTM designs. In this paper, we first present a formalization of HSTM designs as state transition systems. Consequentially, based on this formalization, we propose a symbolic encoding approach, through which correctness of a HSTM design with respect to LTL properties could be represented as Bounded Model Checking (BMC) problems that could be determined by Satisfiability Modulo Theories (SMT) solving. We have implemented our encoding approach in a tool called Garakabu2 with the state-of-the-art SMT solver CVC3 as its back-ended solver. Furthermore, in our preliminary experiments, a conceptually simple but steadily effective way of accelerating SMT solving for HSTM designs is investigated and reported.

Security considerations, such as role-based access control (RBAC) mechanism and separation of duty (SoD) constraints, are important and integral to workflow systems. Since the definition of workflows with these security considerations is a complicated and error-prone process, rigorous verification techniques are desirable for uncovering logical errors and assuring correctness. We propose the use of an equation-based method — the OTS/CafeOBJ method to model, specify and verify workflows with such security considerations. Specifically, a workflow with the security considerations, is modeled as an OTS, a kind of transition system; the OTS is then specified in CafeOBJ, an algebraic specification language. We verify that the OTS has desired safety and liveness properties by using the CafeOBJ system as an interactive theorem prover. A case study on a sample workflow that deals with travel expense reimbursement is used to demonstrate our method.

Theorem proving and model checking are known as two formal verification techniques that have complementary features. In this paper, we describe a lightweight integration of the two techniques by a translation from theorem proving formalism to model checking formalism, and then treating model checking as part of the decision procedure. In the translation, system and property specifications defined for a theorem prover can be automatically translated to specifications feedable to a model checker after a simple data abstraction. The main aim of this integration is to provide the theorem prover with automatic counter-example generating capability, thus to be able to find "bugs" in the early stage of theorem proving and ease the hard-work of doing theorem proving. A case study is used to demonstrate how this translation works and what the verification flow is when using this integration to do system verification.