Malicious code is any code that has been modified with the intention of harming its usage or the user. Typical categories of malicious code include Trojan Horses, viruses, worms etc. With the growth in complexity of computing systems, detection of malicious code is becoming horrendously complex. For security of embedded devices it is important to ensure the integrity of software running in it. The general virus detection is undecidable. However, in the case of embedded systems or personal systems, the software and hardware configurations are known a priori. We are experimenting to see whether we can certify such systems for malware freedom. Most of the current efforts on malware detection rely heavily on detection of syntactic patterns. Malware writers are resorting to simple syntactic transformations (which preserve the program semantics) such as various compiler optimizations and program obfuscation techniques to evade detection. Our work is based on semantic behaviour of programs. We are working towards developing a model of the behaviour of a program executing in an environment. Our approach to detect tampering is based on benchmarking the behaviour of a program executing in an environment, and then matching the observed behaviour of the program in a similar environment with the benchmark (a la translation validation in a sense or bisimulation that is widely used in model checking). Since execution behaviour remains the same in majority of obfuscations, our approach is resilient to such exploits. We have performed several experiments in this direction and obtained encouraging results. Differences between the benchmarked behaviour and the observed behaviour quantifies the damage due to a virus. This enables us to arrive at refined notions of "harm" done by a virus and appropriate measures for protection.

Static single assignment (SSA) form has been widely studied and used for sequential programs. This form enables many compiler optimizations to be done efficiently. Work on concurrent static single assignment form (CSSA) for concurrent programs is focused on languages that have limited, implicit barriers (e.g., cobegin/coend and parallel do). Recent programming languages for high-performance computing have general features for barrier/phase synchronization - this is essentially a dual of mutual exclusion and arises mainly in constructing synchronous systems from asynchronous systems. X10 is one such language that has features for general purpose barriers. In X10, barriers are provided through features such as clocks and finish. Since barriers provide explicit synchronization, they offer an opportunity for reducing pi interferences needed for CSSA. This paper provides a means for computing improved CSSA form of a program taking advantage of the general barriers present in it. Our algorithm is based on constructing a control-flow graph of the program and flow equations. The efficiency of analysis and optimizations for parallel programs depends on the number and complexity of pi assignments in their CSSA representations. We demonstrate that our approach of computing CSSA form for languages supporting general barrier synchronization can improve the precision of intermediate representation for computing global value numbering and loop invariant detection.

We present a novel, table-free technique for detecting all temporal and spatial memory access errors (e.g. dangling pointers, out-of-bounds check, etc.) in programs supporting general pointers. Our approach is the first technique to provide such error checking using only constant-time operations. The scheme relies on fat pointers, whose size is contained within standard scalar sizes (up to two words) so that atomic hardware support for operations upon the pointers is obtained along with meaningful casts in-between pointers and other scalars. Optimized compilation of code becomes possible since the scalarized-for-free encoded pointers get register allocated and manipulated. Backward compatibility is enabled by the scalar pointer sizes, with novel automatic support provided for encoding and decoding of fat pointers in place for interaction with unprotected code (e.g. library binaries). Implementation and benchmarks of the technique over several applications of the memory-intensive Olden suite indicate that the average time overhead of our method is about half the time cost of an unprotected application's execution (