Automatically identifying critical behaviors in programs

Abstract

The large size of modern software systems has led to an increase in the complexity of the interaction between a system's code, its input, and its output. I propose the following classifications for the regions of a system's input: * Critical control: data that influences the internal operation and output of the system. * Critical payload: data that heavily contributes to the output of the program but does not substantially influence the internal operation of the program. * Benign control: data that influences the internal operation of the system, but does not contribute to the output of the system. * Benign payload: data that neither contributes to the output nor substantially influences the internal operation of the program. In this thesis, I present Chaos, a system designed to automatically infer these classifications for a program's inputs and code. Chaos monitors the execution trace and dynamic taint trace of an application over a suite of inputs to determine how regions of the programs' code and input influence its behavior and output. This thesis demonstrates the accuracy of Chaos's classifications for a set of imaging applications and their support libraries. These automatically inferred classifications are relevant to a variety of software engineering tasks, including program understanding, maintenance, debugging, testing, and defect correction triage.