why we need Static Analysis
- Program Reliability: null pointer dereference , memory leak
- Program Securiy: private information leak,injection attack
- Compiler Optimization: dead code leimination, code motion
- Program Understanding: IDA call hierarchy, type indication
国内团队
- 源伞
- 华为代码实验室
- 中科天齐
- 鸿渐
- 开源网安
- 默安
人才较为短缺
静态分析及其短缺 Static analysis people are urgenly needed!
不要浮躁，多独立思考
Define Static Analysis
- 在运行程序P之前知道P的行为
Sound True Complete
Rice's Theorem
- 没有办法给Non-trival Properties 涉及的问题一个extract answer
- Perfect static analysis 不存在 Sound And Complete 不存在
- Useful static analysis 存在
Compromise soundness(false negatives)OR Compromise completeness(false positives) - Most compromising completeness：Sound but not fully-precise static analysis
一句话把握静态分析：Brid's Eye View
ensure(or get close to) soundness, while making good trade-offs between analysis preision and analysis speed 把握速度和精准的平衡
Conclude Static Analysis
Abstraction + Over-approximation
- 将具体数值抽象为 + - O unknow undefined
- Transfer Functions: 怎么计算Abstract value
Control Flows
课表
- Introduction
- Intermediate Representation
- Data Flow Analysis - Applications
- Data Flow Analysis - Foundations(1)
- Data Flow Analysis - Foundations(2)
- Inter-procedural Analysis
- CFL-Reachability and IFDS IFDS非常难
- Soundness and Soundiness 分析反射，分析跨语言调用
- Pointer Analysis - Foundations(1)
- Pointer Analysis - Foundations(2)
- Pointer Analysis - Context Sensitivity
- Modern Pointer Analysis
- Static Analysis for Security
- Datalog-Based Analysis
- Abstract Interpretation
- Course Summary
实验
- Constant Propagation
- Dead Code Elimination
- Class Hierarchy Analysis
- Pointer Analysis
- Context-Sensitive Pointer Analysis
非常感兴趣或者很强的编程能力
- 直接上门交流
