An Evaluation of Automata Algorithms for String Analysis

2. An Evaluation of Automata Algorithms for String Analysis Pieter Hooimeijer University of Virginia MargusVeanes Microsoft Research VMCAI 2011

3. TL;DR We evaluate several existing approaches for explicit-state string constraint solving, fixing external factors as much as possible.

4. Outline • Motivation • string constraint solvers • string-related programming idioms • This Paper • benchmark and study design • results

5. Motivation Reasoning about strings is difficult: • for programmers • for automated tools

6. Constraint Solvers Hampi Kaluza Rex

7. Constraint Solvers Hampi Kaluza Rex ✔ String a;//... R = Regex("^ab$"); R.IsMatch(a) = true; String a;//... R = Regex("^ab$"); R.IsMatch(a) = true;

8. Constraint Solvers Hampi Kaluza Rex String a;// ...R = Regex("^ab$"); if (R.IsMatch(a)){ // ... } String a;//... R = Regex("^ab$"); R.IsMatch(a) = true;

9. what (not) to model

10. Example 1 char *sp = (char *) strchr(cmd , ’ ’); char *slash; while(sp && (slash = (char *) strchr(cmd, ’/’)) && (slash < sp)) { cmd= slash + 1; }

11. Example 1 char *sp = (char *) strchr(cmd , ’ ’); char *slash; while(sp && (slash = (char *) strchr(cmd, ’/’)) && (slash < sp)) { cmd= slash + 1; }

12. Example 2 How hard is regexmatching in Perl?

13. Example 2 perl–wle 'print"Prime" if(1 xshift) !~ /^1?$|^(11+?)\1+$/' http://montreal.pm.org/tech/neil_kandalgaonkar.shtml

14. Example 2 perl–wle 'print"Prime" if(1 xshift) !~ /^1?$|^(11+?)\1+$/'

15. Example 2 • Anchors • Non-eager matching • Backreferences /^1?$|^(11+?)\1+$/

16. In this paper

17. Motivation • Existing work provides tool-to-tool performance comparisons • Confounds: Performance gains may be due to external factors

18. The Framework • Based on Rex • Fixes external factors: • front-end parser • regex-to-automaton conversion • implementation language • search tree

19. Character Sets binary decision diagramssymbolic bitvector ranges in DNF concrete set of character ranges concrete set of individual characters BDDPred Range Hash

20. Charset Interface

21. Minterms

22. Study Design Task 1 (55x): Task 2 (100x):

23. Study Design Lazy Eager Task 1 (55x): Task 2 (100x):

24. Study Design Lazy Eager Task 1 (55x): Unicode Unicode ASCII ASCII Task 2 (100x): Unicode Unicode ASCII ASCII

25. Results

26. Regular Difference Lazy Eager Task 1 (55x): Unicode Unicode ASCII ASCII Task 2 (100x): Unicode Unicode ASCII ASCII

27. Eager Lazy Regular Intersection ASCII BDD Pred Range Hash BDD Pred Range Hash ASCII Unicode

28. Eager Lazy Regular Intersection ASCII BDD Pred Range Hash BDD Pred Range Hash ASCII Unicode

29. In Aggregate Lazy Eager Task 1 (55x): Unicode Unicode ASCII ASCII Task 2 (100x): Unicode Unicode ASCII ASCII

30. In Aggregate

31. In Aggregate

32. Conclusion • For Unicode: BDD-based approach and lazy search are fastest • SMT-based Pred approach outperforms concrete Range version

33. Thanks!