Grant: Discovery Grants Program - Individual

Automated static program analysis tools deduce properties about a program under analysis, without requiring developer intervention. Such tools can have beneficial impacts on the quality of the developed software. However, there are three main challenges to their wide adoption. First, approaches that can analyze a program deeply, deriving complex semantic properties, are not adapted to modern programming languages that feature high levels of dynamicity such as dynamic thread creation or higher-order functions. Second static analysis tools often are too imprecise, as they report a high number of false positives that hampers developer experience. Finally, static analysis tools lack scalability, having to run for too long for large programs. Objectives. My research in software engineering has as main long-term objective the design of novel static analysis approaches that target highly dynamic languages in a precise and scalable way. In my discovery program, I propose three short-term objectives towards that goal. First, the development of domain-specific software contract systems that enable describing analysis-specific properties. Second, the design of compositional analyses, where the analysis of a program is decomposed in the analysis of its constituents and can achieve scalable analyses. Third, the design of collaborative analyses that combine both static and dynamic approaches in order to improve the precision of the analyses. Methodology. To achieve these objectives while ensuring that the principles remain generally applicable, each proposed design will be investigated from two viewpoints. First, they will be instantiated to reason about security properties of a program, namely confidentiality and integrity. Security is a prime concern of increasing importance in application development. Second, the designs will be instantiated for a resource usage analysis, an analysis that reasons about the resources used by the program under analysis (computational resources, memory, file or network usage). The environmental impact of computer programs can be reduced once they are established with such an analysis. The description of these two non-functional properties (security and resource usage) as a contract system is a novelty by itself, and these properties will be checked statically by the analyses designed as part of this program. Impact. The current limitations of static program analysis tools, in particular their lack of precision and scalability, have been established and quantified by the research community. Providing novel designs that focus on overcoming these limitations will therefore enable the development of novel scalable and precise analyses. Moreover, the tools that will be developed based on these designs, such as the analysis that we instantiate for security and resource usage, will have an impact on the practitioners themselves, and on the quality of the applications developed with such tools being used in the development process.