Abstract:Automatic verification of concurrent programs faces state explosion due to the exponential possible interleavings of its sequential components coupled with large or infinite state spaces. An alternative is deductive verification, where given a candidate invariant, we establish inductive invariance and show that any state satisfying the invariant is also safe. However, learning (inductive) program invariants is difficult. To this end, we propose a data-driven procedure to synthesize program invariants, where it is assumed that the program invariant is an expression that characterizes a (hopefully tight) over-approximation of the reachable program states. The main ideas of our approach are: (1) We treat a candidate invariant as a classifier separating states observed in (sampled) program traces from those speculated to be unreachable. (2) We develop an enumerative, template-free approach to learn such classifiers from positive and negative examples. At its core, our enumerative approach employs decision trees to generate expressions that do not over-fit to the observed states (and thus generalize). (3) We employ a runtime framework to monitor program executions that may refute the candidate invariant; every refutation triggers a revision of the candidate invariant. Our runtime framework can be viewed as an instance of statistical model checking, which gives us probabilistic guarantees on the candidate invariant. We also show that such in some cases, our counterexample-guided inductive synthesis approach converges (in probability) to an overapproximation of the reachable set of states. Our experimental results show that our framework excels in learning useful invariants using only a fraction of the set of reachable states for a wide variety of concurrent programs.

Detecting Functional Dependence Program Invariants Based on Data Mining

Learning Likely Invariants to Explain Why a Program Fails

Application of Data Mining Technology in Software Engineering

Interactive Data Dependence Analysis Based on Range Tests

Invariant Detection with Program Verification Tools

Do I Use the Wrong Definition?

A novel data-driven approach on inferring loop invariants for C programs

Statistically Significant Sequential Pattern Mining Applying to Software Defect Prediction

C++ Program Information Database For Analysis Tools

Using Dynamic Analysis to Generate Disjunctive Invariants

A Pattern of Experiment Data Mining Based on Π Theorem Combined with ANN

Data Mining in Software Maintenance

Detection Software Content Failures Using Dynamic Execution Information

Infer Precise Program Invariant Using Abstract Interpretation with Recurrence Solving.

Data-Driven Template-Free Invariant Generation

Dynamical System Theory for the Detection of Anomalous Behavior in Computer Programs

Automatically Identifying Domain Variables Based on Data Dependence Graph

Alattin: Mining Alternative Patterns for Defect Detection

Post-condition-Directed Invariant Inference for Loops over Data Structures.

Efficient Discovery of Functional Dependencies with Degrees of Satisfaction.

Data Dependence Analysis in Presence of Inheritance and Polymorphism