Abstract:Automatic verification of concurrent programs faces state explosion due to the exponential possible interleavings of its sequential components coupled with large or infinite state spaces. An alternative is deductive verification, where given a candidate invariant, we establish inductive invariance and show that any state satisfying the invariant is also safe. However, learning (inductive) program invariants is difficult. To this end, we propose a data-driven procedure to synthesize program invariants, where it is assumed that the program invariant is an expression that characterizes a (hopefully tight) over-approximation of the reachable program states. The main ideas of our approach are: (1) We treat a candidate invariant as a classifier separating states observed in (sampled) program traces from those speculated to be unreachable. (2) We develop an enumerative, template-free approach to learn such classifiers from positive and negative examples. At its core, our enumerative approach employs decision trees to generate expressions that do not over-fit to the observed states (and thus generalize). (3) We employ a runtime framework to monitor program executions that may refute the candidate invariant; every refutation triggers a revision of the candidate invariant. Our runtime framework can be viewed as an instance of statistical model checking, which gives us probabilistic guarantees on the candidate invariant. We also show that such in some cases, our counterexample-guided inductive synthesis approach converges (in probability) to an overapproximation of the reachable set of states. Our experimental results show that our framework excels in learning useful invariants using only a fraction of the set of reachable states for a wide variety of concurrent programs.

Dynamical Detecting Technique of Nonfunctional Dependence Program Invariant

Learning Likely Invariants to Explain Why a Program Fails

Using Dynamic Analysis to Generate Disjunctive Invariants

Invariant Detection with Program Verification Tools

A Dynamic Fault Localization Technique with Noise Reduction for Java Programs

Data-Driven Template-Free Invariant Generation

Securing c programs by dynamic type checking

An Adaptive Loop Invariant Generation Approach

A novel data-driven approach on inferring loop invariants for C programs

Infer Precise Program Invariant Using Abstract Interpretation with Recurrence Solving.

Safety Verification of Semi-Algebraic Dynamical Systems Via Inductive Invariant

Dynamical System Theory for the Detection of Anomalous Behavior in Computer Programs

Post-condition-Directed Invariant Inference for Loops over Data Structures.

A Novel Data-Driven Approach for Generating Verified Loop Invariants *

Probabilistic Conditional System Invariant Generation with Bayesian Inference

Affine Disjunctive Invariant Generation with Farkas' Lemma

SLING: using dynamic analysis to infer program invariants in separation logic

Generating Loop Invariants for Program Verification by Transformation

Ilinva: Using Abduction to Generate Loop Invariants

Approach to protecting program running based on program invariants

Beyond the elementary representations of program invariants over algebraic data types