JALILI, SAIED, BOLAND GHAMAT AZAR, Hossin (2006). INDUCTIVE LEARNING OF THE OPERATIONAL LOGIC OF A PROGRAM FROM ITS MANY CORRECT EXECUTIONS AND APPLYING IT TO RUNTIME VERIFICATION OF THE PROGRAM EXECUTION. , 6(1), 11-30.
SAIED JALILI; Hossin BOLAND GHAMAT AZAR. "INDUCTIVE LEARNING OF THE OPERATIONAL LOGIC OF A PROGRAM FROM ITS MANY CORRECT EXECUTIONS AND APPLYING IT TO RUNTIME VERIFICATION OF THE PROGRAM EXECUTION". , 6, 1, 2006, 11-30.
JALILI, SAIED, BOLAND GHAMAT AZAR, Hossin (2006). 'INDUCTIVE LEARNING OF THE OPERATIONAL LOGIC OF A PROGRAM FROM ITS MANY CORRECT EXECUTIONS AND APPLYING IT TO RUNTIME VERIFICATION OF THE PROGRAM EXECUTION', , 6(1), pp. 11-30.
JALILI, SAIED, BOLAND GHAMAT AZAR, Hossin INDUCTIVE LEARNING OF THE OPERATIONAL LOGIC OF A PROGRAM FROM ITS MANY CORRECT EXECUTIONS AND APPLYING IT TO RUNTIME VERIFICATION OF THE PROGRAM EXECUTION. , 2006; 6(1): 11-30.

INDUCTIVE LEARNING OF THE OPERATIONAL LOGIC OF A PROGRAM FROM ITS MANY CORRECT EXECUTIONS AND APPLYING IT TO RUNTIME VERIFICATION OF THE PROGRAM EXECUTION

The Modares Journal of Electrical Engineering
Article 2, Volume 6, Issue 1, 2006, Pages 11-30    PDF (2.39 M)
Authors
SAIED JALILI* ; Hossin BOLAND GHAMAT AZAR
TARBIAT MODARRES UNIVERSITY
Abstract
To be sure, that a program behaves correctly at runtime; the behavior of the program should be verified. Where the program source code is available, it is possible to extract the operational logic (i.e., behavior) of the program. But in this paper, programs are considered as black boxes, so no information is available about the operational logic of programs. However, some efforts are spent to learn inductively the operational logic of programs by executing them successfully (i.e., correctly) for many (i.e., > 1000) times and logging their system calls implicitly. Therefore, in the first phase, few mechanisms are developed to discover inductively the loops and branching points of a program using its log system calls. Then, the operational logic of the program is constructed in system call level abstraction by applying a novel method. In the second phase, any deviation of the program execution (in system call level abstraction) from its operational logic (in system call level abstraction) is detected, just like white box approaches. Two major applications for the proposed approach are suggested: (1) to make critical programs somehow, detect their misuses (i.e., buffer overflow attack) by themselves, and (2) to protect programs against their runtime faults. The effectiveness of the proposed approach is demonstrated by some experiments.
Keywords
PROGRAM RUNTIME LOGIC; SYSTEM CALL; DEVIATION OF PROGRAM EXECUTION; PROGRAM MISUSE
Statistics
Article View: 71
PDF Download: 39
Statistics
Number of Journals45
Number of Issues2,174
Number of Articles24,687
Article View25,160,146
PDF Download17,806,292