Abstract: In one embodiment, a method includes analyzing one or more first numeric constraints and one or more first string constraints associated with a software module including one or more numeric variables and string variables; inferring one or more second numeric constraints applying to specific ones of the string variables; inferring one or more second string constraints applying to specific ones of the numeric variables; representing each one of the first and second numeric constraints with an equation; representing each one of the first and second string constraints with a finite state machine; and testing the software module for one or more possible errors by attempting to solve for a solution including one or more values for specific ones of the numeric and string variables that satisfies all the first and second numeric constraints and all the first and second string constraints.

Abstract: In one embodiment, a method includes analyzing one or more first numeric constraints and one or more first string constraints associated with a software module including one or more numeric variables and string variables; inferring one or more second numeric constraints applying to specific ones of the string variables; inferring one or more second string constraints applying to specific ones of the numeric variables; representing each one of the first and second numeric constraints with an equation; representing each one of the first and second string constraints with a finite state machine; and validating the software module with respect to one or more requirements associated with the software module by attempting to solve for a solution including one or more values for specific ones of the numeric and string variables that satisfies all the first and second numeric constraints, all the first and second string constraints, and all the requirements.

Abstract: In one embodiment, a method includes analyzing one or more first numeric constraints and one or more first string constraints associated with a software module including one or more numeric variables and string variables; inferring one or more second numeric constraints applying to specific ones of the string variables; inferring one or more second string constraints applying to specific ones of the numeric variables; representing each one of the first and second numeric constraints with an equation; representing each one of the first and second string constraints with a finite state machine; and verifying whether the software module is able to detect one or more forms of injection attacks by attempting to solve for a solution including one or more values for specific ones of the numeric and string variables that satisfies all the first and second numeric constraints and all the first and second string constraints.

Abstract: In one embodiment, a method may include symbolically executing application code on a first framework. The method may also include creating a first model based on the symbolic execution of the first framework. The method may additionally include symbolically executing the application code on a second framework. The method may further include creating a second model based on the symbolic execution of the first framework. The method may also include determining one or more parameters associated with the first framework based on the first model. The method may additionally include determining one or more parameters associated with the second framework based on the second model. The method may also include selecting one of the first framework and the second framework as a desired framework for execution of the application code based on a comparison of the one or more parameters associated with the first framework and the one or more parameters associated with the second framework.

Abstract: In one embodiment, constructing one or more sets of variables corresponding to one or more input variables of a software module respectively; for each one of the sets of variables, computing an average branching depth that is affected by the set of variables; selecting a first one of the sets of variables that has the smallest average branching depth; assigning a first symbolic value to the input variable of the first set of variables; symbolically executing the software module to generate a first set of test cases for the first set of variables; optionally compacting the first set of test cases by removing the redundant tests that do not increase test coverage and selecting a minimal subset of the first set of test cases that cover all the covered conditional branch points; and validating the software module using the first set of test cases.

Abstract: In one embodiment, a method includes accessing an event-driven application input by a user, the event-driven application comprising source code, one or more use cases input by the user for the event-driven application, and one or more functional requirements input by the user for the event-driven application; parsing the use cases and the functional requirements according to the predefined syntax to construct one or more validation modules for validating the event-driven application without any modification to the source code of the event-driven application for validation purposes; formally validating the event-driven application using the validation modules without relying on assertions inserted into the source code of the event-driven application for validation purposes; and if the formal validation finds one or more defects in the event-driven application, generating output for communication to the user identifying the defects.

Abstract: In particular embodiments, an environment for modular software analysis is generated for a software module under analysis. Irrelevancy analysis is performed on the software module to determine that, for each input datum to the software module, whether the input datum is relevant or irrelevant with respect to branch coverage of the module code. A default concrete value is assigned to each irrelevant input datum. A set of concrete values is calculated for each relevant input datum using symbolic execution. The environment is enhanced such that default concrete values are passed to the software module for the irrelevant input data and sets of concrete values generated using symbolic execution are passed to the software module for the relevant input data. The enhanced environment enables module analysis with as much as 100% branch coverage of the module code.

Abstract: In one embodiment, a method includes accessing software comprising one or more inputs, one or more variables, and one or more segments of code that when executed operate on one or more of the inputs or one or more of the variables. The method includes, for every variable, determining whether the variable is relevant or irrelevant to a set of the inputs when expressed symbolically and, if the variable is relevant, instrumenting the variable and every one of the segments of code associated with the variable. A segment of code is associated with the variable if the variable affects the segment of code when executed. The method includes symbolically executing the software with every relevant variable and its associated segments of code as instrumented to test the software.

Abstract: In one embodiment, a method include accessing one or more global temporal requirements of an application specified using one or more requirement templates from a library of requirement templates, accessing a model of the application, generating one or more symbolic expressions of one or more of the global temporal requirements of the application, searching a state space of the application model with a model checker, monitoring the search of the state space for events in the state space encompassed by the symbolic expressions and modifying construction of a graph of the state space in response to occurrence of one or more events encompassed by the symbolic expressions, evaluating the symbolic expressions based on the graph of the state space to determine whether one or more of the global temporal requirements are valid, and communicating one or more results of the evaluation of the symbolic expressions for presentation to a user.

Abstract: A method for detecting software defects includes selecting from a target program comprising a plurality of modules a first module for evaluation and isolating the first module. The method also includes iteratively performing the following steps until the first module has been reduced such that a validation program is able to determine whether the first module contains a defect: generating an environment surrounding the first module, the generated environment preserving at least one external constraint on the first module; reducing the size of the first module; and reducing the number of program states associated with the first module.

Abstract: In accordance with a particular embodiment of the present invention, a method is offered that includes supporting requirement validation middleware and capturing global requirements or properties for one or more web applications. A template-based formalism is employed to capture the requirements or properties. A small set of relevant temporal patterns are provided from which to choose in capturing the global requirements or properties. In specific embodiments, the method uses a set of pre-coded semi-configurable checkers. A Java-like syntax is used to specify expressions. A library of atomic entities or events (to compose expressions) is automatically generated. In still other embodiments, a small set of light-weight automatically-customizable checkers are employed in capturing the global requirements or properties. The method can be used with both formal and semi-formal techniques.

Abstract: In accordance with a particular embodiment of the present invention, a method is offered that includes generating a symbolic string manipulation class library for one or more web applications. The manipulations are generalized into a string manipulation symbolic algebra. The method also includes performing symbolic execution for one or more web applications. Typically, a Java model checker is augmented to check for certain types of requirements or properties in performing the symbolic execution. If an error scenario exists, a solution to a set of symbolic constraints is obtained, and the solution is mapped back to a source code to obtain an error trace and a test case. In still other specific embodiments, requirements or properties are encoded through templates and checked using public domain decision procedures. The properties or requirements can relate to security validation. The symbolic execution can be customized and tuned for Java-based web applications.

Abstract: In accordance with a particular embodiment of the present invention, a method is offered that includes detecting one or more defects in a software application composed of heterogeneous languages using a configurable web services architecture. The detecting step further includes: capturing use cases associated with the software application and checking their validity; providing an automatic invocation of property monitors for model checking; and visualizing one or more defects in the software application for diagnosis. The detecting can further include transforming a heterogeneous software application into a homogeneous application. In more specific embodiments, the detecting further includes providing an automatic test generation for a presentation layer associated with the software application. The configuration associated with the software application can be a simple properties file.

Abstract: Estimating the difficulty level of a verification problem includes receiving input comprising a design and properties that may be verified on the design. Verification processes are performed for each property on the design. A property verifiability metric value is established for each property in accordance with the verification processes, where a property verifiability metric value represents a difficulty level of verifying the property on the design. A design verifiability metric value is determined from the property verifiability metric values, where the design verifiability metric value represents a difficulty level of verifying the design.

Abstract: A method for detecting software defects includes selecting from a target program comprising a plurality of modules a first module for evaluation and isolating the first module. The method also includes iteratively performing the following steps until the first module has been reduced such that a validation program is able to determine whether the first module contains a defect: generating an environment surrounding the first module, the generated environment preserving at least one external constraint on the first module; reducing the size of the first module; and reducing the number of program states associated with the first module.

Abstract: A method for event-driven observability enhanced coverage analysis of a program parses a program into variables and data dependencies, wherein the data dependencies comprise assignments and operations. The method builds a data structure having multiple records, with each record having at least one data dependency, a parent node, and a child node. Each node is linked to a variable. The method computes the value of each variable using the data structure. The method performs tag propagation based, at least in part, on the data dependencies and computed values.

Abstract: Estimating the difficulty level of a verification problem includes receiving input comprising a design and properties that may be verified on the design. Verification processes are performed for each property on the design. A property verifiability metric value is established for each property in accordance with the verification processes, where a property verifiability metric value represents a difficulty level of verifying the property on the design. A design verifiability metric value is determined from the property verifiability metric values, where the design verifiability metric value represents a difficulty level of verifying the design.

Abstract: Propagating an error through a network includes receiving a network having propagation paths and nodes, where a propagation path has one or more nodes and a node is associated with a variable operable to have a value during simulation. A tag of a tag set is assigned to the value. The tag set includes at least two signed tags, positive tag representing a positive error and a negative tag representing a negative error, and an unsigned tag representing an error having an unknown sign. The tag is propagated along the propagation path to yield intermediate tags, where at least one intermediate tag is an unsigned tag formed from at least two signed tags. A final tag is determined in accordance with the intermediate tags in order to propagate an error through the network.

Abstract: Generating a test environment includes accessing initial test environments for a network of nodes, where a test environment specifies a propagation or justification path for a node. The following are repeated until satisfactory coverage is achieved or until a predetermined number of iterations is reached. A coverage for each test environment is calculated, and at least two of the test environments are mated to generate next test environments, where the coverage of the at least two test environments is greater than the coverage of the other test environments.

Abstract: Evaluating a validation vector includes receiving a network having nodes and a target set that includes one or more nodes of the network. The following steps are repeated until the nodes of the target set have been selected. A node is selected from the target set, and a tag is assigned to the node, where the tag represents an error of a value of a variable corresponding to the node. A test environment specifying a propagation path from an input, through the node, and to an output is generated. The test environment is translated into a validation vector, and the tag is propagated to the output according to the validation vector. After repeating the steps, coverage for the validation vectors is determined in accordance with the propagation to evaluate the one or more validation vectors.