Abstract: A method for buffer overflow detection involves obtaining a program code configured to access memory locations in a loop using a buffer index variable, obtaining an assertion template configured to capture a dependency between the buffer index variable and a loop index variable of the loop in the program code, generating an assertion using the assertion template, verifying that the assertion holds using a k-induction; and determining whether a buffer overflow exists using the assertion.

Abstract: A method for detecting a defect may include extracting, from application code and using a framework support specification corresponding to a framework, a framework interaction between the application code and the framework. The framework interaction specifies an object used by the application code and managed by the framework. The method may further include performing, using the framework interaction, a dynamic analysis of the application code to obtain a heap snapshot, performing, using the heap snapshot and the framework interaction, a static analysis of the application code, and detecting, by the static analysis, the defect.

Abstract: A source host device masks the hardware address of a hosted container from a network device to mitigate the use of resources in the network device. A virtual switch on the source host receives a frame from a hosted container. The frame includes a source hardware address of the hardware address corresponding to the hosted container. The frame also includes a source network address of the network address corresponding to the hosted container. The virtual switch replaces the source hardware address of the frame with the hardware address associated with the source host, and send the frame to the network device. The frame sent to the network device includes the host hardware address as the source hardware address and the container network address as the source network address.

Abstract: A method may include generating, by performing a full analysis of code and for each component of the code, summaries including: (i) a forward summary including a forward flow and (ii) a backward summary including a backward flow, obtaining a modification to a modified component, determining that one of the summaries for the modified component is invalid, and in response to determining that a summary for the modified component is invalid: obtaining the forward flow from the forward summary of the modified component, obtaining the backward flow from the backward summary of the modified component, generating a local flow by performing an incremental analysis of the modified component using the forward flow of the modified component and the backward flow of the modified component, and detecting a defect in the code using the forward flow of the modified component, the local flow, and the backward flow of the modified component.

Abstract: Textual masking for multiparty computation is provided. The method comprises receiving masked input data from a number of contributors, wherein the input data from each contributor has a unique contributor mask value. A unique analyst mask factor is received for each contributor, computed by an analyst as a difference between a uniform analyst mask value and the contributor mask value. An API call is received from the analyst to aggregate the input data from the contributors. The respective analyst mask factors are added to the input data from the contributors, and the data is aggregated and shuffled. Computational results received from the analyst based on the aggregated input data are published. In response to API calls from the contributors, the analyst mask factors are removed from the computational results, wherein computational results received by each contributor are masked only by the respective contributor mask value.

Abstract: A method may include receiving a network schema including switches, links connecting the switches, and a topology that maps the switches to the links. The switches may include ports. The method may further include receiving a software defined networking (SDN) policy including a function that modifies a state of a packet entering a switch, converting the topology to a graph including nodes corresponding to the switches, while searching the graph, determining, according to the function, whether a port of a switch corresponding to a node is reachable by the packet entering the switch, and in response to searching the graph, verifying a property of the SDN policy.

Abstract: In a secure multi-party computation (sMPC) system, a super mask is constructed using a set of masks corresponding to a set of data contributors. Each data contributor uses a corresponding different mask to obfuscate the data of the data contributor. a first scaled masked data is formed by applying a first scale factor to first masked data of the first data contributor, the scale factor being computed specifically for the first data contributor from the super mask. A union is constructed of all scaled masked data from all data contributors, including the first scaled masked data. A machine learning (ML) model is trained using the union as training data, where the union continues to keep obfuscated the differently masked data from the different data contributors. The training produces a trained ML model usable in the sMPC with the set of data contributors.

Abstract: A method may include generating, by performing a full analysis of code and for each component of the code, summaries including: a forward summary including a forward flow, and a backward summary including a backward flow, obtaining a modification to a modified component, determining that one of the summaries for the modified component is invalid, and in response to determining that a summary for the modified component is invalid: obtaining the forward flow from the forward summary of the modified component, obtaining the backward flow from the backward summary of the modified component, generating a local flow by performing an incremental analysis of the modified component using the forward flow of the modified component and the backward flow of the modified component, and detecting a defect in the code using the forward flow of the modified component, the local flow, and the backward flow of the modified component.

Abstract: Techniques for virtual workload deployment based on computing resource hardware load and associated network hardware load. For each of a plurality of computing resources within one or more data centers onto which a virtual workload can be deployed, a computing resource hardware load of the respective computing resource is determined. Network topology information is maintained for at least one network fabric of the one or more data centers, and an associated network hardware load of a network device communicatively connected to the respective computing resource is determined. Embodiments automatically select one or more computing resources. The virtual workload is deployed onto the automatically selected one or more computing resources.

Abstract: A method may include determining that a source variable in code receives a source value from a source function specified by a target analysis, determining that a source statement in the code writes, using the source variable, the source value to a column in a table, obtaining, for a sink statement in the code, a set of influenced variables influenced by the source variable, determining that the sink statement reads the source value into a sink variable including an identifier of the column, generating a modified set of influenced variables by adding the sink variable to the set of influenced variables, and reporting a defect at the sink statement.

Abstract: A method may include generating, by performing a full analysis of code and for each component of the code, summaries including: (i) a forward summary including a forward flow and (ii) a backward summary including a backward flow, obtaining a modification to a modified component, determining that one of the summaries for the modified component is invalid, and in response to determining that a summary for the modified component is invalid: obtaining the forward flow from the forward summary of the modified component, obtaining the backward flow from the backward summary of the modified component, generating a local flow by performing an incremental analysis of the modified component using the forward flow of the modified component and the backward flow of the modified component, and detecting a defect in the code using the forward flow of the modified component, the local flow, and the backward flow of the modified component.

Abstract: A method for performing a static analysis may include extracting, from a caller function in code, a context-free inter-procedural rule including a callsite and a return value of a callee function. The callsite may invoke the callee function. The method may further include extracting, from the caller function, a context-sensitive parameter mapping rule that maps an input parameter of the callee function to an invocation value provided by the caller function at the callsite, deriving a derived value for the callsite using the context-free inter-procedural rule and the context-sensitive parameter mapping rule, and identifying a defect in the code by performing the static analysis using the derived value for the callsite.

Abstract: A method for evaluating a test suite for a software library includes generating a mutated software library by adding a fault to the software library, while the software library is used by a testing tool to evaluate a test suite. The method further includes loading the mutated software library, then executing a test in the test suite on the mutated software library to obtain a test result. The method further includes analyzing the test result.

Abstract: A method for buffer overflow detection involves obtaining a program code configured to access memory locations in a loop using a buffer index variable, obtaining an assertion template configured to capture a dependency between the buffer index variable and a loop index variable of the loop in the program code, generating an assertion using the assertion template, verifying that the assertion holds using a k-induction; and determining whether a buffer overflow exists using the assertion.

Abstract: A method may include executing operation types on a concurrent data structure to obtain executed operations. Each executed operation may cause a transition from a preceding state to a subsequent state. The method may further include recording each executed operation to obtain recorded operations, and assembling a concurrent history from the recorded operations. The concurrent history may include a subset of the recorded operations, and the concurrent history may impose overlapping and non-overlapping relationships on the subset of recorded operations. The method may further include checking whether the concurrent history has an equivalent linearization including a total sequential ordering of the subset of recorded operations, and reporting an error when the concurrent history has no equivalent linearization.

Abstract: A method for analyzing code may include generating, via a flow-insensitive points-to analysis, initial interest points each corresponding to a statement in the code, generating, via a flow-sensitive points-to analysis, flow tuples and refined interest points by removing a subset of the initial interest points, and constructing a flow graph using the refined interest points. The flow graph may include nodes each corresponding to a statement in the code, and edges corresponding to the flow tuples. The method may further include identifying a trace through the flow graph. The trace may include a node corresponding to an interest point of the refined interest points.

Abstract: A method for analyzing code may include determining, using a dependency graph for the code, modules each including function definitions, and generating source points-to tuples and a call graph for a source function definition in a first module. The source points-to tuples may include a source tuple including a source variable and a source allocation site. The source allocation site may be a reference to a location in a memory of a computer system allocated when the source function definition is executed. The method may further include determining, using the call graph and until a fixedpoint condition is triggered, target function definitions reachable from the source function definition, determining that a target summary is stored for a first target function definition, and importing the target summary into a source summary for the source function definition. The source summary may include the source points-to tuples.

Abstract: In one embodiment a method includes receiving a first message including information regarding a first host connected to a first tunnel endpoint in a first network domain, the received information being encoded in accordance with a control plane protocol of the first network domain; translating the received first message in accordance with an API and/or a database schema of a second network domain; and transmitting the translated first message to the second network domain. The method further includes receiving a second message comprising information regarding a second host connected to a second tunnel endpoint in the second network domain, the received information being encoded in accordance with the API and/or the database schema of the second network domain; translating the second received message in accordance with the control plane protocol of the first network domain; and transmitting the translated second message to the first network domain.

Abstract: A system and a method for automatically detecting and configuring server uplink network interfaces in a network environment. An exemplary method includes receiving a discovery packet from a network element on a network interface of a server connected to the network element; evaluating the discovery packet to determine whether the network element possesses virtual bridging capabilities; and configuring the network interface of the server as an uplink interface for communicating with a network when the discovery packet indicates that the network element possesses virtual bridging capabilities.

Abstract: A method for points-to program analysis includes extracting a kernel from a program, performing a fixed object sensitive points to analysis of the kernel to obtain fixed analysis results, and assigning, for a first candidate object in the kernel, a first context depth to the first candidate object. The candidate objects are identified using the fixed analysis results. The method further includes assigning, for a second candidate object, a second context depth to the second candidate object. The second context depth is different than the first context depth. The method further includes performing, to obtain selective analysis results, a selective object sensitive points to analysis using the first context depth for the first candidate object and the second context depth for the second candidate object, and performing an action based on the selective analysis results.