De­si­gning code ana­ly­ses for lar­ge-sca­le soft­ware sys­tems 2 (DE­CA 2) SS2024

News

Cour­se num­ber and lan­gua­ge

L.079.05800

The teaching language will be English. Questions in German will be permitted.

Re­gis­te­ring and com­mu­ni­ca­ting

To attend the course, you have to register in the PAUL system as a participant.

To ask questions, please use the discussion forum in PANDA, so that others can benefit from the answers as well.

If needed, we will also send updates through PANDA circulars.

Sche­du­le

Ab­s­tract

Static code analysis is used to detect bugs and security breaches, and aids compiler optimization. It has been an area of research since the past several decades. This course explains several novel, advanced concepts out of cutting-edge research (such as weighted pushdown systems and demand-driven program analyses) and also introduces some interesting (and recently developed) tools. Most of these concepts are very recent and hence give an excellent overview of what static analysis researchers are currently working on. Example applications are drawn from the area of IT security.

Cour­se struc­ture

Each week, two hours will be dedicated to the lecture, and three hours will be dedicated to concrete exercise classes and programming labs.

In the exercise sessions, you will be able to apply the notions seen during the lecture into more concrete topics, preparing you to present your knowledge (with respect to the final exam).

The goal of the programming labs is to introduce you to recent program analysis tools, and deepen your knowledge and understanding of the notions seen in the lecture and exercise sessions. The lab assignments will mostly be done at home, using the scheduled lab hours to answer questions on the ongoing lab.

If you have questions to the organisation of the course, the topic, the exercises, or the labs, or if you get stuck when solving the exercises or labs, please use the forum in PANDA. We try to answer on a regular basis and as soon as possible.

Eva­lua­ti­on

Graded exercise sheets:

  • During the semester, you will have to hand in six graded exercise sheets.
  • Each sheet has to be handed in through PANDA before 8 am on its due date.
  • Late submissions will not be accepted.
  • Plagiarism will result on a 0 grade for the exercise sheets and will be reported to the department. It can result in severe consequences such as financial fine and expulsion from the university.

Graded labs:

  • During the semester, you will have to hand in four labs.
  • Each lab has to be handed in through PANDA before 8 am on its due date.
  • Late submissions will not be accepted.
  • Plagiarism will result on a 0 grade for the labs and will be reported to the department. It can result in severe consequences such as financial fine and expulsion from the university.

Labs are not required for course achievement. However, you will get the following bonus if you submit labs:

  • If you scored 70% or more, you will receive a bonus of 0.3 on your final grade.
  • If you scored 90% or more, you will receive a bonus of 0.7 on your final grade.

Final exam:

At the end of the course, you will have the opportunity to register for the oral exam based on your exercise sheets grade:

  • If you scored below 50%, you cannot register for the exam.
  • If you scored 50% or more, you can register for the exam.

Pre­re­qui­si­tes

The course Designing code analyses for large-scale software systems (DECA) 1 is a required prerequisite. A mature understanding of the Java programming language and object-oriented programming will be helpful.

Syl­la­bus

Topics covered include:

  • Sparse IFDS
  • SPLLIFT
  • Pushdown Systems, WPDS Frameworks
  • Demand-Driven Program Analysis
  • Synchronised Pushdown Systems, Boomerang
  • Introduction to CogniCrypt, FlowDroid
  • Handling Reflection
  • Hybrid Analysis
  • Heapster
  • SWAN/SWAN Assist
  • Improved User Experience

Throughout the course and the exercise sessions, we will discuss applications to software security.

Lear­ning out­co­mes

After having attended this course, students will have learned…

  • how to make educated design decisions when designing automated code analysis for large-scale software systems,
  • which algorithms have which properties when using them to implement static code-analyses,
  • how to design real–world code analyses for practical problem cases from the area of IT security,
  • which current tools are used for program analysis, what their limitations are and where they can be applied.

Re­com­men­ded rea­ding ma­te­ri­al

We will not be able to provide a script for this course. We will provide powerpoint slides where available, but will develop some concepts also on the blackboard. Students are highly encouraged to take their own copies during their lecture.

A lot of the material is also covered in the following books and papers, however, those publications present the material in a more complex manner than in the lectures, which is why they should mostly be used for deeper personal study.