When analyzing programs, large libraries pose significant challenges to static points-to analysis. A popular solution is to have a human analyst provide points-to specifications that summarize relevant behaviors of library code, which can substantially improve precision and handle missing code such as native code. We propose ATLAS, a tool that automatically infers points-to specifications. ATLAS synthesizes unit tests that exercise the library code, and then infers points-to specifications based on observations from these executions. ATLAS automatically infers specifications for the Java standard library, and produces better results for a client static information flow analysis on a benchmark of 46 Android apps compared to using existing handwritten specifications.
@article{arxiv.1711.03239,
title = {Active Learning of Points-To Specifications},
author = {Osbert Bastani and Rahul Sharma and Alex Aiken and Percy Liang},
journal= {arXiv preprint arXiv:1711.03239},
year = {2018}
}