Abstract
Many safety-critical systems rely on software to operate. To check the underlying software, researchers have introduced a number of program analysis techniques which can identify problematic behaviors. Software systems continue to grow in complexity, making these techniques more costly. When designing or utilizing program analysis, there are often locations where the analysis has multiple ways of proceeding, such as which conditional branch the algorithm should check or, more broadly, which program analysis technique should be used. Traditionally, these ambiguous points have been handled using hardcoded heuristics written by the developers of the program analysis. These heuristics are limited by the knowledge of the developer and are unable to adapt to different use cases. Recently, machine learning models have been shown to outperform heuristic approaches, as they are data driven and can be trained for a given scenario.
In this dissertation, we propose Graph Representations for Adaptive Semantic Program Analysis (GRASP), a general framework for designing machine learning models which can be deployed in place of these heuristics. GRASP utilizes traditional program graphs, such as abstract syntax trees and control flow graphs, to represent software. These graph representations are then given to a graph neural network which has been trained to solve the task at hand. Prior graph learning approaches to program analysis were ad-hoc, making them difficult to apply to new problems. GRASP is designed to be as general as possible, allowing users to select from a wide variety of graph representations which may be applicable to a given problem. Further, we introduce Graph and Graph Neural Architecture Search, an automated approach for configuring GRASP which we demonstrate can identify GRASP configurations which perform as well as if an expert configured GRASP.
