Security metrics for Java bytecode programs

Although there are many approaches for developing secure programs, they are not necessarily helpful for evaluating the security of a pre-existing program. Software metrics promise an easy way of comparing the relative security of two programs or assessing the security impact of modifications to an existing one. Most studies in this area focus on high level source code but this approach fails to take compiler-specific code generation into account. In this work we describe a set of object-oriented Java bytecode security metrics which are capable of assessing the security of a compiled program from the point of view of potential information flow. These metrics can be used to compare the security of programs or assess the effect of program modifications on security using a tool which we have developed to automatically measure the security of a given Java bytecode program in terms of the accessibility of distinguished ‘classified’ attributes.

A rare view: Barbara Hatley’s new book documents a career-long study of, and passion for performance in Central Java

Javanese Performances on an Indonesian Stage: Contesting Culture, Embracing Change, is Barbara Hatley’s first book about the performing arts in Indonesia, a topic that piqued her interest while undergoing a masters program at Yale University in the late 1960s. In this sense, it is a landmark study, for Hatley has since become very well known in Indonesianist circles, especially among those with an interest in matters of culture, popular and elite. Until recently, her writings on Indonesian performing arts have only been available in the form of journal articles and book chapters...

LLVM-kääntäjäarkkitehtuuri ja sen soveltuvuus Java-virtuaalikoneen toteutuspohjaksi

Low Level Virtual Machine (LLVM) on moderni koko ohjelman elinkaaren optimointeihin keskittyvä kääntäjäarkkitehtuuri. Java-virtuaalikone on puolestaan suosittu korkean tason virtuaalikone, johon monien ohjelmointikielten toteutus nykyään perustuu. Tutkielmassa esitellään alun perin suorituskykyisen C- ja C++-kääntäjän toteuttamiseksi luotu LLVM-järjestelmä ja arvioidaan, miten hyvin LLVM-infrastruktuuri tukee Java-virtuaalikoneen toteuttamista. Tämän lisäksi tutkielmassa pohditaan, miten dynaamisten kielten usein tarvitsemaa suoritusaikaista ja lähdekieliriippuvaista optimointia voidaan tukea lähdekieliriippumattomassa LLVM-järjestelmässä. Lopuksi tutkielmassa esitellään kehitysehdotelma yleisen roskienkeruuinfrastruktuurin toteuttamiseksi LLVM:ssä, mikä tukisi dynaamista muistia automaattisesti hallitsevien kielten, kuten Javan ja sen virtuaalikoneen toteuttamista.

Field Flow Sensitive Pointer and Escape Analysis for Java Using Heap Array SSA

Context sensitive pointer analyses based on Whaley and Lam’s bddbddb system have been shown to scale to large Java programs. We provide a technique to incorporate flow sensitivity for Java fields into one such analysis and obtain an escape analysis based on it. First, we express an intraprocedural field flow sensitive analysis, using Fink et al.’s Heap Array SSA form in Datalog. We then extend this analysis interprocedurally by introducing two new φ functions for Heap Array SSA Form and adding deduction rules corresponding to them. Adding a few more rules gives us an escape analysis. We describe two types of field flow sensitivity: partial (PFFS) and full (FFFS), the former without strong updates to fields and the latter with strong updates. We compare these analyses with two different (field flow insensitive) versions of Whaley-Lam analysis: one of which is flow sensitive for locals (FS) and the other, flow insensitive for locals (FIS). We have implemented this analysis on the bddbddb system while using the SOOT open source framework as a front end. We have run our analysis on a set of 15 Java programs. Our experimental results show that the time taken by our field flow sensitive analyses is comparable to that of the field flow insensitive versions while doing much better in some cases. Our PFFS analysis achieves average reductions of about 23% and 30% in the size of the points-to sets at load and store statements respectively and discovers 71% more “caller-captured” objects than FIS.

Dynamic path profile aided recompilation in a JAVA just-in-time compiler

Just-in-Time (JIT) compilers for Java can be augmented by making use of runtime profile information to produce better quality code and hence achieve higher performance. In a JIT compilation environment, the profile information obtained can be readily exploited in the same run to aid recompilation and optimization of frequently executed (hot) methods. This paper discusses a low overhead path profiling scheme for dynamically profiling AT produced native code. The profile information is used in recompilation during a subsequent invocation of the hot method. During recompilation tree regions along the hot paths are enlarged and instruction scheduling at the superblock level is performed. We have used the open source LaTTe AT compiler framework for our implementation. Our results on a SPARC platform for SPEC JVM98 benchmarks indicate that (i) there is a significant reduction in the number of tree regions along the hot paths, and (ii) profile aided recompilation in LaTTe achieves performance comparable to that of adaptive LaTTe in spite of retranslation and profiling overheads.

Java Memory Model aware Software validation

The Java Memory Model (JMM) provides a semantics of Java multithreading for any implementation platform. The JMM is defined in a declarative fashion with an allowed program execution being defined in terms of existence of "commit sequences" (roughly, the order in which actions in the execution are committed). In this work, we develop OpMM, an operational under-approximation of the JMM. The immediate motivation of this work lies in integrating a formal specification of the JMM with software model checkers. We show how our operational memory model description can be integrated into a Java Path Finder (JPF) style model checker for Java programs.

Does lean imply green?: a study of the power performance implications of Java runtime bloat

The presence of software bloat in large flexible software systems can hurt energy efficiency. However, identifying and mitigating bloat is fairly effort intensive. To enable such efforts to be directed where there is a substantial potential for energy savings, we investigate the impact of bloat on power consumption under different situations. We conduct the first systematic experimental study of the joint power-performance implications of bloat across a range of hardware and software configurations on modern server platforms. The study employs controlled experiments to expose different effects of a common type of Java runtime bloat, excess temporary objects, in the context of the SPECPower_ssj2008 workload. We introduce the notion of equi-performance power reduction to characterize the impact, in addition to peak power comparisons. The results show a wide variation in energy savings from bloat reduction across these configurations. Energy efficiency benefits at peak performance tend to be most pronounced when bloat affects a performance bottleneck and non-bloated resources have low energy-proportionality. Equi-performance power savings are highest when bloated resources have a high degree of energy proportionality. We develop an analytical model that establishes a general relation between resource pressure caused by bloat and its energy efficiency impact under different conditions of resource bottlenecks and energy proportionality. Applying the model to different "what-if" scenarios, we predict the impact of bloat reduction and corroborate these predictions with empirical observations. Our work shows that the prevalent software-only view of bloat is inadequate for assessing its power-performance impact and instead provides a full systems approach for reasoning about its implications.

Programazioaren oinarriak: C-ko eta Java-ko praktikak

Helburuak: Ikasmaterial honen helburu nagusia ikasleek C-ko eta Java-ko klase teorikoetan lantzen dituzten ezagutzak sendotzea da. Norentzat: Programazioari buruzko lehen ezagutzak sendotu nahi dituen edozein ikasleei zuzenduta, baina bereziki telekomunikazio ikasketak egiten ari diren ikasleei.

Effects of El Niño–Southern Oscillation events on catches of Bigeye Tuna (Thunnus obesus) in the eastern Indian Ocean off Java

The effects of El Niño–Southern Oscillation events on catches of Bigeye Tuna (Thunnus obesus) in the eastern Indian Ocean (EIO) off Java were evaluated through the use of remotely sensed environmental data (sea-surface-height anomaly [SSHA], sea-surface temperature [SST], and chlorophyll a concentration), and Bigeye Tuna catch data. Analyses were conducted for the period of 1997–2000, which included the 1997–98 El Niño and 1999–2000 La Niña events. The empirical orthogonal function (EOF) was applied to examine oceanographic parameters quantitatively. The relationship of those parameters to variations in catch distribution of Bigeye Tuna was explored with a generalized additive model (GAM). The mean hook rate was 0.67 during El Niño and 0.44 during La Niña, and catches were high where SSHA ranged from –21 to 5 cm, SST ranged from 24°C to 27.5°C, and chlorophyll-a concentrations ranged from 0.04 to 0.16 mg m–3. The EOF analysis confirmed that the 1997–98 El Niño affected oceanographic conditions in the EIO off Java. The GAM results indicated that SST was better than the other environmental factors (SSHA and chlorophyll-a concentration) as an oceanographic predictor of Bigeye Tuna catches in the region. According to the GAM predictions, the highest probabilities (70–80%) for Bigeye Tuna catch in 1997–2000 occurred during oceanographic conditions during the 1997–98 El Niño event.

并发Java程序同步操作的有效删除

同步操作是并发Java程序非常大的一部分开销.在现有程序分析方法的基础上,提出了一种精确而有效的冗余同步操作的静态删除方法.该方法分为基本处理和线程间时序分析两个阶段,充分考虑了控制流结构和线程交互时序对同步删除的影响.构造了一个Java编译器JTool,并在其上实现了同步删除算法.对于确定的单线程程序,同步删除率达到100%;对于多线程程序,同步删除率高于现有的分析工具.

基于素数序列的Java哈希表性能优化

分析了Java哈希表的实现特点并给出了导致其性能恶化的一种数据模式.针对这种数据模式的特点,提出了基于素数序列的哈希表优化方法,从而几乎完全避免了该模式下哈希表的性能恶化.实验与理论结果表明:对提出的模式数据,优化方法产生的Hash碰撞比JDK中的方法下降接近100%,而且对随机数据下的Java哈希表性能也有改善.

Java程序中数组越界和空指针错误的静态分析

介绍了静态分析的相关背景知识,对Java程序中数组越界和空指针错误的常见表现形式进行了归类,并通过实验评估了现有的Java静态分析工具功能,指出了其在跨过程分析中的不足,并对如何改进进行了讨论.

一种用于APLA→JAVA系统可靠性评估模型

软件可靠性问题是软件测试中的重要难题之一,由于程序语言的复杂性以及被测程序的多样性,一直没有一个好的可靠性模型来评价它.鉴于此,依据软件可靠性工程理论,参考APLA→JAVA系统的特点,提出了一种基于测试的软件可靠性评估模型,讨论了模型的参数评估和置信区间,并给出了模型的评价方案.数据分析表明该模型具有合理性和可行性.