Twinning automata and regular expressions for string static analysis

TL;DR

This paper introduces Tarsis, a novel abstract domain for string analysis using automata over string alphabets, offering more precise results than existing methods by formalizing and proving its soundness.

Contribution

Tarsis is the first approach to use automata over string alphabets in abstract interpretation, enhancing precision in string analysis.

Findings

Tarsis achieves higher precision than existing string analysis tools.

The prototype successfully analyzed Java libraries manipulating strings.

Experimental results validate the theoretical advantages of Tarsis.

Abstract

In this paper we formalize and prove the soundness of Tarsis, a new abstract domain based on the abstract interpretation theory that approximates string values through finite state automata. The main novelty of Tarsis is that it works over an alphabet of strings instead of single characters. On the one hand, such approach requires a more complex and refined definition of the widening operator, and the abstract semantics of string operators. On the other hand, it is in position to obtain strictly more precise results than than state-of-the-art approaches. We implemented a prototype of Tarsis, and we applied it on some case studies taken from some of the most popular Java libraries manipulating string values. The experimental results confirm that Tarsis is in position to obtain strictly more precise results than existing analyses.