论文标题
Tai-E：通过利用经典的最佳设计，用于Java的静态分析框架
Tai-e: A Static Analysis Framework for Java by Harnessing the Best Designs of Classics
论文作者
论文摘要
静态分析是一个成熟的领域，具有用于漏洞检测，安全性分析和代码优化等的应用，以促进这些应用，静态分析框架通过提供一系列基本服务（例如程序抽象，控制流程图构建以及对点/别名信息计算等）来起着至关重要的作用。然而，尽管该领域的静态分析和静态框架仍然是静态分析，并且在静态框架上仍然是静态的，这是如何静态的，这是一定的静态框架。在某种程度上，分析开发人员可以从中受益更多：例如，一个好的IR（用于分析）应该看起来像什么？基本分析的模块应提供哪些功能以减轻客户分析？如何方便地开发和集成新分析？如何管理多个分析？ 为了回答这些问题，在这项工作中，我们讨论了静态分析框架至关重要组成部分的设计权衡，并通过遵循HBDC（利用HBDC（利用经典的最佳设计）原理）来争辩最合适的设计：对于每个关键组件，我们都不会（可能（可能）（可能是诸如sotbugs of sotbugs and sotbugs and sotbug and sopbugs and of wala），我们将其选择（可能是可能的）选择。足够好，然后我们提出了一个更好的设计。这些选择或新提出的设计最终构成了Tai-E，这是Java的新静态分析框架。具体而言，Tai-E在多个方面的设计中是新颖的，例如IR，指针分析和新分析等的开发，导致易于学习，易于使用和高效的系统。据我们所知，这是系统地探索各种静态分析框架的设计和实现的第一部作品，我们认为它为建立更好的静态分析基础架构提供了有用的材料和观点。
Static analysis is a mature field with applications to bug detection, security analysis, and code optimization, etc. To facilitate these applications, static analysis frameworks play an essential role by providing a series of fundamental services such as program abstraction, control flow graph construction, and points-to/alias information computation, etc. However, despite impressive progress of static analysis, and this field has seen several popular frameworks in the last decades, it is still not clear how a static analysis framework should be designed in a way that analysis developers could benefit more: for example, what a good IR (for analysis) ought to look like? What functionalities should the module of fundamental analyses provide to ease client analyses? How to develop and integrate new analysis conveniently? How to manage multiple analyses? To answer these questions, in this work, we discuss the design trade-offs for the crucial components of a static analysis framework, and argue for the most appropriate design by following the HBDC (Harnessing the Best Designs of Classics) principle: for each crucial component, we compare the design choices made for it (possibly) by different classic frameworks such as Soot, WALA, SpotBugs and Doop, and choose arguably the best one, but if none is good enough, we then propose a better design. These selected or newly proposed designs finally constitute Tai-e, a new static analysis framework for Java. Specifically, Tai-e is novel in the designs of several aspects like IR, pointer analysis and development of new analyses, etc., leading to an easy-to-learn, easy-to-use and efficient system. To our knowledge, this is the first work that systematically explores the designs and implementations of various static analysis frameworks, and we believe it provides useful materials and viewpoints for building better static analysis infrastructures.
