Static analysis tools have showcased their importance and usefulness in automated
detection of defects. However, the tools are known to generate a large number of alarms …

Existing coverage-based fuzzers usually use the individual control flow graph (CFG) edge
coverage to guide the fuzzing process, which has shown great potential in finding …

This paper describes work in continuous reasoning, where formal reasoning about a
(changing) codebase is done in a fashion which mirrors the iterative, continuous model of …

Incorrectness Logic (IL) has recently been advanced as a logical theory for compositionally
proving the presence of bugs—dual to Hoare Logic, which is used to compositionally prove …

Static analysis tools have showcased their importance and usefulness in automated
detection of code anomalies and defects. However, the large number of alarms reported and …

Many problems in program analysis, verification, and synthesis require inferring
specifications of unknown procedures. Motivated by a broad range of applications, we …

The problem of synthesizing specifications of undefined procedures has a broad range of
applications, but the usefulness of the generated specifications depends on their quality. In …

Precondition inference is an important problem with many applications. Existing
precondition inference techniques for programs with arrays have limited ability to find and …

We automate synthesis of environment invariants for modular hardware verification in
processors and application-specific accelerators, where functional equivalence is proved …

While industrial-strength static analysis over large, real-world codebases has become
commonplace, so too have difficult-to-analyze language constructs, large libraries, and …