Path-Aware Static Program Analyses for Specification Mining* - Mining Software Specifications: Methodologies and Applications - page 346

1.6

<=2
3−5
6−10
11−15
>15

1.4

1.2

1

0.8

0.6

0.4

0.2

0

apache buddy openssh osip procmail zebra

Benchmarks

FIGURE 9.20: Comparison with non-profile based inference. (With kind
permission from Springer Science + Business Media: Protocol Inference Using
Static Path Proles, SAS, 2008, pp. 78{92, M. Ramanthan et al., Figure 7.)

for six sources: apache , buddy , zebra , openssh , osip2 , and procmail ; other
than buddy , the characteristics of these benchmarks were described in Ta-
bles 9.3 and 9.4. Buddy is a BDD generator, roughly 2.4KLOC, with 173
procedures.

9.3.4 Quantitative Assessment
We derive preconditions containing three dierent types of predicates {
assignment, comparison, and precedence. As their names suggest, assignment
predicates reflect the assignment of values (or results of procedure calls) to
variables; comparison predicates include six kinds of logical comparison opera-
tions (>, <, 6=, =, , and ) between variables and/or constants; a precedence
predicate is an ordered sequence of procedures whose calls must precede the
call to the procedure being examined. The total number of preconditions gen-
erated for procedures, where the predicates are valid on at least 70% of the
paths is given in Table 9.3. Our earlier experiments on the predicate distribu-
tions (see. Figures 9.14(b) and 9.14(a)) revealed that the size of the predicate
set is less than two for a majority of the procedures.
We experimentally compare our approach with a non-profile based in-
ference mechanism that does not leverage path profiles such as the system
described in Section 9.2. Briefly, the comparison metric is an analysis that
requires a predicate to be satisfied along all paths to a call-site in order to
be a valid candidate for inclusion as part of a procedure call's precondition.
After accumulating the predicates at each call-site, we declare a predicate as a
precondition if the predicate is valid in at least the user-defined threshold per-
centage of call-sites. We use the same user-defined threshold (70%) in deriving
the predicates, i.e., if a predicate is valid in 7 out of 10 call-sites, we declare