A self-contained introduction to abstract interpretation–based static analysis, an essential resource for students, developers, and users. Static program analysis, or static analysis, aims to discover semantic properties of programs without running them. It plays an important role in all phases of development, including verification of specifications and programs, the synthesis of optimized code, and the refactoring and maintenance of software applications. This book offers a self-contained introduction to static analysis, covering the basics of both theoretical foundations and practical considerations in the use of static analysis tools. By offering a quick and comprehensive introduction for nonspecialists, the book fills a notable gap in the literature, which until now has consisted largely of scientific articles on advanced topics. The text covers the mathematical foundations of static analysis, including semantics, semantic abstraction, and computation of program invariants; more advanced notions and techniques, including techniques for enhancing the cost-accuracy balance of analysis and abstractions for advanced programming features and answering a wide range of semantic questions; and techniques for implementing and using static analysis tools. It begins with background information and an intuitive and informal introduction to the main static analysis principles and techniques. It then formalizes the scientific foundations of program analysis techniques, considers practical aspects of implementation, and presents more advanced applications. The book can be used as a textbook in advanced undergraduate and graduate courses in static analysis and program verification, and as a reference for users, developers, and experts.

The First Expert Guide to Static Analysis for Software Security! Creating secure code requires more than just good intentions. Programmers need to know that their code will be safe in an almost infinite number of scenarios and configurations. Static source code analysis gives users the ability to review their work with a fine-toothed comb and uncover the kinds of errors that lead directly to security vulnerabilities. Now, there’s a complete guide to static analysis: how it works, how to integrate it into the software development processes, and how to make the most of it during security code review. Static analysis experts Brian Chess and Jacob West look at the most common types of security defects that occur today. They illustrate main points using Java and C code examples taken from real-world security incidents, showing how coding errors are exploited, how they could have been prevented, and how static analysis can rapidly uncover similar mistakes. This book is for everyone concerned with building more secure software: developers, security engineers, analysts, and testers.

The existing literature currently available to students and researchers is very general, covering only the formal techniques of static analysis. This book presents real examples of the formal techniques called "abstract interpretation" currently being used in various industrial fields: railway, aeronautics, space, automotive, etc. The purpose of this book is to present students and researchers, in a single book, with the wealth of experience of people who are intrinsically involved in the realization and evaluation of software-based safety critical systems. As the authors are people currently working within the industry, the usual problems of confidentiality, which can occur with other books, is not an issue and so makes it possible to supply new useful information (photos, architectural plans, real examples).

This book constitutes the refereed proceedings of the 30th International Symposium on Static Analysis, SAS 2023, held in Lisbon, Portugal, in October 2023. The 20 full papers included in this book were carefully reviewed and selected from 40 submissions. Static analysis is widely recognized as a fundamental tool for program verification, bug detection, compiler optimization, program understanding, and software maintenance. The papers deal with theoretical, practical and application advances in the area.

This book constitutes the refereed proceedings of the 23rd International Static Analysis Symposium, SAS 2016, held in Edinburgh, UK, in September 2016. The 21 papers presented in this volume were carefully reviewed and selected from 55 submissions. The contributions cover a variety of multi-disciplinary topics in abstract domains; abstract interpretation; abstract testing; bug detection; data flow analysis; model checking; new applications; program transformation; program verification; security analysis; theoretical frameworks; and type checking.

This book constitutes the refereed proceedings of the 27th International Symposium on Static Analysis, SAS 2020, held in Chicago, IL, USA, in November 2020. The 14 regular papers presented in this book together with 2 invited talks and 1 extended abstract, were carefully reviewed and selected from 34 submissions. The papers cover topics such as abstract domains; abstract interpretation; automated deduction; data flow analysis; debugging; deductive methods; emerging applications; model-checking; program transformations; predicate abstraction; security analysis; tool environments and architectures; and type checking. Due to the Corona pandemic this event was held virtually.

This book constitutes the refereed proceedings of the 16th International Symposium on Static Analysis, SAS 2010, held in Perpignan, France in September 2010. The conference was co-located with 3 affiliated workshops: NSAD 2010 (Workshop on Numerical and Symbolic Abstract Domains), SASB 2010 (Workshop on Static Analysis and Systems Biology) and TAPAS 2010 (Tools for Automatic Program Analysis). The 22 revised full papers presented together with 4 invited talks were carefully reviewed and selected from 58 submissions. The papers address all aspects of static analysis including abstract domains, bug detection, data flow analysis, logic programming, systems analysis, type inference, cache analysis, flow analysis, verification, abstract testing, compiler optimization and program verification.