Prepared publications

Those papers are under review and will continue evolving in the future, any feedback will be greatly appreciated.

Multi-Variant Execution at the Edge

Edge-cloud computing offloads parts of the computations that traditionally occurs in the cloud to edge nodes,e.g., CDN servers, in order to get closer to the users and reduce latency. To improve performance even further, WebAssembly is increasingly used in this context. Edge-cloud computing providers, such as Fastly or Cloudflare, let their clients deploy stateless services in the form of WebAssembly binaries, which are then translated to machine code and sandboxed for a safe execution at the edge. In this context, we propose a technique that (i) automatically diversifies WebAssembly binaries that are deployed to the edge and (ii) randomizes execution paths at runtime, turning the execution of the services into a moving target. Given a service tobe deployed at the edge, we automatically synthesize functionally equivalent variants for the functions that implement the service.All the variants are then wrapped into a single multivariant WebAssembly binary. When the service endpoint is executed,every time a function is invoked, one of its variants is randomly selected. We implement this technique in the MEWE tool and we validate it with 7 services for cryptography and QR encoding. MEWE generates multivariant binaries that embed hundreds of function variants. We execute the multivariant binaries on the worldwide edge platform provided by Fastly. We show that,at runtime, the multivariant exhibit a remarkable diversity ofexecution traces, across the whole edge platform.

Trace-based Debloat for Java Bytecode

Software bloat is code that is packaged in an application but is actually not used and not necessary to run the application. The presence of bloat is an issue for software security, for performance, and for maintenance. In recent years, several works have proposed techniques to detect and remove software bloat. In this paper, we introduce a novel technique to debloat Java bytecode through dynamic analysis, which we call trace-based debloat. We have developed JDBL, a tool that automates the collection of accurate execution traces and the debloating process. Given a Java project and a workload, JDBL generates a debloated version of the project that is syntactically correct and preserves the original behavior, modulo the workload. We evaluate the feasibility and the effectiveness of trace-based debloat with 395 open-source Java libraries for a total 10M+ lines of code. We demonstrate that our approach significantly reduces the size of these libraries while preserving the functionalities needed by their clients.

Suggestions on Test Suite Improvements with Automatic Infection and Propagation Analysis

An extreme transformation removes the body of a method that is reached by one
test case at least. If the test suite passes on the original program and still
passes after the extreme transformation, the transformation is said to be
undetected, and the test suite needs to be improved. In this work we propose a
technique to automatically determine which of the following three reasons
prevent the detection of the extreme transformation is : the test inputs are
not sufficient to infect the state of the program; the infection does not
propagate to the test cases; the test cases have a weak oracle that does not
observe the infection. We have developed Reneri, a tool that observes the
program under test and the test suite in order to determine runtime differences
between test runs on the original and the transformed method. The observations
gathered during the analysis are processed by Reneri to suggest possible
improvements to the developers. We evaluate Reneri on 15 projects and a total
of 312 undetected extreme transformations. The tool is able to generate a
suggestion for each each undetected transformation. For 63% of the cases, the
existing test cases can infect the program state, meaning that undetected
transformations are mostly due to observability and weak oracle issues.
Interviews with developers confirm the relevance of the suggested improvements
and experiments with state of the art automatic test generation tools indicate
that no tool can improve the existing test suites to fix all undetected