Pick Your Call Graphs Well: On Scaling IFDS-Based Data-Flow Analyses
summary
The paper builds QCG extends Qilin and integrates with FlowDroid to measure how call-graph precision affects IFDS taint analyses on TaintBench (39 apps), generating 27 QCG variants plus FlowDroid’s four defaults. Results show context-sensitive, pointer-analysis call graphs (k≤2) cut IFDS propagation counts, runtime, and memory while increasing precision, but precise CGs cost extra build time so overall wins depend on a sweet‑spot trade‑off between construction overhead and analysis savings.
AI-written summary · about
chapters (12)
- 0:00Static data flow analysis
- 1:07Java taint analysis example
- 3:35Call graph precision impact
- 5:45QCG call graph framework
- 7:51Precision vs performance research
- 8:35Precision evaluation setup
- 10:20Call graph precision results
- 12:07Real-world app performance
- 14:12Runtime and memory trends
- 15:17Performance takeaways
- 16:01Conclusion and framework
- 17:02Q&A
related talks
12mSTG for ABI monitoring
15mAutomatic Synthesis of Data-Flow Analyzers
27mSupercharging Infer: Enhancing Static Analysis with Dynamic Data at WhatsApp
20mTaking out the Toxic Trash: Recovering Precision in Mixed Flow-Sensitive Static Analyses
58mCoverage, quality, and Goodhart's Law
38mStatic Code Analysis - A Behind-the-scenes Look
02h 22mArchitecting and Testing Controllable Agents
53mEmbedded Linux Quality Assurance: How to Not Lie with Statistics