Efficient module-level dynamic analysis for dynamic languages with module recontextualization
Nikos Vasilakis, Grigoris Ntousakis, Veit Heller, Martin C. Rinard
摘要
Dynamic program analysis is a long-standing technique for obtaining information about program execution. We present module recontextualization, a new dynamic analysis approach that targets modern dynamic languages such as JavaScript and Racket, enabled by the fact that they feature a module-import mechanism that loads code at runtime as a string. This approach uses lightweight load-time code transformations that operate on the string representation of the module, as well as the context to which it is about to be bound, to insert developer-provided, analysis-specific code into the module before it is loaded. This code implements the dynamic analysis, enabling this approach to capture all interactions around the module in unmodified production language runtime environments. We implement this approach in two systems targeting the JavaScript and Racket ecosystems. Our evaluation shows that this approach can deliver order-of-magnitude performance improvements over state-of-the-art dynamic analysis systems while supporting a range of analyses, implemented on average in about 100 lines of code.
问问这篇 Paper
智能体会读完全文。
Lune 把这篇 Paper 索引到了每一个公式,引用它的顶会 Paper 也一样。你提问,回答直接引用原文。
引用它的顶会 Paper2
- Preventing Dynamic Library Compromise on Node.js via RWX-Based Privilege ReductionNikos Vasilakis, Cristian-Alexandru Staicu, Grigoris Ntousakis, Konstantinos Kallas 等CCS 2021 · 被引用 27 次
- Towards Effective Static Type-Error Detection for PythonWonseok Oh, Hakjoo OhASE 2024 · 被引用 1 次
它引用的顶会 Paper5
- Small World with High Risks: A Study of Security Threats in the npm EcosystemMarkus Zimmermann, Cristian-Alexandru Staicu, Cam Tenny, Michael PradelUSENIX Security 2019 · 被引用 281 次
- Thou Shalt Not Depend on Me: Analysing the Use of Outdated JavaScript Libraries on the WebTobias Lauinger, Abdelberi Chaabane, Sajjad Arshad, William Robertson 等NDSS 2017 · 被引用 183 次
- BreakApp: Automated, Flexible Application CompartmentalizationNikos Vasilakis, Ben Karel, Nick Roessler, Nathan Dautenhahn 等NDSS 2018 · 被引用 66 次
- A Sense of Time for JavaScript and Node.js: First-Class Timeouts as a Cure for Event Handler PoisoningJames C. Davis, Eric R. Williamson, Dongyoon LeeUSENIX Security 2018 · 被引用 54 次
- Preventing Dynamic Library Compromise on Node.js via RWX-Based Privilege ReductionNikos Vasilakis, Cristian-Alexandru Staicu, Grigoris Ntousakis, Konstantinos Kallas 等CCS 2021 · 被引用 27 次
相关 Paper
- IRIDIUM: A Framework for Statically Optimizing JavaScript ProgramsMeetesh Kalpesh Mehta, Anirudh Garg, Aneeket Yadav, Manas ThakurOOPSLA 2026
- Best of Both Worlds: Effective Foreign Bridge Identification in V8 Embedders for Security AnalysisGeorgios Alexopoulos, Thodoris Sotiropoulos, Zhendong Su, Dimitris MitropoulosS&P 2026 · 被引用 1 次
- Increasing the Responsiveness of Web Applications by Introducing Lazy LoadingAlexi Turcotte, Satyajit Gokhale, Frank TipASE 2023 · 被引用 3 次
- Reducing Static Analysis Unsoundness with Approximate InterpretationMathias Rud Laursen, Wenyuan Xu, Anders MøllerPLDI 2024 · 被引用 5 次
- Representing and Reasoning about Dynamic CodeJesse Bartels, Jon Stephens, Saumya DebrayASE 2020
