Dual Execution for On the Fly Fine Grained Execution Comparison
Abstract
Execution comparison has many applications in debugging, malware analysis, software feature identification, and intrusion detection. Existing comparison techniques have various limitations. Some can only compare at the system event level and require executions to take the same input. Some require storing instruction traces that are very space-consuming and have difficulty dealing with non-determinism. In this paper, we propose a novel dual execution technique that allows on-the-fly comparison at the instruction level. Only differences between the executions are recorded. It allows executions to proceed in a coupled mode such that they share the same input sequence with the same timing, reducing nondeterminism. It also allows them to proceed in a decoupled mode such that the user can interact with each one differently. Decoupled executions can be recoupled to share the same future inputs and facilitate further comparison. We have implemented a prototype and applied it to identifying functional components for reuse, comparative debugging with new GDB primitives, and understanding real world regression failures. Our results show that dual execution is a critical enabling technique for execution comparison.
Document Details
- Document Type
- Pub Defense Publication
- Publication Date
- Mar 14, 2015
- Source ID
- 10.1145/2775054.2694394
Entities
People
- Dohyeong Kim
- Dongyan Xu
- William N. Sumner
- Xiangyu Zhang
- Yonghwi Kwon
Organizations
- Defense Advanced Research Projects Agency
- National Science Foundation
- Purdue University
- Simon Fraser University