Desyan: A Platform for Seamless Value-Flow and Symbolic Analysis

2025-08-01

AI Summary

Existing static analysis suffers from a long-standing dichotomy between value-flow analyses (e.g., data-flow and pointer analysis) and symbolic analyses (e.g., symbolic execution), lacking a unified framework that simultaneously delivers high performance and expressive power. This paper introduces the first unified analysis platform that deeply integrates SMT solving with Datalog fixed-point computation, built as an extension of the Soufflé engine and augmented with a custom algebraic reasoning module. It enables coordinated scheduling of bottom-up data-flow inference and path-sensitive symbolic execution. Key contributions include: (1) the first tight coupling of industrial-strength SMT solvers with iterative Datalog evaluation; (2) unification of lightweight algebraic reasoning and full symbolic execution; and (3) empirical gains of over 20× speedup in value-flow analysis and more than 2× acceleration in lightweight symbolic analysis, significantly improving efficiency in complex constraint solving and path-sensitive reasoning.

Technology Category

• Constraint Satisfaction and Optimization: Satisfiability Modulo Theories
• Knowledge Representation and Reasoning: Computational Complexity of Reasoning
• Planning, Routing, and Scheduling: Model-Based Reasoning

Application Category

• Graph Algorithms and Modeling for the Web: Efficient manipulation of static and dynamic Web-related graphs
• Systems and Infrastructure for Web, Mobile and WoT: Web performance, measurement, and characterization
• Web Mining and Content Analysis: Bridging structured and unstructured data

Abstract

Over the past two decades, two different types of static analyses have emerged as dominant paradigms both in academia and industry: value-flow analysis (e.g., data-flow analysis or points-to analysis) and symbolic analysis (e.g., symbolic execution). Despite their individual successes in numerous application fields, the two approaches have remained largely separate; an artifact of the simple reality that there is no broadly adopted unifying platform for effortless and efficient integration of symbolic techniques with high-performance data-flow reasoning. To bridge this gap, we introduce Desyan: a platform for writing program analyses with seamless integration of value-flow and symbolic reasoning. Desyan expands a production-ready Datalog fixpoint engine (Soufflé) with full-fledged SMT solving invoking industry-leading SMT engines. Desyan provides constructs for automatically (and efficiently!) handling typical patterns that come up in program analysis. At the same time, the integration is agnostic with respect to the solving technology, and supports Datalog-native symbolic reasoning, via a bottom-up algebraic reasoning module. The result is an engine that allows blending different kinds of reasoning, as needed for the underlying analysis. For value-flow analysis, the engine is the best-in-class Datalog evaluator (often by a factor of over 20x in execution time); for applications that require full SMT (e.g., a concolic execution engine or other symbolic evaluator that needs to solve arbitrarily complex conditions), the engine is leveraging the leading SMT solvers; for lightweight symbolic evaluation (e.g., solving simple conditionals in the context of a path-sensitive analysis), the engine can use Datalog-native symbolic reasoning, achieving large speedups (often of over 2x) compared to eagerly appealing to an SMT solver.

Problem

• Bridging gap between value-flow and symbolic analysis integration
• Providing a unified platform for efficient program analysis
• Enabling seamless blending of different reasoning techniques

Innovation

• Integrates value-flow and symbolic analysis seamlessly
• Expands Datalog engine with SMT solving
• Supports Datalog-native symbolic reasoning efficiently