GRAPH THEORETICAL ALGORITHMS FOR CONTROL FLOW GRAPH COMPARISON

Transcription

1 Proceedings of the IASTED International Conference Software Engineering (SE 21) February 17-19, 21 Innsbruck, Austria GRAPH THEORETICAL ALGORITHMS FOR CONTROL FLOW GRAPH COMPARISON Sergej Alekseev Fachhochschule Frankfurt am Main University of Applied Sciences Nibelungenplatz Frankfurt am Main, Germany alekseev@fb2.fh-frankfurt.de Adam Kajrys Fachhochschule Frankfurt am Main University of Applied Sciences Nibelungenplatz Frankfurt am Main, Germany kajrys@stud.fh-frankfurt.de Andreas Karoly Fachhochschule Frankfurt am Main University of Applied Sciences Nibelungenplatz Frankfurt am Main, Germany karoly@stud.fh-frankfurt.de ABSTRACT This paper presents graph theoretical algorithms to compare control flow graphs of program code based on graph transformation and decomposition into connected components. The essential idea is to transform graphs into reduced graphs and to calculate an isomorphic correspondence. We also show some experimental results to illustrate the effectiveness of our algorithms in terms of detected structural differences in graphs that are compared. The presented algorithms in this paper have been implemented in the Dr. Garbage tool suite and are available for download under the Apache Open Source license. KEY WORDS Control flow graph comparison, graph isomorphism. 1 Introduction The Control Flow Graph Comparison is important in several fields of application such as efficient testing of programs, merging between two versions of software, testing compiler optimization and code instrumentation tools. To compare the structure of two control flow graphs it is essential to know if one graph contains the structure of the second graph. A computational task in which two graphs G 1 and G 2 are given as input, and one must determine whether G 1 contains a subgraph that has the same structure as the graph G 2, is called the subgraph isomorphism problem. The subgraph isomorphism problem is a fundamental problem in graph theory and it is known to be NP-complete [1]. Fortunately polynomial-time algorithms for the subgraph isomorphism problem are known for trees [2], two-connected outerplanar graphs [], and two-connected series-parallel graphs []. In this paper we present graph theoretical algorithms to compare control flow graphs of program code and some extensions based on graph transformation and decomposition. The essential idea is to transform graphs into trees and to calculate an isomorphic correspondence. To consider the whole graph structure, the graph is decomposed into connected components and transformed to a reduced tree. We didn t solve the graph isomorphism problem, but all algorithms presented in this paper have linear time complexity and show very good results in terms of detected structural differences in graphs that are compared. All algorithms presented in this paper have been implemented in the context of the Dr. Garbage tool suite [] and we present some experimental results and statistics of our implementation in section. 2 Related Works The problem of comparing two graphs is known for a long time and it is one of the fundamental problems of graph theory. A. V. Aho, J. E. Hopcroft, and J. D. Ullman present in their book The Design and Analysis of Computer Algorithms [6] algorithms for solving general problems of subtree isomorphism, largest common subtree and smallest common supertree. S. M. Selkow defined the Top-Down subtree isomorphism [7]. A definition of the Bottom-Up subtree isomorphism was introduced by G. Valiente in [8], [9]. A systematic review of efficient subtree isomorphism algorithms can be found in his book Algorithms on Trees and Graphs [1]. The Top-Down and Bottom-Up subtree isomorphism algorithms are used in our proposal to compare the reduced graphs as trees. After the trees have been compared, the differences are represented in the graphs from which the trees have been derived. There are a number of publications that deal with the comparison of program code. W. Yang presents an approach to compare the structure of two programs by using the subtree isomorphism [11]. T. Sager introduced an approach and a tool that measures similarity between Java classes [12]. The tool calculates similarity by using different subtree isomorphism algorithms on syntax tree representations of source code. Compared to our proposal, in both approaches syntax trees derived from the source code are used instead of control flow graphs. The problem is reduced to subtree isomorphism which can be solved in linear time. Unfortunately, this approach can not be applied directly for the comparison of two control flow graphs. J. Laski and W. Szermer present an algorithm that finds differences of two programs by comparing control flow graphs [1]. In their paper they address the problem of the revalidation of a modified code in software mainte- DOI: 1.216/P

2 nance. The modifications are localized by using the control flow graphs of the original and modified programs. Both flow graphs are transformed into reduced flow graphs, between which an isomorphic correspondence is calculated. A similar work and a further improvement of the algorithm can be found in [1]. The authors introduced a hammock matching algorithm based on Laski and Szermer s algorithm. This algorithm uses hammocks and reduced hammock graphs. Hammocks are subgraphs [1] which provide a way to impose a hierarchical structure on the control flow graph for matching. This approach is very close to our proposal. In our approach a different type of control flow graph reduction is performed and the comparison is based on subtree isomorphism. Furthermore the problem of comparing the structure of two graphs can be turned into determining the similarity of two graphs, which is generally referred to as graph matching problem. There are a number of publications of graph matching algorithms. The graph matching has been applied to semantic networks [16], recognition of graphical symbols [17], three-dimensional object recognition [18], and others. However the applications and algorithms have a very low relevance to our approach because the graphs have always specific properties according to the field of application. Subtree Isomorphism Algorithms Since our approach is based on the subtree isomorphism, the most commonly used algorithms are explained here briefly. There are three basic types of subtree isomorphism: largest common [6], top-down [7] and bottom-up [8], [9] subtree isomorphism. The largest common subtree of two given trees T 1 and T 2 (figure 1 ) is the largest subtree of T 1 that is structurally identical to a subtree in T 2. T 1 : 7 7 v 7 v v 6 T 2 : Figure 1. Largest common subtree. The top-down subtree of two given trees (figure 2) is the largest common subtree under the prerequisite that the root of the common subtree is identical with the root nodes of the compared trees T 1 and T 2 a. The bottom-up subtree is the largest isomorphic subtree of two given trees if the bottom-up subtree of T 1 rooted at node is isomorphic to the bottom-up subtree of T 2 b rooted at node v2. There are many publications about the subtree isomorphism and corresponding algorithms. A very good T 1 : v T 2 a : 7 7 v v v 6 T 2 b : 7 7 v Figure 2. Top-down, bottom-up subtree isomophism. overview of subtree isomorphism algorithms is the book by G. Valiente [1]. In his book Valiente presents a number of subtree isomorphism algorithms and provides efficient code implementation examples. We implemented a prototype based on the top-down maximum common subtree isomorphism algorithm by G. Valiente. Our approach can be easily adapted to the bottom-up maximum common subtree isomorphism or tree edit distance algorithms [1] and differs only in the last step by the use of another subtree similarity algorithm. Graph Comparison Algorithms The input for the comparison algorithms are control flow graphs (CF G) of a method. The CF G is defined as a tuple G = (V, A), where V is a nonempty set of vertices representing instructions of a method, A is a (possibly empty) set of arcs (or edges) representing transitions between the instructions. Formally, A is the finite set of ordered pairs of vertices (a, b), where a, b V. The algorithm COMPARE SPANNING TREES (section.1) computes spanning trees of the CFGs to be compared and calculates the subtree isomorphism. The differences detected in these trees are transferred into the original graphs. The algorithm COMPARE BB GRAPHS (section.) extends the algorithm COMPARE SPANNING TREES by the graph transformation to basic block graphs. The subtree isomorphism procedure is applied to a substantial graph structure. The last algorithm COM- PARE BIBLOCK GRAPHS (section.) transforms the basic block graph in a so called biblock (biconnected blocks) graph. The biblock graph is a tree constructed by graph decomposition into connected components [19], [2]. The subtree isomorphism procedure is applied to the biblock tree and for all isomorphic biblocks the algorithm COMPARE BB GRAPHS is executed..1 Spanning Tree Comparison Algorithm As a CF G may contain loops, the CF G has to be transformed into a directed acyclic graph (DAG) by removing loop backedges as identified by a depth-first search of the CF G (figure : line 1). For the given CF Gs the algorithm computes their respective ordered spanning trees. Each node in a program CF G has usually a unique instruc- v v 6 78

3 COMPARE SPANNING TREES(G 1, G 2 ) 1 remove Backedges from G 1 and G 2 ; 2 T 1 = createorderedt ree(g 1 ); T 2 = createorderedt ree(g 2 ); subtreet opdownisomorphism(t 1, T 2 ); /* equal vertices are green and not equal red */ for ( all missing edges e G 1 G 2 ) { 6 if ( source and target of e G 1 e G 2 ) { 7 mark e red; 8 } Figure. Spanning-Tree Comparison Algorithm tion code address. The procedure createorderedt ree (figure : lines 2-) is a modified breadth-first search (BF S). It uses instruction code addresses to define the traversing order of outgoing edges and assigns a logical address to each node in the tree corresponding to the steps of the BF S algorithm. This ensures that a deterministically ordered spanning tree for the given CF G is generated. The comparison of the generated trees is achieved by the subtree isomorphism algorithm (figure : line ). We implemented the top-down subtree isomorphism algorithm from G. Valiente [1]. After executing the subtreet opdownisomorphism procedure the isomorphic vertices are marked green and non isomorphic vertices red. Finally the edges missing in the spanning tree and previously removed back edges are compared and marked red, if the source s or target s logical addresses of the edge e T 1 is not equal to the addresses of the corresponding edge e T 2. The figure illustrates an ordered spanning tree after the execution of the procedure createorderedt ree. The v v v bytecode bytecode logical address operation adresses... 1 if_icmpge; return; Figure. Ordered spaning tree. resulting spanning tree misses the edge v, according to the ascending traversing order on bytecode addresses of the nodes and. The logical addresses are assigned to each node. The algorithm COMPARE SPANNING TREES is very simple, but has a big disadvantage. If the difference in the top-down approach is detected right at the beginning, the remaining tree structure is not further compared by the algorithm..2 Basic Block Graph Comparison Algorithm 79 To work around the limitation of the algorithm COM- PARE SPANNING TREES, the compared CF Gs are reduced to basic block graphs. A basic block graph is a control flow graph with basic blocks as vertices. A basic block (BB) is a maximal sequence of one or more consecutive instructions (previously seperate vertices) with a single entry instruction, a single exit instruction, and no internal branches. The algorithm COMPARE BB GRAPHS (figure ) transforms the graphs G 1 and G 2 to BB-graphs B 1 and COMPARE BB GRAPHS(G 1, G 2 ) 1 B 1 = transformt obasicblock(g 1 ); 2 B 2 = transformt obasicblock(g 2 ); COMP ARE SP ANNING T REES(B 1, B 2 ); for (each isomorphic basicblocks b B 1, b B 2 ){ comparebasicblocks(b, b ) 6 } Figure. Basicblock Graph comparison algorithm B 2 (line 1-2). The COMPARE SPANNING TREES algorithm is applied to the generated BB-graphs. Figure : line generates spanning trees and calculates the subtree isomorphism. For isomorphic BBs detected by the algorithm the content is compared. In our prototype we compare the length of the instruction sequence in basic blocks. If the lengths are different the excessive vertices (instructions) are marked red. The algorithm is able to detect if any instruction sequence have been inserted or deleted in the code and the comparison does not terminate after detecting the first difference. Figure 6 illustrates this step. The insertion or deletion of a sequence of vertices within the basic blocks can be easily detected. The algorithm COMPARE BB GRAPHS is sufficient for use cases which define the sequential modification of code. For example if an instrumentation tool inserts instructions for monitoring, it would be sufficient to check if the original and instrumented basic block graphs are isomorphic. The comparison will terminate as soon as complex structural differences are detected. Further reduction of graphs is necessary to avoid this problem.

4 G 1 and G 2 : v v v v 2 v 2 v b 1 b 2 B 1 and B 2 : b b v v Figure 6. Basic Block graph comparsion b 1 v 7 b 2 2 b v 7 2 b v 7 algorithm is applied to biblock trees (line ) and for each detected isomorphic vertex the COMPARE BB GRAPHS algorithm is applied (lines: 6-8). Graphs are usually decomposed into connected components, where a connected component is a maximal biconnected subgraph or a subgraph generated from a bridge or an isolated vertex. G. Stiege introduced in [19] a similar graph decomposition called biblock decomposition, which is better suited for graph algorithmic problems. The decomposition uses undirected paths. The graph is decomposed into maximal 2-edge-connected subgraphs (subcomponents) and trees, which are connected with the subcomponents. The subcomponents are subdivided into maximal 2-vertex-connected subgraphs, the biblocks. A graph produced by the reduction of the biblocks into single nodes, is called a biblock-tree. An efficient algorithm to find the biblock structure can be found in [2]. G 1 : bb2 1 2 bb G 2 : bb 1 v v bb Graph Comparison Algorithm by Decomposition The idea to decompose graphs for comparison is not new. Valiente and Martinez for example present in [21] an algorithm for pattern-matching on arbitrary graphs that is based on decomposing graphs into connected components. For every connected component, the algorithm performs a combinatorial search. Our algorithm in figure 7 transforms a control flow graph to basic block graphs (lines: 1-2) and creates so called biblock trees (lines: -). The subtree isomorphism COMPARE BIBLOCK TREES(G 1, G 2 ) 1 B 1 = transformt obasicblock(g 1 ); 2 B 2 = transformt obasicblock(g 2 ); T 1 = createbiblockt ree(b 1 ); Biblock-Tree T 1 of G 1 : T 2 = createbiblockt ree(b 2 ); calculatesubtreeisomorphism(t 1, T 2 ); 6 for (each isomorphic vertices v T 1 and v T 2 ){ 7 COMP ARE BB GRAP HS(v, v ); 8 } Figure 7. Biblock Tree comparison algorithm Figure 8. Graph G 1 and G 2 and their biblocks. Figure 8 shows control flow graph G 1 and the modified graph G 2. The vertex G 1 has been replaced by the branch instruction block {,,, } G 2. The instruction block {v, v 6, v 7, v 8 } G 1 has been replaced by the single instruction v G 2. The algorithm COMPARE SPANNING TREES stops the comparison process after processing the first vertices, because the children of the first vertex in the generated spanning trees have different numbers of outgoing edges. It marks vertices,, v G 1 and vertices,, G 2 as isomorphic. The COMPARE BIBLOCK GRAPHS algorithm 8 transforms the graphs G 1 and G 2 to biblock-trees and compares their structure. The biblock-trees of the graph G 1 and G 2 are shown in figure 9. The biblock-trees are isomor- bb 2,,, v bb v, v 6, v 7, v 8 Biblock-Tree T 2 of G 2 : bb 1, v, v, v bb 2,,, v v Figure 9. Biblock-trees of graphs G 1 and G 2 from figure 8. phic and the COMPARE BIBLOCK GRAPHS algorithm compares T 1 bb 1 T 2, bb 2 T 1 bb 2 T 2 and bb T 1 v T 2. After processing all vertices in G 1 and G 2 the vertices,,, v G 1 and,,, v G 2 are marked green, because the content of the biblock bb 2 G 1 and the content of the biblock bb 2 G 2 are identical. The vertices,, G 2 are marked red, because these vertices are

5 G 1 : 2 v G 2 : v v 7 2 Figure 1. Biblock comparison result. missing in G 1. The vertices v 6, v 7, v 8 G 1 are marked red, because these vertices are missing in G 2. Experimental Evaluations To evaluate our algorithms, we selected control flow graphs of program code, that contain if, switch, loop and return instructions. The program methods that have been used for the generation of graphs are listed in table 1. The method M I IF S(c) L R BB BiB m m1a 2 11 m1b m () m2a () m2b 2 2 1() m (8) ma (8) mb (8) Table 1. M: name of the method, I: Number of instructions, IF: Number of if-branches, S (c): Number of switches and their cases, L: number of loops, R: Number of returns BB: Number of Basic Blocks, BiB: Number of BiBlocks m<x>a is produced from the method m<x> by inserting a single instruction. The method m<x>b represents the modification of the method m<x> by inserting a block of instructions. Table 2 illustrates the comparison results of two graphs M 1 and M 2. An acronym represents the used algorithm: TD - COMPARE SPANNING TREES, BBTD - COMPARE BB GRAPHS and BiBTD - COM- PARE BIBLOCK GRAPHS. Figure 11 represents the results from the column G+R1% of the table 2. The vertical axis is the ratio of all marked vertices (green and red) in the column M2 to all vertices of the methods listed in the column M1. The Light bar represents the result of the algorithm COM- PARE SPANNING TREES, the light-dark bar represents the results of the algorithm COMPARE BB GRAPHS and M1 M2 A G G% R 1/2 G+R1% m1 m1a TD % -/- 68.8% BBTD 2 1.% /1 1.% BiBTD 2 1.% /1 1.% m1 m1b TD % -/- 96.9% BBTD 27 8.% 1/1 87.% BiBTD % 1/6 1.% m2 m2a TD % -/- 6.2% BBTD 19 1.% /1 1.% BiBTD 19 1.% /1 1.% m2 m2b TD 9.% -/-.% BBTD 18 9.% / 9.% BiBTD 18 9.% 2/7 1.% m ma TD 12 1.% -/- 1.% BBTD % /2 1.% BiBTD % /2 1.% m mb TD 6 6.7% -/- 6.7% BBTD 1 1.% 2/ 17.8% BiBTD % /6 1.% Table 2. M1, M2: names of the methods to be compared, A: Used algorithm, G: Number of green-marked vertices in M1, G%: Ratio of green-marked vertices to all vertices in M1, R 1/2: Number of red-marked nodes in M1/M2, G+R1%: Ratio of all marked vertices (green + red) to all vertices in M1 the dark bar represents the results of the algorithm COM- PARE BIBLOCK GRAPHS m1a m1b m2a m2b ma mb TD BBTD BiBTD Figure 11. Comparison of algorithms The test case m1-m1b is particularly interesting because the result of algorithm BBTD is worse than the result of algorithm TD. This result is caused by the insertion of a block of instructions in the middle of the program code. The labels of the subsequent nodes in the control flow graph can not be assigned in the same order as in the original graph. So the isomorphism of the compared graphs cannot be uniquely determined. This effect is abrogated by using further graph decomposition into biblocks. In a more extensive example m-mb the algorithm BiBTD returns by 81

6 far the best result. The most important conclusion is that the algorithm BiBTD always produces the same or better result than the algorithms TD and BBTD. 6 Conclusion In this paper we presented algorithms for comparing two control flow graphs which are based on graph transformation into a tree and reduction by decomposition into connected components. Experimental results show that the proposed algorithms can be successfully applied for comparing the code differences. The structural reduction of the control flow graphs makes it possible to capture the overall structure of a program code. On the other hand the results also show the limitations of the proposed algorithms. Although the decomposition does not provide a worse outcome, it helps only in certain cases to improve the comparison result. In future work we will investigate additional heuristics to improve the matching results by the combination of graph theoretical and code specific approaches. We will also continue to improve our tools and collect more meaningful examples and statics. Acknowledgement The authors would like to thank the Dr. Garbage Project Community for supporting the implementation of the proposed algorithms and tools. References [1] J. R. Ullmann, An algorithm for subgraph isomorphism, Journal of the ACM, 2(1), 1976, 1-2. [2] D. W. Matula. An algorithm for subtree identification, SIAM Review, 1, 1968, [] A. Lingas, Subgraph isomorphism for biconnected outerplanar graphs in cubic time, Theoretical Computer Science, 1989, 6:29-2. [] A. Lingas and M. M. Sysło, A polynomial-time algorithm for subgraph isomorphism of two-connected series-parallel graphs, In Proc. 1th Int. Colloq. Automata, Languages and Programming, LNCS 17, Springer-Verlag, 1988, 9-9. [] S. Alekseev, V. Dhanraj, S. Reschke, and P. Palaga, Tools for Control Flow Analysis of Java Code, Proceedings of the 16th IASTED International Conference on Software Engineering and Applications, 212. [6] A. V. Aho, J. E. Hopcroft, and J. D. Ullman, The Design and Analysis of Computer Algorithms, (Addison- Wesley, 197). [7] S. M. Selkow, The tree-to-tree editing problem, Information Processing Letters, 6(6), 1977, [8] G. Valiente, Simple and efficient subtree isomorphism, Technical Report LSI--72-R, Technical University of Catalonia, Department of Software, 2. [9] G. Valiente, Simple and efficient tree comparison, Technical Report LSI-1-1-R, Technical University of Catalonia, Department of Software, 21. [1] G. Valiente, Algorithms on Trees and Graphs, (Berlin: Springer-Verlag, 22). [11] W. Yang, Identifying syntactic differences between two programs, Software - Practice and Experience, 21(7), 1991, [12] T. Sager, Coogle A Code Google Eclipse Plug-in for Detecting Similar Java Classes, Department of Informatics, University of Zurich, 26. [1] J. Laski, W. Szermer, Identification of Program Modifications and its Applications to Software Maintenance, IEEE Conference on Software Maintenance, 1992, pages , Nov. [1] T. Apiwattanapong, A. Orso, M. J. Harrold, A Differencing Algorithm for Object-Oriented Programs, IEEE International Conf. on Automated Software Engineering, 2, pages 2-1. [1] J. Ferrante, K. J. Ottenstein, and J. D. Warren, The program dependence graph and its use in optimization, ACM Transactions on Programming Languages and Systems, July 1987, 9():19-9. [16] H. Ehrig, Introduction to graph grammars with applications to semantic networks, Computers and Mathematics with Applications, 1992, Vol. 2, pp [17] X. Jiang, A. Münger and H. Bunke, Synthesis of representative graphical symbols by generalized median graph computation, Proc. of rd IAPR Workshop on Graphics Recognition, Jaipur, [18] E. K. Wong, Model matching in robot vision by subgraph isomorphism, Journal Pattern Recognition, 1992, Vol. 2, pp [19] G. Stiege, An Algorithm for Finding the Connectivity Structure of Undirected Graphs, Technical Report Institut für Betriebssysteme und Rechnerverbund, May [2] G. Stiege, Graphen und Graphalgorithmen, (Shaker; Auflage: 1, 26). [21] G. Valiente, C. Martinez, An algorithm for graph pattern-matching, In Proc. th South American Workshop on String Processing, 1997, volume 8 of Int. Informatics Series. 82