[Paper Review] Model Counting Modulo Theories

Quoc-Sang Phan|arXiv (Cornell University)|Apr 10, 2015

Software Testing and Debugging Techniques110 references7 citations

TL;DR

This paper introduces #SMT (Model Counting Modulo Theories) as a novel framework to accurately and efficiently compute channel capacity in software systems by reducing quantitative information flow (QIF) analysis to model counting over first-order logic formulas. It leverages symbolic execution and SMT solvers to achieve orders-of-magnitude speedups over prior methods, enabling scalable analysis of real-world C and Java programs, including Linux kernel code and anonymity protocols.

ABSTRACT

This thesis is concerned with the quantitative assessment of security in software. More specifically, it tackles the problem of efficient computation of channel capacity, the maximum amount of confidential information leaked by software, measured in Shannon entropy or Rényi's min-entropy. Most approaches to computing channel capacity are either efficient and return only (possibly very loose) upper bounds, or alternatively are inefficient but precise; few target realistic programs. In this thesis, we present a novel approach to the problem by reducing it to a model counting problem on first-order logic, which we name Model Counting Modulo Theories or #SMT for brevity. For quantitative security, our contribution is twofold. First, on the theoretical side we establish the connections between measuring confidentiality leaks and fundamental verification algorithms like Symbolic Execution, SMT solvers and DPLL. Second, exploiting these connections, we develop novel #SMT-based techniques to compute channel capacity, which achieve both accuracy and efficiency. These techniques are scalable to real-world programs, and illustrative case studies include C programs from Linux kernel, a Java program from a European project and anonymity protocols. For formal verification, our contribution is also twofold. First, we introduce and study a new research problem, namely #SMT, which has other potential applications beyond computing channel capacity, such as returning multiple-counterexamples for Bounded Model Checking or automated test generation. Second, we propose an alternative approach for Bounded Model Checking using classical Symbolic Execution, which can be parallelised to leverage modern multi-core and distributed architecture.

Motivation & Objective

• Address the gap in existing QIF techniques that are either imprecise or intractable for realistic programs by proposing a scalable, precise method for channel capacity computation.
• Establish theoretical connections between symbolic execution, DPLL modulo theories, and model counting to unify foundational verification algorithms with quantitative security analysis.
• Develop practical tools—sqifc, jpf-qif, QILURA, JCBMC, and aZ3—to enable automated, scalable analysis of information leaks in C and Java programs.
• Extend the applicability of SMT solving beyond satisfiability to model counting, enabling new applications in bounded model checking, test generation, and reliability analysis.

Proposed method

• Reduce the problem of computing channel capacity to #SMT: counting the number of models of a logical formula representing program traces under confidentiality constraints.
• Integrate symbolic execution with SMT solving to generate path conditions and use an All-SMT solver (aZ3) to enumerate all satisfying models for accurate counting.
• Leverage the correspondence between symbolic execution and the DPLL(𝕋) algorithm to optimize model enumeration and improve scalability.
• Apply the #SMT framework to both static and dynamic program analysis, using symbolic execution to explore all feasible execution paths and count leaking traces.
• Develop JCBMC, a concurrent bounded model checker for Java, using symbolic execution and All-SMT solving to generate multiple counterexamples.
• Use the same #SMT infrastructure for reliability analysis by modeling system failure paths and counting their occurrences with formal guarantees.

Experimental results

Research questions

• RQ1 Can model counting modulo theories (#SMT) be used to accurately and efficiently compute channel capacity in real-world software systems?
• RQ2 What is the theoretical relationship between symbolic execution, DPLL(𝕋), and model counting in the context of quantitative information flow?
• RQ3 How can All-SMT solving be leveraged to generate multiple counterexamples for bounded model checking and improve test generation?
• RQ4 To what extent can #SMT-based techniques scale to complex programs with pointers and dynamic data structures?
• RQ5 Can the same #SMT framework be reused for reliability analysis and fault localization in software systems?

Key findings

• The #SMT-based approach reduced analysis time for Linux kernel programs from hours to just a few seconds, demonstrating significant performance improvements over prior self-composition techniques.
• The framework successfully analyzed real-world C programs (e.g., from the Linux kernel), Java programs from a European project, and anonymity protocols, proving scalability beyond toy examples.
• The development of aZ3, an All-SMT solver, enabled efficient enumeration of all models, which was critical for accurate model counting in QIF and bounded model checking.
• The integration of symbolic execution with SMT solving allowed for precise, scalable analysis of programs with complex data structures, including pointers.
• The approach enabled the first use of symbolic execution for quantitative information flow analysis, establishing a new baseline for precision and performance.
• The connection between QIF and reliability analysis was formalized, showing that model counting can be used to quantify failure probabilities with statistical guarantees.