{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,11,18]],"date-time":"2025-11-18T23:15:59Z","timestamp":1763507759241,"version":"3.41.0"},"reference-count":89,"publisher":"Association for Computing Machinery (ACM)","issue":"4","license":[{"start":{"date-parts":[[2020,12,31]],"date-time":"2020-12-31T00:00:00Z","timestamp":1609372800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"funder":[{"DOI":"10.13039\/100000185","name":"Defense Advanced Research Projects Agency","doi-asserted-by":"publisher","award":["FA8650-15-C-7564"],"award-info":[{"award-number":["FA8650-15-C-7564"]}],"id":[{"id":"10.13039\/100000185","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/100000003","name":"Boeing","doi-asserted-by":"publisher","award":["#Z0918-5060"],"award-info":[{"award-number":["#Z0918-5060"]}],"id":[{"id":"10.13039\/100000003","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":["ACM Trans. Program. Lang. Syst."],"published-print":{"date-parts":[[2020,12,31]]},"abstract":"<jats:p>\n            We present K\n            <jats:sc>onure<\/jats:sc>\n            , a new system that uses active learning to infer models of applications that retrieve data from relational databases. K\n            <jats:sc>onure<\/jats:sc>\n            comprises a domain-specific language (each model is a program in this language) and associated inference algorithm that infers models of applications whose behavior can be expressed in this language. The inference algorithm generates inputs and database contents, runs the application, then observes the resulting database traffic and outputs to progressively refine its current model hypothesis. Because the technique works with only externally observable inputs, outputs, and database contents, it can infer the behavior of applications written in arbitrary languages using arbitrary coding styles (as long as the behavior of the application is expressible in the domain-specific language). K\n            <jats:sc>onure<\/jats:sc>\n            also implements a regenerator that produces a translated Python implementation of the application that systematically includes relevant security and error checks.\n          <\/jats:p>","DOI":"10.1145\/3430952","type":"journal-article","created":{"date-parts":[[2021,1,22]],"date-time":"2021-01-22T14:18:51Z","timestamp":1611325131000},"page":"1-119","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":4,"title":["Active Learning for Inference and Regeneration of Applications that Access Databases"],"prefix":"10.1145","volume":"42","author":[{"given":"Jiasi","family":"Shen","sequence":"first","affiliation":[{"name":"MIT EECS 8 CSAIL, Cambridge, MA, USA"}]},{"given":"Martin C.","family":"Rinard","sequence":"additional","affiliation":[{"name":"MIT EECS 8 CSAIL, Cambridge, MA, USA"}]}],"member":"320","published-online":{"date-parts":[[2021,1,22]]},"reference":[{"unstructured":"2018. Enki. Retrieved from https:\/\/github.com\/xaviershay\/enki.","key":"e_1_2_1_1_1"},{"unstructured":"2018. Fulcrum. Retrieved from https:\/\/github.com\/fulcrum-agile\/fulcrum.","key":"e_1_2_1_2_1"},{"unstructured":"2018. Getting Started with Rails. Retrieved from http:\/\/guides.rubyonrails.org\/getting_started.html.","key":"e_1_2_1_3_1"},{"unstructured":"2018. Kandan -- Modern Open Source Chat. Retrieved from https:\/\/github.com\/kandanapp\/kandan.","key":"e_1_2_1_4_1"},{"unstructured":"2019. PLDI 2019 Konure Code. Retrieved from http:\/\/people.csail.mit.edu\/jiasi\/pldi2019.code\/.","key":"e_1_2_1_5_1"},{"unstructured":"2020. Software Assurance Reference Dataset. Retrieved from https:\/\/samate.nist.gov\/SARD\/testsuite.php.","key":"e_1_2_1_6_1"},{"doi-asserted-by":"publisher","key":"e_1_2_1_7_1","DOI":"10.1109\/ICSTW.2013.60"},{"doi-asserted-by":"publisher","key":"e_1_2_1_8_1","DOI":"10.1007\/978-3-642-15375-4_6"},{"doi-asserted-by":"publisher","key":"e_1_2_1_9_1","DOI":"10.1109\/WSE.2009.5631226"},{"doi-asserted-by":"publisher","key":"e_1_2_1_10_1","DOI":"10.1109\/FMCAD.2013.6679385"},{"doi-asserted-by":"publisher","key":"e_1_2_1_11_1","DOI":"10.1016\/0890-5401(87)90052-6"},{"doi-asserted-by":"publisher","key":"e_1_2_1_12_1","DOI":"10.1145\/356914.356918"},{"doi-asserted-by":"publisher","key":"e_1_2_1_13_1","DOI":"10.1145\/1315245.1315249"},{"doi-asserted-by":"publisher","key":"e_1_2_1_14_1","DOI":"10.1145\/2442516.2442529"},{"doi-asserted-by":"publisher","key":"e_1_2_1_15_1","DOI":"10.1145\/3062341.3062349"},{"doi-asserted-by":"publisher","key":"e_1_2_1_16_1","DOI":"10.1145\/3192366.3192383"},{"key":"e_1_2_1_17_1","volume-title":"Proceedings of the 7th International Conference on Verified Software: Theories, Tools, and Experiments (VSTTE\u201915)","author":"Beyene Tewodros A.","year":"2015","unstructured":"Tewodros A. Beyene, Swarat Chaudhuri, Corneliu Popeea, and Andrey Rybalchenko. 2015. Recursive games for compositional program synthesis. In Proceedings of the 7th International Conference on Verified Software: Theories, Tools, and Experiments (VSTTE\u201915). 19--39."},{"doi-asserted-by":"publisher","key":"e_1_2_1_18_1","DOI":"10.1145\/1698750.1698754"},{"doi-asserted-by":"publisher","key":"e_1_2_1_19_1","DOI":"10.1145\/1007512.1007539"},{"key":"e_1_2_1_20_1","volume-title":"Bradley and Zohar Manna","author":"Aaron","year":"2007","unstructured":"Aaron R. Bradley and Zohar Manna. 2007. The Calculus of Computation: Decision Procedures with Applications to Verification. Springer Science 8 Business Media."},{"doi-asserted-by":"publisher","key":"e_1_2_1_21_1","DOI":"10.1145\/1180405.1180445"},{"doi-asserted-by":"publisher","key":"e_1_2_1_22_1","DOI":"10.1145\/3359591.3359732"},{"doi-asserted-by":"publisher","key":"e_1_2_1_23_1","DOI":"10.1007\/s00165-016-0355-5"},{"doi-asserted-by":"publisher","key":"e_1_2_1_24_1","DOI":"10.1145\/2491956.2462180"},{"doi-asserted-by":"publisher","key":"e_1_2_1_25_1","DOI":"10.1109\/TSE.1978.231496"},{"key":"e_1_2_1_26_1","volume-title":"Proceedings of the 8th Biennial Conference on Innovative Data Systems Research (CIDR\u201917)","author":"Chu Shumo","year":"2017","unstructured":"Shumo Chu, Chenglong Wang, Konstantin Weitz, and Alvin Cheung. 2017. Cosette: An automated prover for SQL. In Proceedings of the 8th Biennial Conference on Innovative Data Systems Research (CIDR\u201917). Retrieved from http:\/\/cidrdb.org\/cidr2017\/papers\/p51-chu-cidr17.pdf."},{"volume-title":"Generative and Transformational Techniques in Software","author":"Cleve Anthony","unstructured":"Anthony Cleve, Nesrine Noughi, and Jean-Luc Hainaut. 2013. Dynamic program analysis for database reverse engineering. In Generative and Transformational Techniques in Software Engineering IV. Springer, 297--321.","key":"e_1_2_1_27_1"},{"doi-asserted-by":"publisher","key":"e_1_2_1_28_1","DOI":"10.1145\/958961.958962"},{"doi-asserted-by":"publisher","key":"e_1_2_1_29_1","DOI":"10.1109\/TSE.2009.28"},{"doi-asserted-by":"publisher","key":"e_1_2_1_30_1","DOI":"10.1109\/WCRE.2000.891454"},{"key":"e_1_2_1_31_1","volume-title":"Proceedings of the 24th USENIX Conference on Security Symposium (SEC\u201915)","author":"Ruiter Joeri De","year":"2015","unstructured":"Joeri De Ruiter and Erik Poll. 2015. Protocol state fuzzing of TLS implementations. In Proceedings of the 24th USENIX Conference on Security Symposium (SEC\u201915). USENIX Association, Berkeley, CA, 193--206."},{"key":"e_1_2_1_32_1","volume-title":"Proceedings of the Conference on Advances in Neural Information Processing Systems. 1289--1297","author":"Ellis Kevin","year":"2016","unstructured":"Kevin Ellis, Armando Solar-Lezama, and Josh Tenenbaum. 2016. Sampling for Bayesian program learning. In Proceedings of the Conference on Advances in Neural Information Processing Systems. 1289--1297."},{"doi-asserted-by":"publisher","key":"e_1_2_1_33_1","DOI":"10.1145\/3192366.3192382"},{"doi-asserted-by":"publisher","key":"e_1_2_1_34_1","DOI":"10.1145\/3062341.3062351"},{"doi-asserted-by":"publisher","key":"e_1_2_1_35_1","DOI":"10.1145\/2737924.2737977"},{"doi-asserted-by":"publisher","key":"e_1_2_1_36_1","DOI":"10.1007\/978-3-319-41540-6_25"},{"doi-asserted-by":"publisher","key":"e_1_2_1_37_1","DOI":"10.1109\/COMPSAC.2007.43"},{"doi-asserted-by":"publisher","key":"e_1_2_1_38_1","DOI":"10.1109\/ICSE.2009.5070546"},{"volume-title":"Proceedings of the 27th International Conference on Computer-Aided Verification (CAV\u201915)","author":"Gehr Timon","unstructured":"Timon Gehr, Dimitar Dimitrov, and Martin T. Vechev. 2015. Learning commutativity specifications. In Proceedings of the 27th International Conference on Computer-Aided Verification (CAV\u201915). 307--323.","key":"e_1_2_1_39_1"},{"doi-asserted-by":"publisher","key":"e_1_2_1_40_1","DOI":"10.1145\/1065010.1065036"},{"doi-asserted-by":"publisher","key":"e_1_2_1_41_1","DOI":"10.1145\/2090147.2094081"},{"doi-asserted-by":"publisher","key":"e_1_2_1_42_1","DOI":"10.1016\/j.tcs.2010.07.008"},{"doi-asserted-by":"publisher","key":"e_1_2_1_43_1","DOI":"10.1561\/2500000010"},{"doi-asserted-by":"publisher","key":"e_1_2_1_44_1","DOI":"10.1109\/ICDE.2010.5447862"},{"doi-asserted-by":"publisher","key":"e_1_2_1_45_1","DOI":"10.1109\/ISCC.2010.5546750"},{"doi-asserted-by":"publisher","key":"e_1_2_1_46_1","DOI":"10.1145\/1101908.1101935"},{"doi-asserted-by":"publisher","key":"e_1_2_1_47_1","DOI":"10.1145\/2786805.2786875"},{"doi-asserted-by":"publisher","key":"e_1_2_1_48_1","DOI":"10.1007\/978-3-319-11164-3_26"},{"doi-asserted-by":"publisher","key":"e_1_2_1_49_1","DOI":"10.1145\/2884781.2884856"},{"doi-asserted-by":"publisher","key":"e_1_2_1_50_1","DOI":"10.1145\/2786805.2803189"},{"doi-asserted-by":"publisher","key":"e_1_2_1_51_1","DOI":"10.1145\/1806799.1806833"},{"doi-asserted-by":"publisher","key":"e_1_2_1_52_1","DOI":"10.1109\/SP.2006.29"},{"volume-title":"Proceedings of the USENIX Security Symposium (SSYM\u201905)","author":"Benjamin Livshits V.","unstructured":"V. Benjamin Livshits and Monica S. Lam. 2005. Finding security vulnerabilities in Java applications with static analysis. In Proceedings of the USENIX Security Symposium (SSYM\u201905). 18--18.","key":"e_1_2_1_53_1"},{"doi-asserted-by":"publisher","key":"e_1_2_1_54_1","DOI":"10.5555\/2337223.2337233"},{"key":"e_1_2_1_55_1","volume-title":"Proceedings of the 34th International Conference on Software Engineering (ICSE\u201912)","author":"Lo David","year":"2012","unstructured":"Lucia, David Lo, Lingxiao Jiang, and Aditya Budi. 2012. Active refinement of clone anomaly reports. In Proceedings of the 34th International Conference on Software Engineering (ICSE\u201912). IEEE Press, 397--407."},{"key":"e_1_2_1_56_1","first-page":"129","article-title":"Gedanken\u2014Experiments on sequential machines","volume":"34","author":"Moore Edward F.","year":"1956","unstructured":"Edward F. Moore. 1956. Gedanken\u2014Experiments on sequential machines. Autom. Stud. 34 (1956), 129--153.","journal-title":"Autom. Stud."},{"doi-asserted-by":"publisher","key":"e_1_2_1_57_1","DOI":"10.1145\/2597008.2597790"},{"doi-asserted-by":"publisher","key":"e_1_2_1_58_1","DOI":"10.1145\/2594291.2594297"},{"doi-asserted-by":"publisher","key":"e_1_2_1_59_1","DOI":"10.1007\/978-3-319-40667-1_3"},{"doi-asserted-by":"publisher","key":"e_1_2_1_60_1","DOI":"10.1109\/ICSE-C.2017.87"},{"doi-asserted-by":"publisher","key":"e_1_2_1_61_1","DOI":"10.1145\/2908080.2908093"},{"key":"e_1_2_1_62_1","volume-title":"Proceedings of the 35th International Conference on Machine Learning (Proceedings of Machine Learning Research)","volume":"80","author":"Pu Yewen","year":"2018","unstructured":"Yewen Pu, Zachery Miranda, Armando Solar-Lezama, and Leslie Kaelbling. 2018. Selecting representative examples for program synthesis. In Proceedings of the 35th International Conference on Machine Learning (Proceedings of Machine Learning Research), Vol. 80. PMLR, 4161--4170. Retrieved from http:\/\/proceedings.mlr.press\/v80\/pu18b.html."},{"doi-asserted-by":"publisher","key":"e_1_2_1_63_1","DOI":"10.1145\/3180155.3180232"},{"doi-asserted-by":"publisher","key":"e_1_2_1_64_1","DOI":"10.1145\/1081180.1081189"},{"volume-title":"Database Programming with JDBC and JAVA. O\u2019Reilly Media","author":"Reese George","unstructured":"George Reese. 2000. Database Programming with JDBC and JAVA. O\u2019Reilly Media, Inc.","key":"e_1_2_1_65_1"},{"doi-asserted-by":"publisher","key":"e_1_2_1_66_1","DOI":"10.1145\/1297027.1297072"},{"doi-asserted-by":"publisher","key":"e_1_2_1_67_1","DOI":"10.1145\/3276954.3276959"},{"doi-asserted-by":"publisher","key":"e_1_2_1_68_1","DOI":"10.1145\/1081706.1081750"},{"doi-asserted-by":"publisher","key":"e_1_2_1_71_1","DOI":"10.1145\/3314221.3314591"},{"doi-asserted-by":"publisher","key":"e_1_2_1_72_1","DOI":"10.1145\/3236024.3236034"},{"doi-asserted-by":"publisher","key":"e_1_2_1_73_1","DOI":"10.1145\/2694344.2694389"},{"doi-asserted-by":"publisher","key":"e_1_2_1_74_1","DOI":"10.1145\/1168857.1168907"},{"doi-asserted-by":"publisher","key":"e_1_2_1_75_1","DOI":"10.1109\/ICSE.2015.231"},{"doi-asserted-by":"publisher","key":"e_1_2_1_76_1","DOI":"10.1145\/2967606"},{"doi-asserted-by":"crossref","unstructured":"Margus Veanes Pavel Grigorenko Peli de Halleux and Nikolai Tillmann. 2009. Symbolic query exploration. In Formal Methods and Software Engineering Karin Breitman and Ana Cavalcanti (Eds.). Springer Berlin 49--68.","key":"e_1_2_1_77_1","DOI":"10.1007\/978-3-642-10373-5_3"},{"key":"e_1_2_1_78_1","volume-title":"Qex: Symbolic SQL query explorer. In Logic for Programming, Artificial Intelligence, and Reasoning, Edmund M","author":"Veanes Margus","year":"2010","unstructured":"Margus Veanes, Nikolai Tillmann, and Jonathan de Halleux. 2010. Qex: Symbolic SQL query explorer. In Logic for Programming, Artificial Intelligence, and Reasoning, Edmund M. Clarke and Andrei Voronkov (Eds.). Springer Berlin, 425--446."},{"key":"e_1_2_1_79_1","volume-title":"Approximate active learning of nondeterministic input output transition systems. Electron. Commun. EASST 72","author":"Volpato Michele","year":"2015","unstructured":"Michele Volpato and Jan Tretmans. 2015. Approximate active learning of nondeterministic input output transition systems. Electron. Commun. EASST 72 (2015)."},{"doi-asserted-by":"publisher","key":"e_1_2_1_80_1","DOI":"10.1145\/3062341.3062365"},{"doi-asserted-by":"publisher","key":"e_1_2_1_81_1","DOI":"10.1145\/3276527"},{"doi-asserted-by":"publisher","key":"e_1_2_1_82_1","DOI":"10.1145\/2642937.2642947"},{"doi-asserted-by":"publisher","key":"e_1_2_1_83_1","DOI":"10.1145\/3158151"},{"key":"e_1_2_1_84_1","volume-title":"Mysql Reference Manual","author":"Widenius Michael","unstructured":"Michael Widenius and Davis Axmark. 2002. Mysql Reference Manual (1st ed.). O\u2019Reilly 8 Associates, Inc., Sebastopol, CA.","edition":"1"},{"volume-title":"Using Dynamic Analysis to Infer Python Programs and Convert Them into Database Programs. Master\u2019s thesis","author":"Jerry Wu.","unstructured":"Jerry Wu. 2018. Using Dynamic Analysis to Infer Python Programs and Convert Them into Database Programs. Master\u2019s thesis. Massachusetts Institute of Technology, Cambridge, MA.","key":"e_1_2_1_85_1"},{"doi-asserted-by":"publisher","key":"e_1_2_1_86_1","DOI":"10.1145\/3005745.3005754"},{"doi-asserted-by":"publisher","key":"e_1_2_1_87_1","DOI":"10.1145\/2908080.2908088"},{"doi-asserted-by":"publisher","key":"e_1_2_1_88_1","DOI":"10.1145\/3187009.3177735"},{"doi-asserted-by":"publisher","key":"e_1_2_1_89_1","DOI":"10.1145\/3133887"},{"doi-asserted-by":"publisher","key":"e_1_2_1_90_1","DOI":"10.1145\/3132847.3132954"},{"key":"e_1_2_1_91_1","volume-title":"Proceedings of the 26th International Conference on Software Engineering (ICSE\u201904)","author":"Yan Hong","year":"2004","unstructured":"Hong Yan, David Garlan, Bradley Schmerl, Jonathan Aldrich, and Rick Kazman. 2004. DiscoTect: A system for discovering architectures from running systems. In Proceedings of the 26th International Conference on Software Engineering (ICSE\u201904). IEEE Computer Society, Washington, DC, 470--479."}],"container-title":["ACM Transactions on Programming Languages and Systems"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3430952","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3430952","content-type":"application\/pdf","content-version":"vor","intended-application":"syndication"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3430952","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,17]],"date-time":"2025-06-17T21:24:43Z","timestamp":1750195483000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3430952"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2020,12,31]]},"references-count":89,"journal-issue":{"issue":"4","published-print":{"date-parts":[[2020,12,31]]}},"alternative-id":["10.1145\/3430952"],"URL":"https:\/\/doi.org\/10.1145\/3430952","relation":{},"ISSN":["0164-0925","1558-4593"],"issn-type":[{"type":"print","value":"0164-0925"},{"type":"electronic","value":"1558-4593"}],"subject":[],"published":{"date-parts":[[2020,12,31]]},"assertion":[{"value":"2019-05-01","order":0,"name":"received","label":"Received","group":{"name":"publication_history","label":"Publication History"}},{"value":"2020-10-01","order":1,"name":"accepted","label":"Accepted","group":{"name":"publication_history","label":"Publication History"}},{"value":"2021-01-22","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}