一句话：提出 ROFER 框架，以维度级变异和消息特征覆盖引导 ROS 程序模糊测试，发现 88 个真实缺陷。
随着越来越多机器人程序基于机器人操作系统（ROS）实现，已有若干工作将模糊测试用于 ROS 程序以检测缺陷，但仍存在测试用例生成低效、程序反馈无效、通用性与自动化程度弱等主要局限。本文设计并实现了新的模糊测试框架 ROFER，相比现有 ROS 模糊测试方法引入两项新技术：其一为维度级变异方法，考虑每个输入维度对测试覆盖的贡献，从多个维度高效生成测试用例；其二为消息引导的模糊测试方法，采用名为消息特征（message feature）的新覆盖度量，反映受多个 ROS 节点影响下机器人可能的状态转移。作者在 ROS2 的 13 个常见机器人程序上评估 ROFER，共发现 88 个真实缺陷，其中 46 个已获 ROS 开发者确认；与四种现有最优 ROS 模糊测试方法相比，ROFER 发现的缺陷更多且测试覆盖率更高。
An increasing number of robotic programs are implemented based on Robot Operating System (ROS), which provides many practical tools and libraries for robot development. To improve robot reliability and security, several recent approaches apply fuzzing to ROS programs for bug detection. However, these approaches still have some main limitations, including inefficient test case generation, ineffective program feedback and weak generality/automation. In this paper, we design a new fuzzing framework named ROFER, to effectively test robotic programs in ROS for bug detection. Compared to existing ROS fuzzing approaches, ROFER has two novel techniques: (1) a dimension-level mutation method that considers the contribution of each input dimension to testing coverage, to generate efficient test cases from multiple dimensions; (2) a message-guided fuzzing approach that uses a new coverage metric named message feature, to reflect the robot's possible state transitions affected by multiple ROS nodes. We evaluate ROFER on 13 common robotic programs in ROS2, and it finds 88 real bugs, 46 of which have been confirmed by ROS developers. We compare ROFER to four state-of-the-art ROS fuzzing approaches, and it finds more bugs with higher testing coverage.